MalScore
100/100
MalFamily
Nanocore

po.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 19/65 Related 2238
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 350.50 KB (358912 bytes)
Compile time: 2018-05-04 00:24:04
MD5: ac5034baaea3df6ec5c5b49678f364cb
SHA1: 975a75d5f3b1111ac29edaf7cd665c77822a0f9b
SHA256: 246546d9efbeb7b0b76fad8dca8893a68208d9add16328a1eb3c91ae86fcd799
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-05-18 04:15:08
Last submission: 2018-05-18 04:15:08
Filename detected: - po.exe (1)
URL file hosting
hXXp://medconrx.com/done/po.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-05-07 00:27:04 [19/65] VirusTotal
PE Sections 2 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0x53204 340992 b1f3ae852e4e1d50f4bedef5c084571e 56f091e5fae49933ce7164fd78fb899baaa23a0d
.rsrc 0x56000 0x416c 16896 1902896dcb24dcced097011d8f980056 25cd9103baa126e58ceaba3ff0fac900f72abed6
.reloc 0x5c000 0xc 512 b0151e81067cfc4234c3ab79a3a7c310 b8919fff1a7428166366cb00d50723cb71fe8bdd
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x57658 9640 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x59c00 48 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_VERSION 0x59c30 1340 LANG_ENGLISH SUBLANG_ENGLISH_US
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: \xa9 2010 Microsoft Corporation. All rights reserved.
InternalName: msoxmled.exe
FileVersion: 14.0.4750.1000
CompanyName: Microsoft Corporation
LegalTrademarks1: Microsoft\xae is a registered trademark of Microsoft Corporation.
LegalTrademarks3: InfoPath\xae is a registered trademark of Microsoft Corporation.
LegalTrademarks2: Windows\xae is a registered trademark of Microsoft Corporation.
ProductName: Microsoft Office InfoPath
ProductVersion: 14.0.4750.1000
FileDescription: XML Editor
Translation: 0x0000 0x04e4
OriginalFilename: msoxmled.exe
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Library
mscoree.dll
IP Found
No IP detected
URL(s)
No URL found
XML Editor
4JqkPjgg9Dd11vbfumaiT
vx3PPSlFSn4NZ8eTCx1eZmV5tocnz4dWti
5BH6Hz5kLEdZyxqYMv3cU4p1Sx3JRhLE0qhhk
2010 Microsoft Corporation. All rights reserved.
VarFileInfo
62HLr1BrE8eV04AmJQyx5y
BKoxaAVjDmeMxHQQAn6otDnKeQyGLmoDSUyM
Ut6jG6MnNXuvSZKURccoViUE
0RU
EQo7sXePbON2STF6xYihtGM7WWwQu4mqkv1Et
is a registered trademark of Microsoft Corporation.
po9wQnITwkwsIKVyHyWu8OIlCXM9PzFHKi
KREfy2fHo6cnyQBgPtgTxlEs
R8pYhbvhc1e2kvONTVYZSRf6crqutpAL
byv6kNavSbmAfkAjoUsbBw9X
InternalName
IuFsQjjC4IyphJAl8QOWh4fgMyXZQ2Iegvw5hKC
Microsoft Office InfoPath
TSrvYmAkFOCXiD0dbQ5afNzURDJY
LegalCopyright
60hQ7mhP29gIYOiycCrP5JzPn1XGxaUVxQJ4F
plosU4FkPefbjNVVP2b15tw68Uak7H
DMQnkjjd1McK42TUZ5mym
OHJeUswjVMP9WUAT0c8h7I8ZWh3OJd
LegalTrademarks1
Translation
msoxmled.exe
Windows
StringFileInfo
MBH1Hrr2UwdTAXPEWBMXASJhJOO46FvRQY7UqEC
bdbhsdjxG3rs1f8OpquNvoV
RxRZ0AVIaplNTCRG7yk2l
56hK79zRW0O4MGcPe23dfRJcTYpCY6mJbBQ
VczwtOL1LjFuP7N7q8uy
7syN628v8PAO9Pc5BNAsZYLDREoNAhFs1D
FileVersion
000004E4
VS_VERSION_INFO
bIiJEYd1ckkZm2Qyp33U1kfRdRAED75waOMI
LegalTrademarks3
LegalTrademarks2
BPIIGmcatNTxT3Hrl6CoIsYuovot7f9
q1mTHkgDf68aNXzxGCalWkXkiIdjmgNv
05FncQvyDX3DBuQsojObIzkyfNGw
ProductVersion
BafDWau9ZtG2KnfzpRBMg639pgJUI2uL0I
FileDescription
j0sLTIXuJzmZncinLzI5UD4hYXeJDvD3GNOP
DPwaIBqvNobEj7FFUfilef
Microsoft
OriginalFilename
1TAGTaE9dQikqZvXGgDRca
14.0.4750.1000
d5Q6Q9UrvuK7h8YD3mvuUCce9k53GGrkGShxRjB
CompanyName
MKsDhkxMBUp92rSE7jCJwzGS
b4G0i8BJktAI4BrbwlI3oXh6
ProductName
FC8asbGt132PjSiTH2sXnZQPzjsdq
Microsoft Corporation
PVYWXohkmRpnufxCRkG659YZ
rSELCKhmxlWk4sr6FaTJpoWAiWNP5tA9W
InfoPath
ZmC1m9nSiRPdhfuzvqFBccdhBRYYHlzXW
Yyo*F
{.,m?
vBL k
n8pb'4
,| %
oe "gZ
Itpd
\bEV`
Z UD
byv6kNavSbmAfkAjoUsbBw9X
;b<[
uPi[
= B90\B8
t7&_zS3
IOCn
'c@[
>r:9
Mcw)
Ob S
ZYz[
^ WY
Rc-Z
EN:E
"Jw6
8U6j
@< X9
K`2d
)/ Y
)9A h
,;1#
M?^z
.kc;
ocCT
eFP
7%^L
dw?/
0u5C
Qgul*
:n&{
?Y/C
BT=*
@V7EY
8dG~
>bF`
{ Z\L
ZC^v
6u'y
oA?
=ubx'
x
|r$};
M&UK:
pWu"?H
!qHAS
*-Jb\
}fG1
<#0<
0~[y(Sx
d>~1
E-i
D/dhU
/{+9S
p5z3y
/ Ft
- pN&
mGm:
\]('
K!5d
*{sM
,~?(0%
G^8AoV
pd\M
[ q<
\?O(
Uw1t
j#uA<q
M7 '
5TCO0
Gn K
BC6=
}. S
D>ik1f+$
PYGlT
GUUc
x{Z82
wqr5
R *
xxI1
m g9)c[4
RY8:
7{9~"
^.$30
7'-#
lV)xM
#5}su
;d[A
>@s>~#
JK qR1!6
R"R^8g
K{e
]P s>
gv p
|'EC
+j l
9B2E:
f5c]fm
YGIblR
.<x
iC &
System
#{!aEL
I3nd2
^desU/Y
P3%L
%$U1
Q !Y
8G&
fo#I
D<-=*
HSHm
AY\A
QJ 6
w],y
)F>
p^n1
wAG_
JVX
lX-+.jNxe
rFyc]Mo
ks Y
5%2r
-$a.
%yu
-.?oF
m[ 1m
n~5R
W}HT
-Wu-.v
#Zjo
Z^4{
~}a_
h;Q;
y|wj
Z! /
Y>r
g[YI4Q
0pW]
z0|ME
7CVh
KR})
F\I# q
^98|m
P3?
-#)C
ltP,
+j}
h:-G
System.Security
=^"z
) f1
t8)X
b/&%
WT>
<[ Y9
* ml
k{>,W@
K+Zg
[?Ax
* hJ*QTn
gRSX
%UM-Sy
~U@8
o:6g
92;q
.v+b&
$MN+
fl ]
.Qn~
P@U34 4/op
Ax{:
rss
-mXG
JSrLn
X<:@
plosU4FkPefbjNVVP2b15tw68Uak7H.resources
Ck{99%
GHRw
pClDds
rt]K
#'b\e
+t,_
<f/]*}
u7 X
gfD;
_6ZY
P5-)
r ZWO
y8a~A?
<1I.
}KJN
PSS<
Vb"Z
@ Y2/ l
mcJ9
V>Ty
6*ck
pZYp
|;?
wgT
zNPq
e*>1
,M2X
%yhR
iCA-hR
$jI>
U5$K$Fzw
|^YQx
tD]
L$kR
;X2MS
WIbGE
&~tJV
8lN<)
432Q
f*,-
$<"t
'=8c
'MBH1Hrr2UwdTAXPEWBMXASJhJOO46FvRQY7UqEC
4cr1[a
|Rw@
8][D
wHdu@
YzU@ar0
JD~W
Yi9L
un}MH
`g:a
$*7
#Z4$v
;:*4r?
$x;N
b6aO
|Q K
AddRange
-2cY
[Ei d]
Y/4g
b)W:p
8E)k
ko-A
K'LV
A9g&
'IXZ$
IFB:
av1Y
$Ij5
gV@u
l<Id
:wsh
Ig<d_6'
eqQ/
D^x%
J J
IE;h
7Mhe
\ hk
X "D;
*pJq#x
v2.0.50727
e]bPx
ED
+Xri
A Yuf
}I+h
!59T
,?c,S
iZ p
:?OT
^#D
_u :
*<^.
&a2
E V~
? O
m&CJ
$n_
k9w(
5dbJ/
&w-?{
\7v/
dV+t
pz#L
f-vx
5^n=
VmrF
(7%B
; &[~
e"cM
@Caz
~ "J)b
SV*;
NFDI
1'+1
d?1ndA
E\`X
!*x5
-,ey =
x&I7
Fe">
6H=,v
wAVw
j^<n
$7xW
dPO<
yI9_v{$
q9mX
;-L<1
U\cRJ
[_(/
