MalScore
100/100
MalFamily
Malicious

idihc.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 10/65 Related 2391
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 603.50 KB (617984 bytes)
Compile time: 2017-05-13 03:01:22
MD5: b093dda14ab2bcceaf790f760db88d6c
SHA1: 36e9e7b9251fff0ef819c0b70d21f0d606c2a543
SHA256: 59155d4b1847f13be514faa25263ff9bb9c8b46b873a03fa358622d86c3bedab
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-02-20 13:15:05
Last submission: 2018-02-20 13:15:05
Filename detected: - idihc.exe (1)
URL file hosting
hXXp://prosciuttiamo.it/ice/idihc.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-02-20 08:15:14 [10/65] VirusTotal
PE Sections 2 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0x62cf4 404992 3b14588c017b873351dd2baa861c6e44 75f1fb8e61b2b2514311b8f1030122ec59d906f2
.rsrc 0x66000 0x33a60 211968 6267d26257c7ae6b6d3f22d19e3a5cc1 c1b48df821a8a122607220a40ecd78beeac130b3
.reloc 0x9a000 0xc 512 d1313e95ccc499a8b0420c0f1332d3b1 74ce7fee9d61df98f54ed75c273417684e019e9c
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x66130 209740 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x9947c 20 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_VERSION 0x99490 996 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_MANIFEST 0x99874 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: Copyright \xa9 2018 Ace Hardware Corporation
Assembly Version: 0.0.0.0
InternalName: idihc.exe
FileVersion: 1.3.1.1
CompanyName: Ace Hardware Corporation
Comments: oyonayaweb
ProductName: Accu-Chek Connect diabetes management system
ProductVersion: 1.3.1.1
FileDescription: Accu-Chek Connect diabetes management system
Translation: 0x0000 0x04b0
OriginalFilename: idihc.exe
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Library
mscoree.dll
IP Found
1.3.1.1
URL(s)
No URL found
String too long
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
Comments
InternalName
2018 Ace Hardware Corporation
2400731d-8d87-e232
2400731d-8d87-e233
2400731d-8d87-e230
2400731d-8d87-e231
2400731d-8d87-e236
2400731d-8d87-e237
2400731d-8d87-e234
2400731d-8d87-e235
2400731d-8d87-e238
2400731d-8d87-e239
2400731d-8d87-e213
LegalCopyright
idihc.exe
oyonayaweb
2400731d-8d87-e221
2400731d-8d87-e220
2400731d-8d87-e223
2400731d-8d87-e222
2400731d-8d87-e225
2400731d-8d87-e224
2400731d-8d87-e227
2400731d-8d87-e226
2400731d-8d87-e229
2400731d-8d87-e228
VarFileInfo
2400731d-8d87-e242
2400731d-8d87-e22
2400731d-8d87-e23
2400731d-8d87-e20
2400731d-8d87-e21
2400731d-8d87-e26
2400731d-8d87-e27
2400731d-8d87-e24
2400731d-8d87-e25
2400731d-8d87-e28
2400731d-8d87-e29
2400731d-8d87-e214
2400731d-8d87-e215
2400731d-8d87-e216
2400731d-8d87-e217
2400731d-8d87-e210
2400731d-8d87-e211
2400731d-8d87-e212
1.3.1.1
2400731d-8d87-e218
2400731d-8d87-e219
Copyright
ProductName
dxy
08fd8934-aa8e-4d
Accu-Chek Connect diabetes management system
VS_VERSION_INFO
Translation
Assembly Version
CompanyName
2400731d-8d87-e265
2400731d-8d87-e264
2400731d-8d87-e267
2400731d-8d87-e266
2400731d-8d87-e261
2400731d-8d87-e260
2400731d-8d87-e263
2400731d-8d87-e262
2400731d-8d87-e250
2400731d-8d87-e251
2400731d-8d87-e252
2400731d-8d87-e253
2400731d-8d87-e254
2400731d-8d87-e255
2400731d-8d87-e256
2400731d-8d87-e257
2400731d-8d87-e258
2400731d-8d87-e259
StringFileInfo
2400731d-8d87-e247
2400731d-8d87-e246
2400731d-8d87-e245
2400731d-8d87-e244
2400731d-8d87-e243
FileVersion
2400731d-8d87-e241
2400731d-8d87-e240
2400731d-8d87-e249
2400731d-8d87-e248
000004b0
ProductVersion
FileDescription
#@\h
0.0.0.0
OriginalFilename
Ace Hardware Corporation
5Q%+W
2o`$
wH-Q
6 1z
}Pc@
'la'I
ZSzK
@a<N
[HC4>
=4]u
%`k:&R
NC%,J
r(A=
Ja|V
3 S~
R$z3
YjBs
Tb r8+
6Po~a
vw4<
52a,
k55r1
<Dg-A
|?zH
B~wG
( -dT
(XOi
PNG
'Mor
Yt=`
j8kl6
A4|(
<vr\53
_ 0C
'o
42:$
Dj;1
T]7
M0F9
i'>B
)1(CR
!Oqp
+T@1]
/irc
)%'g@
( a?