RxRZ0AVIaplNTCRG7yk2l
.2 k`
g{fT
N%3k
)>NDFs
x2pI
UK"e
'@|
!o^
V kT
yEvb
[ D|
OK*2+
]LqB
qcsn
`eq:@
JVB<
,}W6
{T<k4
$"IZU
)QSH
~dz)
g$vBB)X
+Ln9s
#"A0
aLBg
F=C8
t*$FN
qel!
<lthX<
#Blob
xQ B
} kP
o3wG2
^gOS6.
rn 1
r]al
~mhq
7YE)
z`@(
Fawv
D(rg
z,H!L;
WU?U&
]MS:<
g T)
"OByr
]_Zrr
sRJn%
m)Z5
B@,4
I0!f
{>%S
>cis
xL 1
Pd]t
1kXa0{
47$}
jP|!T
;&cI0
KREfy2fHo6cnyQBgPtgTxlEs
Type
SXhx
xJ5fF
F5M|
/wqQ Iu
Wu"0
Iiv
Kr"3
vDk(
m!_I
-)< Z
/>n
l[6!W
u6GW
M+1rV
y[w _zD
Y@$q
#}8q
7 +5*
UQVO
w 6`I~
;fv#
p,` *
'5>-B
#jSI
}_=BS
M,>FR
`X?`
dtz@3\
)u,t
x@n
N@<ngq~t
Bz>9
-Q2GW$
}tQY
x>,be
,a|br6
BwLn@
>Hlw
1)Uj
j_I(f
9qa+
SJqG
[l=<
<iT
U z
CXuWm
wBRks
9 Q9
[k4$
7N-
B^Ab
9f/)
f"@s[
o&Zl
{wFB
L!$8
+vBO
] @
CxP
* zo
UviV
-VNrwp
j$!K)1
$+.1IU
*pCv
9os5
=vAm
?2BE"f
~(d=
^ *^l
WnKw
X.XK
o\~
M24<
1 8r
4~^r
*x(
[h=%
^1f %R
F}gO
J, M
_C E(
! >j
s[B
uD,51\X
yvpt3
~K6p.
Wd}-pA
@ mk
2pio
E_<:$
s|6g?
?P{b2
g1{xR
iTs] Rh
nW$k
>>{g
p~I#DE
i_L&H
[?7z
U9T.;
^8 a
lrJp
>Y"h
zD1
>jQv
/*uV
L|5':xJ4
WgCL*Z
8ijNO`
/ X`
7A E
}@u{
_ w9
flF*
CAi
`=Ku
m|~
p}sz
dQ02
V@ M
Bbm"
=ci]
5l$[P
t C+;
>]:`K
)i%'
Gk!%
2Tp
i
\x?j
T6FtI
b##<ao$
h/Yl
^az[
07R:
a)'c
Y( l
(3Nb
f6t|3
Exception
9E<l"3
DG.9
~"?y
aWuOx8
"5Z~
(vo93
ry3:P
hK y
tD18
G Gp
$y3z
),$<
-;^+&
LX:3
.text
>VdIj*
N]9V
&k-Q
!Y(k4p
7$l%
BHLDJ
U(Gm
GetObject
\BDe
b~E[o
3 um
.@=U
acB5h
#c;%`
_YRr
0l6?c*}
"po9wQnITwkwsIKVyHyWu8OIlCXM9PzFHKi
w)
eaLw
IECyqgz
hN :
Ec8
},RJ
bGMF
X X1
Gi%>A>
sa2%o}GY
\v~L
A@ o
uu!W
q>Cp
eJ 'U
qiou]h
g>Y:
jxT:vU
WP >
| V_
FCS+
naL?
R`kmZ
Fdr+
@u*z
+V!
3U"G
j]U4n
M3
|P=.
#pNN;
SkipVerification
CreateDecryptor
q98hY
W'VL
[2_!`I
f%[%JzF,
I HU
.>p:
Cz1^gg0
=\<(
X _Cv
QSr
[ m/
|B!e-Ai
%.J^
V 8hQ
Wa-8B\
l![
XX+T
7u":
aNgm
]sm
#/:0?$
O$ZK
EKhe
b dg
#LnQ#
,:)h
75ONJ
65:M
4\6 V
D%({I=n
~1@r&
jteh
D1$w2
, "E
-vb'z
. Vh
4 iu
3x}/
w2C,U
#3+@
+3{q
SOn@
4IX@
')Jj
mZl@
sg(E
EG#
q*hq
=I_V
lx*a
*.x`-
m. t
z@KhQ
1^d{
W!cEM =
&@&\
7H"!
RuntimeTypeHandle
%374
M$,&
KzC}
vsa`
;@sj
a^2\
'k @gd
*Tz5
XH|j
K~[M
)y{ 7
9exH
TpUH
:2]yH+4
@1!p
PsgfzX
C kk
Y'bi#e z;
eZ`<7
)`iC
fr{ CE
"-98
&6 q
o43e
1 e_[$L
$c=
PN=2p
OoD&d
k;Q>^h
jWv mZ.
k e
,&^J
w2ho
S^nX
5saf
bFXb
L5Ds
E.l65{
_0[xS
^Q}(8
gZ | 0
hfjW$JJ\
L}Giz
-fkiO
L0S.
2bNtNVq
J{T+
.ctor
8<)Y
IO"Rza#
a$V&
Q#_)E
g9Kg
3wV#
yP py
HL[pF
FI!,
Fx^]
o+o)
y~E~
rRM9
jRu"
nI# S
zr>9\
SEXD
^aYy
9Z!s
@A,h"
97X)
kI:n
g 2
zu#^
1Ih
:Js
J\;
xvNoE
pQ^M
[]i4#
LX~!
DialogResult
&Qw8
sf5z
H@9S-
'W4X
8^/g(
&<iW
p9gU;
q= T
>}E1.
?G*)
i9-+R
/n fJ
2zG4
4r0b]
&ev`
Z\ ~
-0#i
GG@&
5'v@/g
vr7T
XI?1
G[_g.
LDWZ
*=Wzr
/J",
xT*gSz
Kt7
q>)_
d0D&
\&zT
v7_B6
,laHZ
;=ozFT
L)[+@
4VMs00/)I5
>7?"L?'
mluD
g72ce
eW@#
3vs,f
_\'$Q?
%oWZr
cACMkp
00?>\u
aBaJNe
5r1y
" ":
ELr<Q
97}Q%
:F{'
v_kj
U-dN
uv*)b
]JN\5
P%cp
},qg
h#c;G
nW # ?
'*w}
~E1(
9p*<
] 8xP
{Z{%
6O%2
&?JQ
Giy6
]d]8O
,xHg
v8\(
K|kU
0:U$
btbT
_M5V
VxWeK
9z\,
kLf: 6
(.D Cq
I VP+
]t,,
Qg1$S
^ E H
LWaB
-_X D
Bo9uX
v 8
:5e.
0@l'
>mlC
pxN[
wop
??bk
E{n_ T=
BRI7AM
2X [%
+:9c ~
6[4+
9w 0
]9W*
fo )<(
bKH=%
M?8L
^t-,\
+vA@B
!_wY
CzF~@j
1:(%
$DIp6
gg?Z|`
L86-'
ky k|0
jk?
w7(~
-e0VX
%@o
QL!K
ga?k
}DNf
n",}
X ~
5!L
;>pJ"
iIXJT
MsE]
, 5D
b)Fu.
$j0sLTIXuJzmZncinLzI5UD4hYXeJDvD3GNOP
dVu
\@iG
2bm
(4'E
v7zJ
Rs\?
ykTN
1q\
get_CurrentDomain
U7c
q$QR
*|>I-
;j/p
,0~~
YJH@
u5rt
{ECN\'
Invoke
nYQ/d
Qm~k
xZCt
b$9Xu
Av'N
uJ5x
9'PT>
-mHB
$w,U
6B1&
/(3x
!C i
9U 9{R
w[$WO
%ukf0
Ci?6G=%
=kzB,
I9*7Z Z|T
5Nk1j'1 -
c$ixG
M.@`
#_.I
LIw
d`3_|~
,/f<#
6ki,
PK J
Y 46
eA|f
!J[f
RFU*.
Q.gj-
||..
Xp xU
5*r
6>8K
_*>M
[QT"L
hVgP
'`wH
d FDz
i60 @
x-3T0K
fS7!2p
3igE>
l Cr
3:lU
NsGig
q0),
J]c\
X>KW
?61h
bP'!
2S$7
kx#}G
0,~t
MuGx
AO8!
FrD+
ozx`
+K
V)SNZ
d u>
RwDLF@?$^
@!ZS
hed"'
|1_!<B
s:Bq
UoB,m
{I C
mo`0Qe
h3vb9
$?/fRv
d/Ph
BPIIGmcatNTxT3Hrl6CoIsYuovot7f9
- O
#@bpd
.B!gzm3
(\1L@
E]WS[
::m`
m$>%8
pIzI
I@4
MC H
{<F[C6F
!ihC
33?_7
6"%*
XZ*y
/E~\
8"mu
g~xu{PgNXw(
G!\RO
Sa/G
e}=%}
{"NN<
c{-*
.&4i
m1 i
e ?wq
6dg_
{c%
; Su
iRk5
-dkTcSK
-?p'
<kk6
!H^[i
$uV]
V/2UT
&uak0
zZlcD
<j&#
C}`$
jP7N
#9?AI8
}^hg
3w1G<
z4|mh
`f_w
jp{T
WDc<$3
<pEbI
V:la
o=hXM{
SkB
Dot}
{Wf0|
2 Jd
e/hB0n
J.J7l&
T s4Qki
wAPI
4*9.
N 3yiC
egQ$
)-oZS
@S>^/.H
`kA`
jSHl
"=YO
r,Z_
Z"GE
T>LEYR
u7?g[kRr
)qBVy
yb=8
|:-^
"RBN
fRrC
J'J:
"jdFB
G`hv
3`yj
( g'
Y #?
Qa3V
]U\]pcL/
ezK=
myy X[
'0?Q"
+B`W
7xX@
<6Kx\
_L~D
xYqk
`3c |I
E=Gq-
P}3Y=PZ
:UrLc
)hKz
/:cP
pf, uA
PN ,j
$T-Ge
09\
#*D
}`kV3M
5ge p
[ ./
/CU;
^]X
31s!
*$fV C
D6
]XY:
w_o0^h;
mMyV $
#emR
3QHz
Ut6jG6MnNXuvSZKURccoViUE
&N;{W
[YEF
v'z]T
Ydl]{
-{s
)v#'k
3`^})
FIJ0<
N%?,
IUCy\
saYg
.+Ml
r0?@
ho y
so?u
/=Sj
jp%`
V~k e
O,"M
j zu;
x^*ol0
/zQKI
oS:"F)
$t.@eo
$4Bk
.Y2\5
KVLL
~mMUV
C*rj*
;;4
'"9
mscoree.dll
get_EntryPoint
-a-e
Wx]G
qy^}
3{]5
HmN5
#bI ]
vfZC
Ry :T
FVGLJ
s >-x
Z"x<
>NdN
pt=x
u3B%
& u
,WyesG
$DG/
wD[7
T!o\+{
!o]q
?R[el
[UzN;
Ccl<P$
-0F 6$
W}Yu
#ssPK
6}l1
4a>"/j>K
>ZlB
`iC`
~w{9Cl
$N q
AVf:/!
wP]c7\k9
z"J{
~ Ay`
8^0
DI"_(
oRv?
F#T/Q vX
C%9R?6
NA##
@24Ch
a&/g
!b@
S,d\
y{h#
RlnST
QS-j
Ixd
!?.g
?/<U
.YI@BsqH
@0I=N-`ph
q@ka
P;2i
tnAT
AMz"
x6PM
</25
7g\C;
>Bf4
7.r&
k.ea
Au2j
'v?q
DkIQ
?O s
-a2/B
* |j
QJQL
&muiG
vF2Y
br~.
o:\g
BXOT
D4)5
1 I
(_~h
SX7N
8R4$7
|J7/g
UlEJ
=Uy$
faMhu
Es[/
1'RMS6
9% U
y0?B
ksruE
TP9>
ObUUl,?
a*lq
x#pv#
?^`M
VT`6f
lv@}
j C
KohT
NJ
?tp^>r
TSrvYmAkFOCXiD0dbQ5afNzURDJY
S(Z_
jG:,
X5vF)
B!,S)
T$ze%w)
jm;j
/:0&'
\c-Nl
27mY0
L-3 s
%6{+D
I <
pe@}x|
]/i4
=>e
`Y`\G
$vMKt
XUD
8-S
J.Vm3
.0`l
` eL
+-br
bpy0
+486
wv-0
#rC
{2K]^
:7h3:M
GE!eY
~n*H
s7c@
$1Q;/
h=D>J
=;L
)rR.8g
@!p&v
QT`m
eb(>
]9[o
{ X?f
4*?@
A e-/
Gsj>{
*& g@p
K$FA
'crt
&>e*_
D i+
gvm#
2J;Dx
M(|;X7
[-yPI
i2g
#f-(
kq U GmV
T@rx
w8s~"
)um8t-
_YQRr
]D7R
BwbZT
* 0
!gZ)d
uY-z
=o8X
@{sJ
x/9J
XMNhO
.Ho)a
w@9m-5
1|*IU
o%&nq:e
(Wsf
:FG`
O2j+
W3v
A:*X
kZm3
7}Bx
| d[
,vazt
m_E1
/w=,
_rB Qz
9&e2
m"?%
f8d}
$0cX
<AFj
VSnS
?mz[
d0$
wfT8
NOw
CdU
LZ)j
2>1oW
_Q}`#n
7YhS
} oi
`.w2|
=T'6
L2'0
yh|9k
Z?5s
TmI
UeC)
N]c3
%Yi*{
5S9:
RCSrul
D<m]
w<Q@B
b?U0
-yFm
Yp]
M/lj
<r)"
}k87
oe\
t*0N
$m6
zG }
z(OW
AHO
Tz0!
u3'i
9EEnMd:
zmB#
[SCC
isii'
G0bn
J)vp
,a7_
L7+g
h7Q(
){<?
`=y`%
tIS2Lvl
(sR9E
a@uu
DBb:
Z22q
1beM
N]>9
wP >w#y
&_yC
[3{iN
MnYN
D@xc
/4|x
_r9_:
DspY6Wi
c=}2
+yEx
-0\S
AM#b
K4 e
Kz9i
2cDT
4eK'
O`od
KJ<`
q&90
)]9m
getj
Gj[ &
+PMvm
Q/vl
tqY0aK
a? YYY
fESU(4
G{D8
- Q0
{yIo
S&A3*
fw:E
dPo
U> Kqd
9M)
Fd9
zF@
>Fk?
{ SO
sG6\
<$hR'
b!w
F G*~
w& P
<ee7
&6<X.
S>,e
|?~l
Z[>]UY-
q.7s
3 WH
2zAq
#Strings
.|xv
CKK]
v(('
u=Yr+
USL$u
9C:t
.hJ)E
Z[=J
XZ7L
I3,Px.
G(]rPEn
D1\J
3qsaU
qg32)
KN-
Bk@(PGJD
\ ^I
UZAS15
>9e=
f^C1
| FW
E_>;QF
50iN
,xd%
%dwn
&r_(
LPmo
!'$A
l xD#
2SO,
q&\>
PyHBR
Y}MoT
Ra6%
'<!6t_?
l^I+
~ Ui
COS:
! ee\Yw0
)9y8
3koB?H
21Vi
g?3wcZ
b*]j
8,Rp<
#$fL
E -e
N+-o
+N\X
g[~.)*
cS`03"
+1m S
o5F
ubOCS
)C u
B`j&
XO69Z
UnverifiableCodeAttribute
FJsgf
~Uhb-:
u4"v
v)?{
veC`
^!K
90-X
y^R
u SG
YfWc
k3n[s
+CxZV
E[oI
t] g
BV7f
Ue^L
qY0u
AL 7>
>Qiv
bR5A
W_qF
GMX4
\m(m"
\10E
cHjY
b T3
}\+2
}&7Y
(ZyT
Z <S
Fd9X
*T!
^TW[y
y8v*B
5r&D
Pm)0C
Bj6K
GwO!D
cN%uq
OSE$
(xnUz
e)G,"OU
DJ[:@
fW!tdm
zpwW]
{a0.
8wh7
;Irg
HI AU
/u*s
l[F'
H4w.
wMoK[
1Xz`
PVYWXohkmRpnufxCRkG659YZ
cW}f
'TL_,7
dY|&T
"B>Pg ;>
Y%(Ub
u!e&
Bn zu
=.x_
Q7Fq
!<6A
{1tqG
/8G
Y&187P<
6/2l
#CV0
c(=3
7[eV
sK2{r
n-P?e
lJXG
rcK.
R%WF9
$'iF
t@$O
FPYs}
xt{W
0A#@e
YfN}
G}aj
Y%%/
3IbC
j%A(
lFl=
]N%"
,1`W
+i7!
)iwu
,S;H
'@2*
VKp/FU
!}3 +
c&d6}
nX_>
]JAXH
=~SZ
*'6 c
Ads|
y*B
c|6V
MKY\
y[t8
7^kT
R+J#J
,[x-W
H(vx
k]6r
DapZ
9,2b$
prZj
?7=6
$mB)
<%h
H Ud
VLXb%M
&+jE
WvX7<E
{Yc1
UbetF
[ s]
WQm^
QHDp
XM>qc%
wD57ym|
pd,z
S f.nw
z>,`
1+&SyA
Q<rk
Ul0e,
_0W~o
%g6;
4 bk
!BB-;
QF-i
gry|
^cm+
5)P]
*Yx|9
R8pYhbvhc1e2kvONTVYZSRf6crqutpAL
GhX
U s
$j[v
|%G`6
=ajt
Yn<t
W+cy=
QkZwJ
rjV,
DUj
~eD]
p ~g#
p#kF
z+91
JDq=
B:j2
tu>qgL
_\@1s
sGf?;
>uQP
7W8,
ioW&
d_o7*"u
x0 =Y
sBa3
TX C
rP2x
G``>!PU<j1
_l$
_CorExeMain
G052y
GYJi2x
6fH:
&{Xk
AAooM
hb*]
ICryptoTransform
Z%Prq
My])
U~_W9/
-#r$
>}z~
f4E|
#pp#L
oT_y
Q80E
\37A
kT^"
Xb[g[
4UufMZ
AppDomain
J>)"d
;?M}
v^< zv
4i98
,JQ:
g&lk
~M{|&
Y8
c? T:
-y0M
vc,P
+%ax
qwrn
ORk4y
X\OY
ajm8ok)z
!_.h
;(<D
JD+
`[6oJ{
;'NK
nxz)
$VH>M
'"bH
dJ'.X
>S-
MGap
\'mgoKU@
$y0R
28J8
M6 8^
;4EVc
s1 s
wm9g
U :l
gYqLK{
M@Np
- ;
Jk!)
TRif
{p\U
Tjx'
V;y=j
=e;sF
qnJ$G-
kM0.(
fa@v
dDw
2uzg
q@T'J
Cb? ?U!`D
K\Pl
6SYd
~pbP
?h :
Htpz
+o+#&
_'u r
S7G'U
p:mo
J\f&~h
)[wF
=%]<d
&VI
j"6
T33
`:]L
f .
W;GG
;qu.
wgXh
=->#
t12a
I2~9
GS(&a
)LB{
L<oO
)l%g/
,1|m
=}DH
vtgeU$
3HZ{
y&v>d
SK--~?
J75&
;J},
' 0}
BItA
`bo2
^v -@
Bg4b
IEnumerable`1
9|nj=
A+3}
Jh,J
46i[
c,{5JJ9E
cs#_
t0Kz'ik
{ 6p
c<K;
rt '=@
A ^8
S2zwfy -
[TJ!
94eG
&2H
7t8H
+ {Pl[
L{y@
Af5y
Q|:t
j4_E
2 z}
Q2 N
T5na
tUG+
_kJ@
TP(j
{awbkfc
|kby
-+J,
get_Message
TP_Q
\y(O
T^Cz
nAeuyp
2G)&
%40-
p] Y
o*gG
bul?G
'pcO
~#`W
pJL[
Mj6n
~[ '
8? N
_ :x
tnRR
1LBF
$sW/6
dJ^a
,x^(,.
I0/h@
~x7s
Q-G5
zl N
)kW<t
Q )d9
xT_)
OoEb
E0Nf
7e]
Lh-7w
wQx_
U8Q
QKV;{
/qx
6 x8
rz
73Wp
-KR"
o>-.
_PB
N4BG
O, !
%!L<
w@:
&V{S
*J"4|
5WiC
8/5A=I
j3\`,
Io&
DR1,8
B]p/?
GtGg/
Z" UI.
rSHnxAPFIx
WMT^M
0f&4
!ZmC1m9nSiRPdhfuzvqFBccdhBRYYHlzXW
.Y4;}
k+lH-
=Ta2
Se\3
_IsX
]H66
@hd.
y9R@'R
G*p7
n>'N
xFJ8
5:u`
I-W j{
-;}\
"GBb
FI|>f
)G>S
<J8H
8W/X
KS+1
@.reloc
HM(N
-?K=
j3^w
jMZ{
.gC[
sq
Y>$ww
+!tJ~
)F zw
LrmR
0``
mRmw
*slTj
(s6b
>Z?=
8# XV [
Ms6|
yR%*}=m6
18yRA"
38*:!
0Vo_
g^s?
zDwq
Q?_:T
y|;O
P$*30
mq|j
T?Te
cj?R
yL-
\W5
c+h5
!3b M
PLnY}
Xrmr
F0ii
Load
t?;P5
IY<)
N7I|
X'0/[8
>di|Fy
Mt-s
j-<G
-+DI
3,O@Z
q#f5
H6d[
J q m
S<GK
'IuFsQjjC4IyphJAl8QOWh4fgMyXZQ2Iegvw5hKC
: ^H
~@]&
5ag7
`8XR
|y*
{o):
sSC{
7$$0)]
=&6!
2<hm/
= 0
]xyu
Qn 'CZM{
GgO-J
sKdB
7/:B<
f-c
y:mw4
n#1k"
S\7w
@-z)V^
$BS1
"EKHO
.x1p
&5B&B,
UJm3m
Q Q'
v*F"M c
c:UHHH
.3\m
&w2zT
L]?w
"[]n
Fgdb
+L-Kb
GK94
3-GMqO
E& ga
H[qi
X=>F
MessageBox
m4JY
BVg\K`
zmc`u:
P3@U{pd
p IH
TU _WD
0`]$$l
}75t
@1Wx
RS+ LH@
tC"BY9
KHx0
=EBL
?'P(
_$:@
tm3
<6'E
;GI:6
,@_>
|N:I^
79}:
w7 Y
ja3
pb?v
'fSN
B;"5
b>>^a
Y"Z_
0WPra
hIU>
!eJ+!Y
H $R0
~I<0
]&4rfC
n9%J
PMp1
=]<
[42c}
aRG%
tT~Q
Ukaz
dgW8g
,4i@
~ iH
]#$=H
3J7x@
_X1H[U
MwF
;UZ9
|7\o
$-Bx
x$0P}
5Hr".
^3X8
|CkjA
]%l;
2@9;
eNfp0
z#$D
]"4P=g
T05:
H`bFC
'}
RuntimeCompatibilityAttribute
dsw/nC
3 KMn
n0`q
?PffykK
C}Q4
uGQT
Y ?U!
I}g&
zm}= J
Y6]I[#l
)~+X
C}k6g
Assembly
*H$d
1e. .
\XFJ
G5"l
|K) rO
q< 7
%60hQ7mhP29gIYOiycCrP5JzPn1XGxaUVxQJ4F
NR;O
},:v
=;w&
r]>8c
1]p1
~UQ}c0
~zTG
rF,z
9YP-y
-AL\
Z957
G)YF
JC),
;e}f
)<=-C
%kFP
V7>
'br,
T [+~=
2#]R
7U7c
#pd<dw
JTj? H
QiX>
jrR}
b[!-Gr9
N&H^
=;"3
xaT7j
p7tob
aZ^
Uwk:
)~Jb
!4q],
^)pT
?m|
cjG +V2
y?V
/nDs
8V5 E
_Oa?&,
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
-<1:
w]R%9x
-[Ts
:A
z*#&=
!ak:I
-B5zq
oWMg
l/v_
&-["j
WUgs>R
?_ Xz
~JK@t
f)\6r
:`Ls
YApQ
:6GhB
klWc
wk&~x4
@=|4
`*Le
2?#U
K^_9
D'J*y
~'FQ
.-jF
!6,AO
-hC
L9pTB
c]<L
0Kw/
iIB?
]izc^b>
uUc^
sNVR
+ +0+ e
(b1J
nt%-
P)u
"`h\
9zkB
:@fknV
" LND
\F+[KM|
f;7|
37xqM
PB, -4\
rPmvG
K77K9
&mLu
/G',
bN&[z+
63_;?
ppk-
-}|>
wuLz
l: RW1
K7 \Z
);?MX
n8wgf
>%3kuaa
*Se(?
&u(b
cO\\
N [\
Vj4t
@\<D)
Ywk]!
3?):R
y#>-
/QRu
yt};
fy%`)a
dG$J
> 42.
LI-_
8eW92u
EkLv>2
l.y]7
^d`m
(B-!
#Q ~
rG:n
U X4
~ma]
+2[k
n#+8
uW i
g/O|
Ha8|
I0so
rpx3B
zU9]
r Xm
N |F
k2tE
/KW
fv\=
};6Fu
$xT>
:mj}
lk/Q(V<
yg/6
Tq*w:[\
a`\l
3B S
Gxan
0c]T
!a:m
o`'z
}d:R
D$J 1
hR{zUy
BEk@
1L c
:n{>
b3)i>]
xn h`F
=4Z.
{uS0
^*4B
<nWH
&S d
1C,~
.ax
c_N