]s2Ox
Eh ~
7? t+
Gy7Z
Nh%h9(]
)3oh
mfr<
a]BjM
`t%,?
MncQ>
%(a[
sxe}b_
k{5b||
@026^
>i?[C3.
U.$j,
6wWf
Control
1eZ1
~Bxmr
bhG"
vFSB
7Rre/z
yxcb
:.9 ^
8bC%y
4kGI
Bltv
&D$x
nB~Y
0^A
R#3H
^UQ xkf!V6c
8a87>u_
yL"5
OS1}
}n\ &
{ E4
w^m/
!Pi)
~S fh:{
S,Rb
@*\#
yO5
|'Vh
{33^
textBounds
1.K1
%R}R
h~X&A
= < < < < < < < < < < < < < < <
LLJO
m au&`
O0h
FqxZ
=a |
6ZBn
s =
*P8
4G}6
!n7D
l0.x+
1.K6
System.Runtime.CompilerServices
1o~p
J/|-
wkD#
_Qa#/
]jvO<
f <O
\zLe
@ |LO
<'cS
aN"|
N^~V
`Mt-J
vU1/X^
u\a|
@Q7h
]bP+
b=nz
jA]
Q-P_
kA1Q
Int32
ArgumentNullException
xl`
0]jo
L y 4
z-:K~
KM=~
GcM]g
o5L
Sf.H
Xma<
y[lg
X&hz
Iv#L
Ta(w
=xno8
VyF|
;A;
~$w|T
|JOe
%=m5{],
_kiu3O
E9#Xr
[q& ;
rz,t T
#QRA
Xu(u
L26J
p*2$%)
X)xvra
ZJK"
5-Im
'm&{
JWK7Ip9A
=B@W#
M_0u
&d$VS
tfuEB
?5F"
w(JQ:
Gk w
0Y98`
bHr46
qctZ
x$vg>
c&/
VyOD'
6q "
FUI`
`g$F
Y o]
vzN
5n0u
CH L?
wp:)tN
mOscx
974z
4Y{\
+0 72
@_YI
RA&
<O!#Z
mscorlib
$%(qU
Sx?d\
f~Oo
_ Rl
LabelEditEventArgs
_ |!(
~|K`
}f8`
uxvc0'(
<Gy&%
'Nb
1.K.
FEc8-
cK9a
atH
{gDl
:Vmwkl
99`L
lK"i
Wl5o
NA^b*@
Zv9 +
L d/Y
[[&k
|C?gp.
,i0^ d
g&g
!Q
33Eg
3Gr/
tw w
4%+tB
t <SeR
Q0jH?
34J+{T
RfQ8
t)c[
E q@
X8P'
>(^b
aI[M
9mT@N
Math
i-Tb
u'w5
rYrv
WWeM
2kk$
*qz?
Voj?Z
, ?0^
B"[Z
GJ19O
7Hl;
set_Alignment
u1YMv
$6Fuq
<Yy|
]C=D
`$urJ
jg "
xj"o
CD92
5z b
^ Vgp
)7:3r
$HrP
mf*+
ipq13
],!/
5(lZ\N
:wkB4f
cBqCQ
hXCt
/*lsw
"k5i
awDp
lK^@
C!{R
@?sN
b+>?
" 3N
O>ND
~8uv
WL>
XPz}
@Cpc
ut~ (
o?s{
E361
1$f9
0A:j
@}7|
]c 4<
XSx$
g dJ
B+[,
9-xD
!$b^
m[aY
` RK
)Hw
_m?
)Xv^
$^22U
Vt&_Z
AppDomain
eXFb
X[w u
,UcZ nW
zsuWQ%
bfj7~:
545L
'zYB
v4lP7
Rui@
ahC8
Ho~nc
m<L.
qu".K3
:( s
w#z-
CA/D
,6A[#
~_9=JI
z?0p#:J
5>BTL
vx\]
QL.,`m3Xj
P )D2
Gt$yNK
N|6-
RpmN
lt||/,
a{A"
|8=1
> @
<K#]
BV]qtC
77YtL6
g6;la
L !]