1Z#[
a W=
"(tD
-F?K
ZT*}K
.%JLx!
&)s{-
qvpY
};+9
OOmQP
G)wH
aWxn
:KYn
k}OhG
^?eda
j73
k ~c`v<6
}a{a
+#:1:
>#@t
^M1
B}CA
B4X e
{'
~9|6$@
Y36zx
I64C
6Fn p
"C.'
>"zs
qrH!
FK9X
N:;C
Show
H5|I|R
c:3w
AH"
6s_4
TYWC}
/\<_
6f/ @@b
_z;X*
J~a;
V|K ^l
3!+d l
X!jw
u"@h F
AZzA
E|f?
\j/SI
z=`Qgc.p
;P3Ns
05FncQvyDX3DBuQsojObIzkyfNGw
eCFdF
?&U%>
`{AK'
m%){DA
JFCs
~r7
G8&HQ,
gj/Bb
# iV
$qh&
Ltrb
J8j-
Nmgy+
in@Q~N
_b )
DV{s
AC}Y
0 FGwn6s
z cZ
K%K?
V9NI
F%Or
q7[Ls
%rfd
7MJ'
/eTPO
+ w
"e=Z,
OOz-
D|bl
M7(
HOy2
Qm ]"
{c~#0
zDK=5:
+m#u
[(;x
0Y@6
%0$zXVN
OH5N:%
WRtZ
SC(dt
<bryj
uG~0
[q1*
`j fq
bHP*
y@^8
Y3?=
K!ST
p(fJ
O5F|
*h
jk-X
.d;Qk
|z%@U
dXEz
1~KV
L)1;
rauL
/m1P
P8[7
0 }@
21b=
Q89X9"
4tS{
"..|
[x"vQ^!~{
aua.
SM9o
]*ByL-go
4^Bd}KA
tw"o
_Y I
<[sq
k1&2
3sp8$
n1+6u
RFz#
~4oI8
3tFZ
,R_M
}oE(
H0BJ
&5Ln
;1!E
IV]f
KY|
-07.^m
jqBys
~0(M
-;#]L<;
l/t]~
.i).Y
e? m
ZuD*
D $-
*&@o
1U j
@aL3
gyW"
Z,/#
JTft[
@ A5
>>UkZ
m-_f
HzEo
System.Windows.Forms
G o^1D
.g.v
7SC6
<=1
}:]f
NE~-g:
JI|Q
&T$e
{+:O
0p<r\Z
-mRX
'Ix3d
9^Cx[
nrf3
35.,
}6/!
$g{(
GT d
dAU-0
%R[
Vk$?
}6/'
SO=1
yUO1
uM4.
<&XwME
:zM%
Z;>Wp
bU3
Bfgd,
HPfA
'2t_w2
3,sl
J?{p-
t;du
6mBb
uP)
qxc'
> +|@
) yk[
62HLr1BrE8eV04AmJQyx5y
da(e
z]o+
StZf8
H8;1j
-rC(k
"MQ/
\CmdB
MethodInfo
#eM)
F|tY4
yv5e5+
Af!t
Ml(t
a'yD
|*iv
_iN^= ;d!w
tAx,
e~(K
LYgsYM('L
F+r\,
Y^d8
I'J`
D(-w
4M&I
P2LEg
=6 [s
d|OL
uD-F
-6%:z
^TV|e
i?u@
R@7 \
#$lfl
p5 !
*Fvk
d">x
lz'R
x<6{
is6F
.n;r
VB%;[
T#0Z%
.m{>{B
Q*Pol
4^+2
9 ao
hOWX ,
oT ^
XWbU!
3zwxY
H Pu3
$KK!
daU2
git4
^j{'
H}5/
}M;]
? ( b6%2
tUwj
/ wHgM
Qg?}
%>,q
k)%x%
N#gY1
m&{x
$^_ :T
*F7B
6Zl=,
!:(V
67"v
\^wA
DY*9b
VPXT5K
!g0NP(p
S7qpFE{
>gk7H
Nz=f
? V
|q+{7W
Ic]GE
S<4>
9\VQ
rejp
lC`K
rKCU
2N6q*u
6hA
sb!6\z
q>{/ \,
O1@
b9gw
zy0D
M)c?
n(1%
*5rI
amf[A
$Fv{+j
{!WZ
S}m
Ryte&WQ
mscorlib
;zIx(M
.&[m
Ab9?
)K-55
xSoS
4[@8P
pm 5u2-;$qv_F
QQl=
,7V)
v2)
t\/
yn+ "
{1P2
)]CP
jB7E
=rC,
c3i;
;x) Z
=NL_w
Qo@xD
!<:!w
|&U}
?xxY
B!g`
ogAl
JTm{t
MA|6
ABHl{
Y-t:g
ZE %/M
E 2h
V>Fl
PKH0
]lcR
ai5$
n1*.
fpyc
9>gk
pla#
Hcq%C
@ +~
Fe d
t!w*
2M|,
\System.String[], mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089PA-i
r0F*
><"`
HzXO1
Z[e|
F=K/
J@"B\q
Z|HqhA
3F%F
fRwxr
H@{o
/yw]
9Of:=0
=,o8
"B*\
I>Qv
iVv^
$7?}%M
y]ww
N1zH
~64
--c\
C4=J
wYSK
6[BN
NO05i
e(UR
i[*!/
/rHXI
%\}2
$3\Y
Y9lZ
6Yd:
eD9O
rmto
[F#S
Tst)
C)D`P
t:E
#8LS
^E{]
)l1u
0ZM`
wogIkP
(`Fwg
g?r7
z` N
:6Kt
q)~8
= )cA
#'7S
N8\;
f39=
h.0$
8_JO
DateTime
+b^<W
5t|>
zpg#
&{kl
a(F#
)pZm
U7O8
ssRd
DPwaIBqvNobEj7FFUfilef
; wE4
0Jq
|j'FI
?eRT+
vb,{
<?Kw:
Kg3A
(@9ZX
otp`
4I]BU
?WpE
- ? xj
(8k+
6s5CO
b]bW8
$(,BO
HT&y#'
_6K@#
hWwx
}]au
_G$:
Q,-A3
T"?{2j
=11H
`5>
&+3=o
25EH
!~Q1z
=Z>
.TR!&W
y? P
0\ Q
hlM
I?9h.?
[n]|
>5]-v
*9im
xF(\#
n2Qp
H(3M
72)a
':>=
EWRf
78 .
,6V<TN
oh'u
qz6
&H{F
gxfk
dsSo%
yQ0.
wo$[
iTB[
.Nx,
|B6
i6K
Un"~
]g#e
L-H
vD8`
cB`gr
$8z*
_e}Lf#`
4^)Mz
S4I8
xyD'
dO(gH
OE8Gh7O
/' *
@ !O
MN/4
t!Na
sEX/
TA!e
rV$d-
v/Eu
O$xt
LZY1
kBfi
"1H,4
EmtI
tGo4gx
'XT[
Y[S
pOEf
K0$PN>
pJ@]N
j"xo
nv[P#
\|e!
wo#
6F4;
Ws+ues
+ g,
J!"#C
^*lh
s un+Q^
g%>AC
I'|0
U fDKN
j`D
MT^
Y(kz~
Ze WL]
Bd8]
[Ok BB
?<9=
x [=
)]ibL(x?J[#
2Xd5
)sL$
gl>
=F|i
^h2jkzf&c
qu3d
Q6kRtH
U'p#lI
Eiq$
>]n?
NA2F
+op4'
{F0V
-v]m?
f)qy~
Ab N
*\8)
78a+*
'TnY
[R"dQ
b] I
zCrO
??K\
!rSELCKhmxlWk4sr6FaTJpoWAiWNP5tA9W
.z H
~Xu]
}jT
AcaB
0kMya
$:)Q
MVu~
;A].1r
eMj
P_ K
I,CO
$?.N
"r
=Xa#
p] ddl
*]^w
M@*s
wI3y
a#gzq
TX+C
Q\B?n
q2;,
=@xp
C=;&
q:;b
I(E7
%I#
ON |b
X'_X
'"X8
!This program cannot be run in DOS mode. $
s@=
lGghi
?F`
;KP-
;$
X z*
aR.J
{%UAQ
7k&.g
@$'TtP^
/=bl
#2`cU
U=[R
$kL
f;5M
EMdf
_,0
]8jw
aS-?U
I;Yf
U<w4
zIO=
>9WP
6o=
)|0;
'.E
BWb5
-9v
zAxL
F\c
xj u
d`(}
System.Runtime.CompilerServices
qd0Y
\p=;xF\
E<#m
":Ti
VZR$
H{_':
"BT$
#hdC
J 7[
W,gh
["Sa
gG\g
upPm
oh7x`
fo}9
Ne r
0w;+
Z]1
7l=q
nxr.&/
^)z]
]|
S`AQd
(9b)
"=c
eT?V
M_c6
6|+px
RTA4
2B?T
Yc@v
dk+S
Bl dN
a$.+
: f?
XC0L
L kU
:/SQ
%hsP
VczwtOL1LjFuP7N7q8uy
X}5'&
K-iJ
<) nD
+vs"%9
sC'HB%
n%l8?
Y"V5
.K,3
# +Y
78;p )i
's a
k^Jwu/
QwOL
igD6
k>/v
*,L/C
j<ay;
{,T78
`5#sx
D5nym
Xn;R
h]K[
B^FOz
z; bM2*Y/
x}s2U
oQA
*y6hP
5Ltt
BSJB
IVdv['b
y(9O
3VV
!!l"[I
%JY
RL :]
Ku$$
[pOj
Oa-X
)y}
M?.6
RrXW
Z,-,
(?&l
^i N
-|MC
}&?X
CB%1
0c_l
$<2aGO
e[)YqS
|$X6
vKaO8
)P,](
4/\
ApRbM
?:xH
UHG
4R),
z*q;
@vJp
Hg0i
F J
]4&Z
H|W$
*r]@N~
{62'
Vn G
!2N*
0|-\\'
X\i
UW\3
QL(x*
-@9#
uE%
Oa#
&[U&
@_#R
1kD-
LgdT3H
3.r<
|)T=
1KNg
o6A |
'xO<}
AL|
zJrw
=/F8NV
TVRy
btmo
fc>+mrG
' Ji e
n <
n N*
jDET{
&cZ<
=]-9
"f07
8r~h,
_j u
eJ]
*(p@K
fM6j
J[48fr
$BKoxaAVjDmeMxHQQAn6otDnKeQyGLmoDSUyM
8;0
%)+v
)$xp
^ N}
@fL
r*L4
~4O4
ZS\E
j8`<K
*Ys
E/0R
2Qo=
Bm7%8
\6ax
5Nva
`H)hf
y7]p
,f[;
<6cY
^ =/[2
B.:%
9GgU
M3_T
'$dY\igM4
{0m8L
DWqK<L
U\~j'*D
qs08]
X}d
01&
=032
Lxg<
C*}&d
RijndaelManaged
E&c4
&n (A
hSu
X=P<
k-V%
7t-XY
cU:W @-
S>h2aW
5 $+
Q.o2
I5u M
Pr d
^m!Z,h
[<G#
CM7GLd
fMS'
%e)1
b/)o
PK*Nwo
+-}R
(yV
g[1x,
pUB9Lr
Y $H:\
?M7K
c0 y
-/98
PU$e
ej =
%X=
'm!^f
o4^U?
:bN
e*$N
l<\#t
bzMpJz
p'O4
ess!
'wRZ
)-&:
wVk/:
vY}5
zB6Zw
`!j(
/#sw
Pp UmU"'
pla
Ip\Bg
ahKd
J=l;
mD^)h
Lay=
[YdfC
?h[N
HP{of
:Mv~5Q
SMNV
4 2K
#9mwI
iMNo
ueK$
b5<+!
8rX4
8y30
)@!}
[S^4
"U WCd
Ah}a@
8pVVZ
Cw^U
Li>:
wT1"
w%h}
mW"
&%XV
hZU[
C7 [Eq$
Duc~
I.zb
EH[0A
R<&@
jKi
; 9L
"*/]
IB<
HJGB
"<.sqg
QGDI
RzQA
uWnvH{D
Wc*P
f0z=PG
EG7[|
0-F3
p6NV
1\6?
P+pO
=x,m
LJK
^R=9
djfw
A `
>=9>
a&4#
WBL[
.y?$
}Cli
4xq,
~2VH
<O^D9`
ZA 3
_\DwY
+:0; _
%Z*T|?v
(M@1
JrS-0
W*N#
Mm @V!
F<uT
XTt6
1m'=
-Ah[tfx
# 4'
vv"F
tW0{D
o'fV
OQgR
&^?k
^B4/
nG_,)
L{C?
R ;'?
G9&
S4[
?X4xY
d/7W
CompilationRelaxationsAttribute
~5DN
fw@ W
bzQOv
H pl/~%$
AhwP
'#4us4Wk
Z`)We
,%q{9r
fMys
'!%o
ji>w
Q+\,_NM
73w93
;ERD +8
}@Y6
;UT^
jVI%
)24B
?_4>
u1}l
wb%@Nr
!$mC
fYF@
a! w
G1.C)
t OO
3?`N
Li)W
YHE}
` 1gF
Cn@K
8vGaE
=z4B]y
@rx]f
t"h#
RBi|
ry<y
x%m*
(KBg
XvYC(
zxV
T;jN
FY'i
$bIiJEYd1ckkZm2Qyp33U1kfRdRAED75waOMI
nYW1
:j?]
UU8KL
$$<+
e8W"'f10
w JN
f#Hr
! a//
Dgpny
E`}X
wk]l
mRtQ[
`nO$
O0dvKE
BT"*
]: q
K!QlM
?*xT:
vfBy
z_c
3n+
nCsr&nO
HoQ>
V: r
BTG6c/|
;am
W!z"
*ryi
gy'X^
4=gb
U.=B
0XZ/
?^!2
KL2F
A JJ
Q{6g2*
$~BNbz
h26J
_VJ]h
k v#
:V P
4nU!xR
A'I/%
b7H#k
Gb%c/
x.71Hs
0y@0
7 e^H|
xgXA 1~$
>#E%
A>
+\)x!AZ
f _H
SxUU
/#WG
omxY
J:KVQl
)!`Y
Ws_k
>] b
|`-Bl!
o Y~
CkyuX
1TAGTaE9dQikqZvXGgDRca
F}c{q
O-Vmd
G$Wx
(@$Q
|,CQ
oVWzK
.~,}
Gd9-
\+`
|>-%K
)H^$0
t{CvE
j[kKV8~
K%jI
H";;
F|=`
Ldr\
$Zm9?L
AZ-2
ToxB
tOTJ
SyCHL
/x<z--
-6u;
0R[!(
xq~
"BafDWau9ZtG2KnfzpRBMg639pgJUI2uL0I
aZ^c"
5CUP
`I L
O3) p_
?8*ox4
2xwn
mr^
`DVHU
uci+W=X
cd5W
lQ9p
X|^e
G(`S
IH`f
&Dt-
U|L&
jvUM
1Y/f
0kGT
DdV
5|-
a^xt7
p} 0q*8
-4-t
a ?|
>O&.
B 1hs
?}qT
ubZN
Al.
[nu}?
:kAHJT
J.cd
^a0
CVvqNI,,
<K?Jz5l7
/a~%0
WW%hy}
#y IDan[2
NV+
/uhp Fii
` B'|
*uh8
l);Z
)(%
>a(B
o$K:
5 >7d
=w`U
9;A$
h#[/
tR);
-}'s ^
^/ V7
W$DH
"Xthy
b=gPh
CTP7^
^vYl
_g4N
w'>!pB
L3U,[m
L kjc
HRh
5th5
TW1C
NWH=
<%rI
Ra !
e$\#
&@ ?{^
31~h8
qkJv
D0eb
nieL4u
0q!C
JXr=
80vo!
cAmv
{N45_eT
Da%<
L_r
\'OL,d
N'ui
6 $g'
$)P~
?0<W
I7u
;vi
rMF&G
lhX jy
e~3O t?
@&id
ToArray
eVG
;yE|
MRl,l
^<&O
aC=i
"2Y%V/
-<F<2
2rwh
x*<T
U)sh
)S{M
dm ^[
pc:/
1!*P
^=Nq
+ETz
@t[V
hc]sD
AC$kZ
3 \5j&
DG)~
zAfH-)
R)za
Fxl'SA t
gK;
a9Fs]\C
System.Resources
K p}
^fl,
KiTA
DB@X
$BEL
}o|9
}DGw
8\HKK
%uW#
;a.TB
KDZ
]i o
t_BF[
p7}b
~j=-
O+:=}
+iJj
:z>8
vg3~-4
OC97
M'
f0n<
wa)
mTD1
QTPoF
A Kc:
"/=q
$e#e
>to@
bk>(
hAm2
rFJd
;YKp
3UQ
~\cf
\O?#-
@:$I
( 2=
T6%zk@
]d=G'
WrapNonExceptionThrows
-9!\|
V@kc
B78%W
JGL"B
W >&
q9T^
._ZQ
ql9
_N{.
=kO8
'%_`,
#XYu
A KA~
1w(
tAo$T
s\?"
\S(y
"4.9
-m_f
cqQHN
_q ?
%B%&Uu]
CL{G5}C_
IP^ +
;:#\A
P03Q
A$Tq
tN1\
iTZI1
ZoKj
|g@8
@s,C
|11d
Bgk 9d5
KOPH
G7 m
NmwU
\.OBt%
7"\x
s/*1DS
|wy}
3Gy@
FuOvW
m
`-\d
mv8hL
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
;E/(
!>6oF>x
5,(N
&A8KB
7Wz@
H6CjW
:}|
b4G0i8BJktAI4BrbwlI3oXh6
#5 K
._)R!p
I_2nrU|
~(a"q
QFKr
sB<g.
(pvne
|Tr<
b]@tl`
``1(E
hn&
&k\{|
l T*V N
roS9
(NTp
` / w
*PEi
A5`[
Lh]
CYN
*;g#
\+m
kyj|J
Wz3h'
6 tg*
Qm:ly
7&0F
)SVd
WGuqz
|RP=y
H4XD
T*B4SB
E"6&
'wQ2
7!UYF
j&;+
:M75="
u7<s
X1RFu-
N4-
]o&oH
set_Key
s=A5
;8RW
V *X
OO@U
b:WyX
s:RFo
d?o
OdxGktQ
bY(/
KWO&*M@
, S/
! wi
i^41
?nv5
&%{D
L G*
$H>jO2
1m=1
%^,P%
{4yD
X3X\
Ff<VB
zTLo":R
9DE
9h#q@
"h# ] qH
"AS_n
f"$U
Q>2U
@rK1^
6 ap
3=%.
Ka?j
F( <
DV@X
*d%,
mFW[H
cTFn*SO)v1
S.w)
:|I
t.=;U
XIj
znw?K
8&m$W
+ON,
q{` L
-pmZD
ZvEK
>osI
7o&`V
m<L7
@VB7m
*M'
/2=,YB
) 6)n
^d['ke
_D1zB+
get_Now
9j2V
6TX$ M
O+L%f
{ThN
Y&=y
nmI+
V^ =
&$4nN_
}SYG
PpWeN
|{96qg
B0)
gxZKQF
KUT-
*hl+E69
y<dT
$Thp
$)sE
j>Z#9H
gV!!
5N -
{$P..
::OH
Nqh1}
w5SI0
f8|.
jn@,{
'34=c
JV u
rThWB
u2~
.\uB
|Eu"
>eDY
m7w&
v_P8:
P7lK
z)'
D{|dV
6{U;
ieV@
#SP[
b+S~
^Ype~
RI|\>G
6B~^
2Goz
KShY
*9S9
Z kI[
ULcE6
1{XZ
]M[
ZI3
@IX7
x}h7\
D /Y
.v!F
9K P
Hf#p
+V6 b0
2}bl
?J(!
2HCVX@
w3XN
RBs
Nmd
Q\GS
nokD
R;aTz
3t1v
l- M
&d oV
L;^[
XAf*
X\|w9
`\L6
|w+SQ[
s!Gp(
{BWp
~2aN
.u67
xRo\Xdw1
/\6/
Q3 0
{ NX
<y>Q#
ft Sd
*.`s
`2p
+p!
lfaZh&
RRyV^x
W?_=~
S^NF
R&
)nv"
c)7U
Et h
R#XS
FIrS
km$[A
_SOG=
so `t^
Fy;.
1!&H?f
\jjr
W YPs:;%S
CN
|U
^;9tg
8v@D
)E3O
s'$@z;
6xmL1b
[*lUym
7@BJE$
-j&x
xI8{&
b 7}e
_O0F
D~f1
OEx"
F0`>
t3X
P}2W
U^DSe
DC%z
Wdw+
mQdUTCU
AVfJ1
Qi:b
$0y
Pv}Ww
^,8#M
?# t
S3sI3M
tJ8m
;^!9;
]8w
N@w ~
s @I
X8,=
% e,1
0yi!
_7*'
^5]\j
C6AJh
aMZn
@".d M.
FQe
9w p
~~Wq
`h$|Cp
}=o?
Ld6?;
Object
7R3X
]+LG&
FD?B
h^ig
RX~l
o6rx
aEv}ed
XP
nQzw
a,o{
f)=:
b6<t*
?~B~
%EQo7sXePbON2STF6xYihtGM7WWwQu4mqkv1Et
kfwI
U"|e
:n|=
?Hh"
vVAGq
qSS8
| </N
/'d
hx*r
Q);}/
}h,]
"Ebq
!s]E^!q
Ml
d7'
/Wf-Hp
-*RSx
+Ejn
g_HHa
|~xn4:
m5!>
~di
jD4L0t
Z;s;
Q!*5
L_)S2
` kMT
<|(<
hJ+5
#pi
!JMJ
\b_MF
s5.G
'Uk,1g
?~j\
)jHA
v\r_`
#`_!
J*6o
uXq8
*Ap\
kkf
`{iQ
e4<vh
kBA]
QoMM
w:[U
Oq+ 5S-
9$w>Z^
N<V
>'`a
?cJ4
"OF[J
=Ar6
$^k<
v1 N1,
575{
S Go"
I:-;
0_mo
:=P&
AFM{
[KaT
}s8@hJv3
_;3F#b
AWL5
CzzI
)u0,
Y[h+
GLwY)
6 `i
v$kb
?\83p6
yiovn2
9<Dw
6u]~
9>8b
g2 d
<;DF]BF
YQ"L
;^qs'
N#]I
r1 Vf
4M>Y
cN$}o
d6NnDm
FlV -E
L"v,
BZRS
l+dNp
C_qZ
(L@\
Dfm7%
&{.l
K$ML
NX[rstz
P 4<
7 *c
d[ _z
X&,#
+"w
^X"p
4$Nsxn
meMG
15{WV8w
!v:M8S
%lP\M{
mK(3
+/$,
oy/~
E?
r@Ds
~F{O
p@^]g
HV$F
,"Y7
J|z:
#K!:
ADtq^
0o|h
wPT
c3Mz
VDFN
Bp$Wr
E.72V
*;NR
LE
xC2v
q=IV\
DQ`$
GtCc
i8=\M
8xd1
]YOa
gk 0~}%
S ^mJ
+]yN
*kQNmkQ
|Zb3
59X*
*u3,
BVO*
|`(
Z(n~
Uz@>
G]!7
1/9:
^\n+
u38O(
=_me
!Z-
5{kBB2
]=4,
s+Rx
j*3N
(wz#^
m.Yo5
k[Dt
gP,b
P%}+$|
>60
FijLa
=r8J<
gf7n)\,M
92 u
1=Cj^w+n
=Y1O
f[%%
bdbhsdjxG3rs1f8OpquNvoV
c& i
\.g
j4%J
MethodBase
6@5a_}+
:1b|
sy+"
\S, m
+ok+2
YW9I
HKV~
gCk),d
R /w0l
`MH^L
UYsU
/<?p/5/T\v
)~
![&W
RhQDD
ACW[
oCuw`
DUdo
t|k6A[
\"U~
0T)
JB 9k*W
!M$,
@`Pp
8FTq
t]`!cQ
'cNr?
1s'70m=p
2OZif
2?l t
5BdhL
>F# 0
[%|
((91
H{Rnr!3
:NT)
W,=)w&
EjN"2
.t8vc
U%l
QyN
XQ;<)L
ey]b
List`1
Jy$@"
py82
T-sYt;
_c$\
Ti ?
a 0(
xVWFR=
}}[2;
" \Y
r5>M
@0Q?S>
aEC|Y
.R<
9ew@
]A.M
op_LessThan
$}Z&
(g]bHVD
!ati|
JvM@
H_\FYp
cKE0
ae?\
D{#v
Gb+;T
G Eu
hz N-
?urYW
.wXayA 5NK
]Q %
\ki ?
/^9t
"0b 3
`Wft
u)
k#d5
s5@r
1,ys
jNQyOY
#8hp[
1uWq!
J 4/
1+#f
ND.B
BL0F
)#@]?Z
G7o}
/sWN
>r.6
a6rq
o0 f
LW2p~?
ICmNUzP
@:SQD
+ja@dp
%5BH6Hz5kLEdZyxqYMv3cU4p1Sx3JRhLE0qhhk
`dtE
w3/c
t*%Dd%
&6j<
priB
}:<9
\CN7
"#c1
l9bI
zKyu
5 y<
System.Reflection
CgpW
7zR|
' *s
0Twv
K -;
&jm.
Aa){A
H/#
)bK(o
G5vj
nSZ`
VacuP
C<9;
H teyo},
b[b4
CZ#X
,cp_
SqtY
#W J$
m\lyMi
F?!k
';Vn
2 24
WCHrWka
[=C<
) 3-6
P-[ a
\ D
Mxvt
UhmT
Nj3t
8E%LP
!w]
s ;H
?8nS;
5}y;G
To!8
*1E
N#A"3#l
. xO
By]J
8sr* {
86cZ
&9Ae
G$M3;
$-x|
eV]l
{.*V
<?t7
% )u"L>
\d!',->
`orT
xj\
2|n ^
S@ 1
ng3
{',s;
UyTA
Ho)9
)o~X
au[8[[
q~zm
gt#b!
QT^&
c T9uKE
Ekc8
LQyJ
YZ%l
b|J*\
set_IV
A{\
}&5W$
mxQ/
NW}j
}nd8
o{Ej3 0
HHvgO
yl90aF
kY<a
=3Z<
r(zc
} RGA
~:3|
l So
r B=
& ]B
U?.
^GC=
`.rsrc
0!z?
'FE#k
v/mV
zOlK XX
@lQlbVN
A4_)H
h}e(
(_~
~un[
jfC<
*3G<
ZDIXH
x)< 6
>(z: 1C
YUI`
pY!,]
K4ei
);T\
@=v7?
xR8&
N# 'A
;pK1
67tK
ppMs
4WfT8F
lZ@
Aar6zLR
Z[u"G
8h=
$! y
eWL&R p
k=dH
_0N"
o hM
J^n$$
P=-]L
=vQl
Bu|i
W4]-
Rlj,
jYCP
rt1]$
Nklb
p(B;O
Xs6sAs2
^`%Xajd.
LV>3
TJ9?6
4VP t
H-p'
xz_1
Ht0N
3PuX$
-Th[%
4*rKP
J [p
TWQU
~&Qd
dy`:
g Z
8IoJ
|`^I
8 #'
CMg+
P>oo
AddMilliseconds
@,k8
RyB4
$ axRa6
H!A,X;
oyC`
w }4O
6?X24A
'd5Q6Q9UrvuK7h8YD3mvuUCce9k53GGrkGShxRjB
rj2h
EcO*[
d o[y
[Z.-
cs(3
z 7q
%T:d
CKSs
;3 i18
rdi>(o
=Bq&
[O##
HP r
2%V"
y^ \
rE0
QnM&)
8FVLX
$eRI
BU[A#W!
Y~M6
78_NW#
j,4l
Shd?v
H1CIx
]A}f
k3xo
G@%
+'<u
\F~9
O0y6]vVN
`RkB
:6l@
RDS]j{
lD28
N?fNf
c0+|<
J.
Br@lV$
A_W>
a8p
*DIoRnC8
1r2!NzI
\60ra
)\w9
k-Lu~
s[
CC>e
<wHE
K.3Ku
cw+Rb!
1Zl$
Ge5,
~zZB
*J&c
C{ICU
p3{#1
L,I:
tW|\
RSCK9
So =B
Bw\=
Je %
8k."W
=6G&b
8e~S
pB4^
z8hyp
RP5p
q#!V(
> 1
_1P\
bL(
:LE`~
]`fw
C5wa
h8(wz
w^O;9X
t) 7
C((*
FKK1
0 *
GetTypeFromHandle
9#H{GU
\;2@
)${**s7j
Y%ltl
xV1
sB!+
4=*jV
tE F
4N[Q
W|Tz
4M+4u
V3fM
\fLL
O;^<
SymmetricAlgorithm
uWZpi
Etb
t2"$
<O+7
,?k
+LXl
y(Xa
k c"
`p ,<
b7 "
fukc
tvAhe
D2L
_l*T~-
O'Cw
V(#}]
UNeO
_7p_
i:19
I3o-
NuUs
*j1Q
18Io
[3
-g;Ai7E
_C31l'
&Z!u
| 2v
&KW57P
e5:`
oYE.
q`9:I
=?$3
>-S!j
ci=9(
--Nyr
$)q4
%Y N
aBc
- v Ad
m &.
N@NZ
v(vpE
6CWB
-[e
,3m@
paU/9#
kgmlrF
lYRJn
)s Q
Ce N
MKsDhkxMBUp92rSE7jCJwzGS
G+ ?"
` N
\x=*(q;
(8:5Wf
X)V[?p
/pCi
g( !
aN6a
hV Rr
lv&k
pbLv
M[t.
8TO
System.Collections.Generic
MH'z
aU|!
vOFD
mwzZ3]
dzWCVo
L"qG_
qKN
],k.f
S/UE0C
6=iDIF
"Kq>
?j$>
$9;Y!
Ga9w
@O{T
7ytBf
^Vef
H&mKL
=#LB
?cDel'Dv6
G{YH
7?'Y``8
_+5s
AKM|
`tM
5xf>~
x;FJ[M
1xY~
gbvur
1o@
p]tB
|-N|
_ucX&
0m 7!
zeyv
oiu#
_:'G
3SPJX:s
"p9v
UHsB
y#1
ap]!
.$nV.
qY(L
@$1_
<% i
c!2u
~E5
GZ}IV
:gLx!
(Mj
7f)|
$}=Dk
[EzZM [H:
0x2);
ORd
l@wW
^+UnEXZ
>C`A|s
f Sxf
TS/D
{^ 9
/ <$
c2G!
ResourceManager
Jil1
h o^tA'
mJWo
* 0
2.y 9
C64f
:;5%
p}Rz
"4#8
Z PG
c%VF&
H`q#
MDq2<z
-Y9z
Uzt9
EP3Q
5 <B
A=}*gX
~_PI#k
&f36
a slQ
icP
'j25i
j&y ) 4
-1 d
^+n
"Cz4z
5 I#Y
{ @U"
8n[~
+ zo
EE:IL
I.O
1 W9kj
\k 9
SP,y
TransformFinalBlock
;?.GU
8DL.
t"{\-
t<=%
Gb6W7
P&\'
w5W |4
!0pV_
8lQ,
Kw`Pw
t/,K-7
tb]2
-</
A(d
p'.-
QXy
!g,n
l<&E?
cTp5J2aK
gNEU
@R-L
nCV,
\aVN
j S"
N:G
5Ee QD
XoSY=
Z?q:
F8W#
a5fN~
.'pkLT
2jRW
I t{C
c}|!
$_+'
CGdF
XIm'
OsqE
&_ A
.q:
Ekp^5
RPd Z$f
UgJ2
I<,'
"iDrm
ZT%Cv
bi70
?0W(
Y`V|
Sp-O}
4JqkPjgg9Dd11vbfumaiT
A7ra|r
"&)o?
NArZ
O;G%5 #
4jXCi`
2R}[
61u"
Ev*I
~X,%A
j@XKS
"rjg
< 6}
IhK2-K
d_n7
=`"\i
`a0Hn
?O
get_Assembly
7TRZ
3]3z
>-:Dk
\' #
joQp7h
xV"d
lHSl7
[#xZ
UuE{
Lt.o
iBD}
o~^k
<#fZ
d{ X
pf0Ow"M?
5eOI
caz<`
lRh;
W!Am
1Fk~
6_X5d
\;<K
KB%,
s@{Y
mKt9
k_F@
0Z|Z
pJt$
^G>hE
=.B"q
. d)
VV=\
rFs7
K^9H1D
`$Kf
Rh@
.0IO)1
Iq|&
Sh1#s9
)9_dM^z
81I^%
G3a<x
(3i1
5N12
/b bd
}}m/
A+Gj
kv&9
9*F5\
Q#IU
8LY`
mDR)
5uM7
}UDC
-GGf
9HTU
D Ob:t"
ea'"
Y /9T
^E_L
9{"8
6AYr3
}9G@
Z[l<
iotJ<N`
C3FRJB
fVp
* ya h
f^3Cr
P}1'
Il- T
BK m
q&'1k
y*x.~
z+c1
(URQ
HT&]y
}jV H
jEN]E
L)8/
=b/9)
bvD
G2yRS
+-q.,
e`UQ
#GUID
<joG3
<,v/:
FXq)
$@*K
^7(o
_*'H
7)2q
t3./[
r0* '^k
kC#~9
G|h}Y
x =uXDkp
W)b%
2N,vdy
=YzC)
h+#MZ
)t)_
%V7
%&EZ.V
;u.-
s|*T
/Er#|g
&ah'
>6n
gHsm
Gf`I
M= 2
h\d*"\
?gcG"
~/mfY
FfR
^QDp
=6vj
d/=+
$:ZxCkD
TyK~
,+b>
{Djc
G665JD
R+t^~>p
Z IV
&Tf:S{
OE2e
u%!2^-
>;3W
&`c?
C +$ Rt=
yJ 1
'$^5
,sWB
{m -k}
O[iw
TM(6
jD]I
x,CtX)
`LUv
x"Om
} 5a^
xHZ7
t p_
U"]E
3sd nP
yi|&?
+?'p
&41I
Ja}#
xuz*
TQoW
awUd
DMQnkjjd1McK42TUZ5mym
UA EU
"cuo
ZjV[
rF;Mq?9
}emB<a9
Ncx#
dfeH
k XcCl
2q[
xj/,l?
is-X:
l~(U+
q"Y_
0>^0
wtiOL
m & ,
7 >Z
}[Pu
L335:u
f):R6a
*L3_&\
%7@N
@?Hx
q>td
} $/B
k/j^&
7F&5
kF|"
j><Oj
Lbt
\ *AG
u" 7x~
Tkk\
H*)Z
D.R}1V
68.
es;Y
tK}LK_
ofP4=
IC*rW
7eC f
L\j3
baH!
D)qz+&YX
yblV
K+"H
Ej5p
#c3q pM
luTD
;BXy~/*m
yOs[
xxXW
]QMDtv
q9h\W
VK3oKi
OEK;s
wU/5
.EMf
P,}jy
YE0[
W/.&
Q$v^
'xP0kIqW
[*S4
jI ]
Fp g4
vd)NK
&^!Wd8
:-5D-m
dxn(
v~(n
g3kO_
vTh{
u&T[
B1y
F<v9
CBx4
kYl:[
&$.G
o2o/
^ |8
5m",
#$ Rwj
<w9
' [O
r{Fo<
,|-4
{=,]
0P}2
u)-*
Q7i.
nN<
'0yn
N<^Z
v=*V
;oj{I
IDR&
=]&\
uf(wG
45=E
t-]:
"7syN628v8PAO9Pc5BNAsZYLDREoNAhFs1D
1USQ
X16
SnN|N
*(a0
aS{
BM$
VCAFg
Dd|k
60<t]
a!*'
!Sg"y
sK P
gTi6
#Cu0$
9 o0s^
1n(Q`XK
727#
0g%W
dUHfS
#Wcz
;PfX6
d,$A
((JR
Z\*D
' w:
Kt.=n
&GTv}
s myj-(
X-kN
[F`c
? PD|^
s~L8
Z]#A`m
'? "
g4N-
(m Hj
J 6
2!y~
`D r
}Wd S
$oJb
t;R/W
3G},
h\eR
Q(.kX
~EPc
K?G2
="U@]
F"^Dk
"Ot 1!
(_gU
@jr~S9e
GAdu
._c:
4XK^O
System.Security.Cryptography
-Wc&Yz
DRN
I4# d\jI
2OJs
|I }
5R3q
Fc89x
k!Ub
4M~]Q
cjs(cJ
a]=l
YM6V
]A):
Tl2(Fvr
0?TJ
/EaA}I
; ^8
NAzyT
\M3?W
t[0bT#^
.D?w
*Od,
(f
QWur
!|_P
Qsg%`
W/p
"=`xr;zK
/CJ/
V#e9^
Qe{']q
r6d\
4:Ht
jY7"
eqWK-{
rC,X
p0qQ
Dtml
;d4M)
i6 i
lUIF
]Dr:9
},b:C
HQ.k
s d
f0j5
g1 me!
u6FD
a_/m
*(}Q}y
m;j
d'w=
WC3[
8=f
)iCX
zwOL
=@gb
H+K}
t8)f,
wJA#
-<z!7^a
"?xE
dloP
+]j$
tY~L
\CLC
^g3aq
0 f ]
sIRC
h[Fk
atgd
%LU!)"
+b.Vk
UIu^}
R^+Yr4m
[<wz
;0p2
HG.m
KX`k
*nu>
G)0>
uCFu
.*^dhK(
l_eRT
%`kl
lVl
XBu%c
Q:'=_
Lv/M
FeDd
fR+Qc
7 ,p
3F19;
ItO
L;PSU
i:]LJ
^k]lY
kf*
~rZa
[BueR
C7 .
0^Cp
~GsL?
" /Z
,Pj&
*;vm
p1u$
mcl'
m:8C R"Y
Srw7?
&E/2
UPHa
Y1l[9
d>RD
}|Z
h[Gk
,3n1
#56hK79zRW0O4MGcPe23dfRJcTYpCY6mJbBQ
q1mTHkgDf68aNXzxGCalWkXkiIdjmgNv
QBCq
9aIps
VN>s
%*tH7
,qXn
!}r@
qgJ8
o[6g
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05b_64 Seven05b_64 VirtualBox 2018-05-18 04:11:42 2018-05-18 04:14:40 178

13 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05b_64 Seven05b_64 VirtualBox 2018-05-18 04:11:42 2018-05-18 04:14:40 178

10 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\po.exe.config
C:\Users\Seven01\AppData\Local\Temp\po.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\po.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Users\Seven01\AppData\Local\Temp\po.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\System32\tzres.dll
C:\Windows\Globalization\it-it.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Users\Seven01\AppData\Local\Temp\it-IT\po.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\po.resources\po.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\po.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\po.resources\po.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it.nlp
C:\Users\Seven01\AppData\Local\Temp\it\po.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\po.resources\po.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\po.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\po.resources\po.resources.exe
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bcrypt.dll
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Users\Seven01\AppData\Local\Temp\RunPEDll.dll
C:\Users\Seven01\AppData\Local\Temp\RunPEDll\RunPEDll.dll
C:\Users\Seven01\AppData\Local\Temp\RunPEDll.exe
C:\Users\Seven01\AppData\Local\Temp\RunPEDll\RunPEDll.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\stub.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\stub.resources\stub.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\stub.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\stub.resources\stub.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\stub.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\stub.resources\stub.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\stub.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\stub.resources\stub.resources.exe
C:\Users\Seven01\AppData\Local\Temp\Update.txt
\Device\NamedPipe\
C:\Windows\Microsoft.net\Framework\v2.0.50727
\Device\NamedPipe
C:\Windows\System32\Branding\Basebrd\Basebrd.dll
C:\Windows\Branding\Basebrd\basebrd.dll
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Users\Seven01\AppData\Local\Temp\reg.*
C:\Users\Seven01\AppData\Local\Temp\reg
C:\ProgramData\Oracle\Java\javapath\reg.*
C:\ProgramData\Oracle\Java\javapath\reg
C:\Windows\System32\reg.*
C:\Windows\System32\reg.COM
C:\Windows\System32\reg.exe
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe.config
C:\Windows\Microsoft.net\Framework\v2.0.50727\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe.Local\
C:\Windows\Microsoft.net\Framework\v2.0.50727\RegAsm.exe
C:\Windows\Microsoft.net
C:\Windows\Microsoft.net\Framework
C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe.Config
C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.INI
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\uxtheme.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A
C:\Users\Seven01\AppData\Roaming
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\run.dat
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\Exceptions\1.2.2.0
C:\Program Files (x86)\UPNP Subsystem
C:\Program Files (x86)
C:\Program Files (x86)\UPNP Subsystem\upnpss.exe
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\UPNP Subsystem\upnpss.exe
C:\Windows\Microsoft.net\Framework\v2.0.50727\it-IT\mscorlib.resources.dll
C:\Windows\Microsoft.net\Framework\v2.0.50727\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Windows\Microsoft.net\Framework\v2.0.50727\it-IT\mscorlib.resources.exe
C:\Windows\Microsoft.net\Framework\v2.0.50727\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.pdb
C:\Windows\symbols\dll\mscorlib.pdb
C:\Windows\dll\mscorlib.pdb
C:\Windows\mscorlib.pdb
C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.PDB
C:\Windows\Microsoft.net\Framework\v2.0.50727\RegAsm.pdb
C:\Windows\symbols\exe\RegAsm.pdb
C:\Windows\exe\RegAsm.pdb
C:\Windows\RegAsm.pdb
C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\catalog.dat
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\storage.dat
C:\Windows\Microsoft.net\Framework\v2.0.50727\ClientPlugin.dll
C:\Windows\Microsoft.net\Framework\v2.0.50727\ClientPlugin\ClientPlugin.dll
C:\Windows\Microsoft.net\Framework\v2.0.50727\ClientPlugin.exe
C:\Windows\Microsoft.net\Framework\v2.0.50727\ClientPlugin\ClientPlugin.exe
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\settings.bin
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\settings.bak
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\Logs\Seven01
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\Logs
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll
C:\Windows\Microsoft.net\Framework\v2.0.50727\Lzma#.dll
C:\Windows\Microsoft.net\Framework\v2.0.50727\Lzma#\Lzma#.dll
C:\Windows\Microsoft.net\Framework\v2.0.50727\Lzma#.exe
C:\Windows\Microsoft.net\Framework\v2.0.50727\Lzma#\Lzma#.exe
C:\Windows\Microsoft.net\Framework\v2.0.50727\it-IT\SurveillanceExClientPlugin.resources.dll
C:\Windows\Microsoft.net\Framework\v2.0.50727\it-IT\SurveillanceExClientPlugin.resources\SurveillanceExClientPlugin.resources.dll
C:\Windows\Microsoft.net\Framework\v2.0.50727\it-IT\SurveillanceExClientPlugin.resources.exe
C:\Windows\Microsoft.net\Framework\v2.0.50727\it-IT\SurveillanceExClientPlugin.resources\SurveillanceExClientPlugin.resources.exe
C:\Windows\Microsoft.net\Framework\v2.0.50727\it\SurveillanceExClientPlugin.resources.dll
C:\Windows\Microsoft.net\Framework\v2.0.50727\it\SurveillanceExClientPlugin.resources\SurveillanceExClientPlugin.resources.dll
C:\Windows\Microsoft.net\Framework\v2.0.50727\it\SurveillanceExClientPlugin.resources.exe
C:\Windows\Microsoft.net\Framework\v2.0.50727\it\SurveillanceExClientPlugin.resources\SurveillanceExClientPlugin.resources.exe
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\System.Configuration.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\461d3b6b3f43e6fbe6c897d5936e17e4\System.Xml.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.INI
C:\Windows\Globalization\en.nlp
C:\Windows\Microsoft.net\Framework\v2.0.50727\dnsapi.dll

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\po.exe.config
C:\Users\Seven01\AppData\Local\Temp\po.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\System32\l_intl.nls
\Device\KsecDD
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\System32\tzres.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
\Device\NamedPipe\
C:\Windows\Branding\Basebrd\basebrd.dll
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe.config
C:\Windows\Microsoft.net\Framework\v2.0.50727\RegAsm.exe
C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe.Config
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.pdb
C:\Windows\symbols\dll\mscorlib.pdb
C:\Windows\dll\mscorlib.pdb
C:\Windows\mscorlib.pdb
C:\Windows\Microsoft.net\Framework\v2.0.50727\RegAsm.pdb
C:\Windows\symbols\exe\RegAsm.pdb
C:\Windows\exe\RegAsm.pdb
C:\Windows\RegAsm.pdb
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\System.Configuration.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\461d3b6b3f43e6fbe6c897d5936e17e4\System.Xml.ni.dll

Write Files

C:\Users\Seven01\AppData\Local\Temp\Update.txt
\Device\NamedPipe
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\run.dat
C:\Program Files (x86)\UPNP Subsystem\upnpss.exe

Delete Files

C:\Program Files (x86)\UPNP Subsystem\upnpss.exe
C:\Users\Seven01\AppData\Roaming\88A12796-24F0-4E67-B5B8-6D00E4011D2A\UPNP Subsystem\upnpss.exe
C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe:Zone.Identifier

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\po.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\701bff\1e1e5dff
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3416b996\b928fd8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|po.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|po.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|po.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3416b996\6789bce1
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\4ad60644\6f323003
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5d1b2185\235dd0a9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5d1b2185\9e47f51
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DisableUNCCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\EnableExtensions
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DelayedExpansion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DefaultColor
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\CompletionChar
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\PathCompletionChar
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\AutoRun
HKEY_CURRENT_USER\Software\Microsoft\Command Processor
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\it-IT
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\it-IT
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000410
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Update
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regasm.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5aa75839\10fdf3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\mscorjit.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\System.ni.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\System.Drawing.ni.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\System.Windows.Forms.ni.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.8.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Web__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
HKEY_CURRENT_USER\Control Panel\International
HKEY_CURRENT_USER\Control Panel\International\sYearMonth
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UPNP Subsystem
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\UPNP Subsystem
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Windows|Microsoft.net|Framework|v2.0.50727|regasm.exe.Config
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Windows|Microsoft.net|Framework|v2.0.50727|regasm.exe.Config
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Windows|Microsoft.net|Framework|v2.0.50727|regasm.exe.Config
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\culture.dll
HKEY_CLASSES_ROOT\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32\(Default)
HKEY_CLASSES_ROOT\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\diasymreader.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\4ecde57e\31d9ddbb
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\a054161\46043f61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\219e9581\29613036
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\219e9581\26d59603
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\InstallationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Data.SqlXml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Data.SqlXml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\Library
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\IsMultiInstance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\First Counter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\CategoryOptions
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\FileMappingSize
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\Counter Names

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DisableUNCCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\EnableExtensions
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DelayedExpansion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DefaultColor
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\CompletionChar
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\PathCompletionChar
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\AutoRun
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\it-IT
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\it-IT
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000410
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Update
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\mscorjit.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\System.ni.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\System.Drawing.ni.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\System.Windows.Forms.ni.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
HKEY_CURRENT_USER\Control Panel\International\sYearMonth
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UPNP Subsystem
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\UPNP Subsystem
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\culture.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\diasymreader.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\InstallationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Data.SqlXml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\Library
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\IsMultiInstance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\First Counter
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\CategoryOptions
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\FileMappingSize
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\Counter Names

Write Keys

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Update
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UPNP Subsystem

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX
Global\{694600da-1a43-4b5d-b649-0e509c8f7a8f}
Global\.net clr networking

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
kernel32.dll.QueryActCtxW
kernel32.dll.GetVersionExW
kernel32.dll.GetFullPathNameW
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.GetUserDefaultUILanguage
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
bcrypt.dll.BCryptGetFipsAlgorithmMode
kernel32.dll.VirtualProtect
kernel32.dll.GlobalMemoryStatusEx
kernel32.dll.GetEnvironmentVariableW
kernel32.dll.SwitchToThread
kernel32.dll.CloseHandle
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
kernel32.dll.GetCurrentProcess
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
kernel32.dll.GetProcAddress
kernel32.dll.DebugActiveProcess
kernel32.dll.WaitForDebugEvent
kernel32.dll.ContinueDebugEvent
kernel32.dll.DeleteFileA
advapi32.dll.SetKernelObjectSecurity
advapi32.dll.GetKernelObjectSecurity
ntdll.dll.NtSetInformationProcess
ntdll.dll.NtProtectVirtualMemory
kernel32.dll.GetModuleFileNameW
kernel32.dll.GetTempPathW
kernel32.dll.CreateFileW
kernel32.dll.GetFileType
kernel32.dll.WriteFile
kernel32.dll.LocalFree
kernel32.dll.CreatePipe
kernel32.dll.DuplicateHandle
kernel32.dll.GetStdHandle
kernel32.dll.GetCurrentDirectoryW
kernel32.dll.CreateProcessW
kernel32.dll.GetConsoleCP
kernel32.dll.GetACP
kernel32.dll.UnmapViewOfFile
kernel32.dll.GetConsoleOutputCP
kernel32.dll.SetFileAttributesW
kernel32.dll.VirtualAllocEx
kernel32.dll.GetThreadContext
kernel32.dll.Wow64GetThreadContext
ntdll.dll.NtUnmapViewOfSection
kernel32.dll.ResumeThread
kernel32.dll.SetThreadContext
kernel32.dll.Wow64SetThreadContext
kernel32.dll.WriteProcessMemory
kernel32.dll.ReadProcessMemory
kernel32.dll.TerminateProcess
ole32.dll.CoUninitialize
kernel32.dll.SetThreadUILanguage
kernel32.dll.SortGetHandle
kernel32.dll.SortCloseHandle
kernel32.dll.CopyFileExW
kernel32.dll.IsDebuggerPresent
kernel32.dll.SetConsoleInputExeNameW
ntdll.dll.NtQueryInformationProcess
kernel32.dll.GetNativeSystemInfo
uxtheme.dll.ThemeInitApiHook
user32.dll.IsProcessDPIAware
cryptsp.dll.CryptAcquireContextA
cryptsp.dll.CryptImportKey
cryptsp.dll.CryptCreateHash
cryptsp.dll.CryptHashData
cryptsp.dll.CryptVerifySignatureA
cryptsp.dll.CryptDestroyHash
cryptsp.dll.CryptDestroyKey
user32.dll.RegisterWindowMessageW
user32.dll.GetSystemMetrics
user32.dll.AdjustWindowRectEx
kernel32.dll.GetCurrentThread
kernel32.dll.GetCurrentThreadId
kernel32.dll.GetModuleHandleW
user32.dll.DefWindowProcW
gdi32.dll.GetStockObject
user32.dll.RegisterClassW
ole32.dll.CoTaskMemAlloc
ole32.dll.CoTaskMemFree
user32.dll.CreateWindowExW
user32.dll.SetWindowLongW
user32.dll.GetWindowLongW
user32.dll.CallWindowProcW
user32.dll.GetClientRect
user32.dll.GetWindowRect
user32.dll.GetParent
uxtheme.dll.IsAppThemed
kernel32.dll.CreateActCtxA
kernel32.dll.GetCurrentActCtx
kernel32.dll.ActivateActCtx
dwmapi.dll.DwmIsCompositionEnabled
user32.dll.GetWindowTextLengthW
user32.dll.GetWindowTextW
user32.dll.GetProcessWindowStation
user32.dll.GetUserObjectInformationA
kernel32.dll.SetConsoleCtrlHandler
user32.dll.GetClassInfoW
kernel32.dll.GetStartupInfoW
user32.dll.GetWindowPlacement
user32.dll.GetDC
gdi32.dll.GetDeviceCaps
user32.dll.ReleaseDC
user32.dll.CreateIconFromResourceEx
user32.dll.SendMessageW
user32.dll.GetSystemMenu
user32.dll.EnableMenuItem
user32.dll.SetWindowPos
user32.dll.RedrawWindow
user32.dll.ShowWindow
user32.dll.GetWindowThreadProcessId
user32.dll.PostMessageW
ole32.dll.OleInitialize
ole32.dll.CoRegisterMessageFilter
user32.dll.PeekMessageW
user32.dll.IsWindowUnicode
user32.dll.GetMessageW
user32.dll.TranslateMessage
user32.dll.DispatchMessageW
user32.dll.GetFocus
kernel32.dll.SetCurrentDirectoryW
kernel32.dll.FindResourceExA
kernel32.dll.LoadResource
kernel32.dll.SizeofResource
kernel32.dll.LockResource
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptGetHashParam
cryptsp.dll.CryptGetProvParam
cryptsp.dll.CryptSetKeyParam
cryptsp.dll.CryptDecrypt
cryptsp.dll.CryptEncrypt
kernel32.dll.ReleaseMutex
kernel32.dll.CreateMutexW
advapi32.dll.RegOpenKeyExA
advapi32.dll.RegQueryValueExA
shfolder.dll.SHGetFolderPathW
kernel32.dll.CreateDirectoryW
kernel32.dll.DeleteFileW
kernel32.dll.CopyFileW
advapi32.dll.RegSetValueExW
mscoree.dll.DllGetClassObject
mscoreei.dll.DllGetClassObject
diasymreader.dll.DllGetClassObjectInternal
kernel32.dll.GetSystemInfo
kernel32.dll.CreateIoCompletionPort
kernel32.dll.PostQueuedCompletionStatus
ntdll.dll.NtQueryInformationThread
ntdll.dll.NtQuerySystemInformation
ntdll.dll.NtGetCurrentProcessorNumber
advapi32.dll.GetUserNameW
user32.dll.GetForegroundWindow
psapi.dll.EnumProcesses
user32.dll.GetKeyboardLayout
user32.dll.RegisterRawInputDevices
user32.dll.SetClipboardViewer
user32.dll.SendMessageA
ole32.dll.CoCreateGuid
ws2_32.dll.WSAStartup
ws2_32.dll.WSASocketW
ws2_32.dll.setsockopt
ws2_32.dll.WSAEventSelect
ws2_32.dll.ioctlsocket
ws2_32.dll.closesocket
kernel32.dll.GetFileSize
kernel32.dll.ReadFile
mscoree.dll.ND_RI2
mscoreei.dll.ND_RI2
kernel32.dll.GetComputerNameW
advapi32.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW
kernel32.dll.CreateFileMappingW
kernel32.dll.MapViewOfFile
kernel32.dll.VirtualQuery
advapi32.dll.CreateWellKnownSid
kernel32.dll.WaitForSingleObject
kernel32.dll.OpenMutexW
kernel32.dll.GetProcessTimes
ws2_32.dll.inet_addr
user32.dll.WaitMessage
dnsapi.dll.DnsQuery_A
ws2_32.dll.getaddrinfo
ws2_32.dll.freeaddrinfo
ws2_32.dll.bind
ws2_32.dll.WSAIoctl
ws2_32.dll.WSAGetOverlappedResult
kernel32.dll.FormatMessageW
oleaut32.dll.#500
kernel32.dll.SetThreadExecutionState

Execute Commands

"cmd"
C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe "C:\Users\Seven01\AppData\Local\Temp\po.exe"
reg  add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Seven01\AppData\Local\Temp\Update.txt" | cmd"

Started Services

Nothing to display

Created Services

Nothing to display
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05b_64 Seven05b_64 VirtualBox 2018-05-18 04:11:42 2018-05-18 04:14:40 178

3 Host(s) detected

IP Address Hostname Reverse DNS
8.8.8.8 United States google-public-dns-a.google.com.
8.8.4.4 United States google-public-dns-b.google.com.
78.130.176.161 Bulgaria server.cloudbalkan.com.

Host(s) by Country

Hosts Country 2
2 United States United States
1 Bulgaria Bulgaria

#infosec #automation

TheSystem Itself @ 2018-05-18 04:15:12

Detected family: #Nanocore

TheSystem Itself @ 2018-05-18 04:20:02