,x_';
56=T
9V p
>} f/
[M13
hARa(9
NNLw
Lu}_4
v5,w
)x>I
-+\U
LHD?
dhZZ
NH@k
b%Y+
[}fO^
AssemblyTrademarkAttribute
:}Vi2
<{tl
DY[Y
I%mi
/fg_
h]sz
`csm
LO$m/
xx9 C
9[> I
"jU$
W$*)
sC!q
],
t&-6
Q$c
Ku#g
z227
G"(a
!Hlt)8:
[X]u7
xGf
u*o]
,U/e[
T ROG
*H n
@D
RaY4^
wd::
t3]M
k~#:
MF*fo
Vit
=r|8
T?'n
TabPageCollection
N'%9
miFj
h!y4
_q)*
T -9 :.*3
2-Cb
\)KA
acmq
|q;
EY +
Ypwm
_W.h
(GZ[
,?rX
X?*o
!+zo
AV*|
/#MY
vZE
OnMouseMove
rk^2S
1"u=
XswN
u)D
`)o
OIsO
V\`r
"u)0
-o/]
0I4'
Gzt0
xZ&4
no-#
EC5F
Kst*
#))}(B
]h}/
z]0S
X1sa
W5!9
<=b @
`)}G
.xX1W'
)k6m
System.Text
Pr7O
uZlV
c=5#
IhLq
`P5ED
s4)j7
ETtj
oVD&)b
"0mkt
),GQH
kM! i
pDu'[@
set_Width
Nlj
V,X=
j@Il
Kq+%!
M3KD /
a':3
d;g:jRf
bRM-
X~ s
>^Z7g
7A&
.=6QE g
s;?&a
2%eW
_LNl
.o->
0~ /
N$0f
Hovering
m_,1
Mg$U
-06!W
yG[l
019>
`Ymfg
u'p'p'p'p'p'p'p'p'p'p'p'p'p'p'p'
}>M?
8IDAThC
Lse_
R 3m
o`<_
puGB
<NxBK$
"s(E
D~/C
+1v|
m.j`
T [i
_-xq
ZM.?
=|5w
String
ry|D
e$E}S3
0IrTs
R2H6
@NL4P[
)Mc' 9
H1f
D4K0-
7"Hw
J&B8T1
specified
$-)w
aDlM<
d"ZR/
$dS:t
Vb@4j
|R71A?
K(Rl
AH`3
$^Zn1~
J GF
,cb8
E$L
hp6 k
L!}o
5."h
k7$
N5V)
QQA|
6Y!
RP``
+A E
< xc|
1-[p
SMU\
>**d"
)?dg
}Q!{
;[n@
6 D*
7 [b
B.Ue
W_rX
J}fM`z
Vm qR
UA1p
w7C;{
zieK9
9qZ^:,!b
FQ(o
GHCL
8D]z
>DG2
+&u3+
L}D$J
GTo!U
dP%H
5zGn
qM"{=
!%1jt3
^(!j
mOkZ
+u>k
d? 4"
sfNL7
=<qY1
P(E3
>l)/
u#8D
A%>_g
VNOn*g
BaseRect
/n^6
4&2M
.text
.\Xl<
x:PV
fo3X
+p1o=
*T>
?.?a
+7xV
}7@@
hUFd
/=b
{2Lap
RuntimeHelpers
9\ "_
}hX{
vg'O
Q9Y%
>ORs
_VA\
#$P[
U/VDP6x
95jh
|>0p
~~dI
:G+4
bsm3
g^St
x*I.
xTxen
ck4[
G}nL
/9(#s
ek.g
(tzS
w0@7
Ex^g
?cD
#&W}j
[ f6
g7vL
5 9O
;&`q
]vq>'
EY$(
fmX>j=
@hS$
V:"x
AObu
krE
m[gg~b
02k]
xzQ+u
jx2O
Hs^t
r-/b
d*, W
k\SSq<JDA
0L|K
XODO
VI.p
Tv.o
*r(\
H~*j]
p^qB
o 1_I
t#GA
aL07
dw}M
rQ*1
w/r
+o$_AW9
adzE
>\o~
/b#e
jk
CEon
S_7
LHC46
] []
S6}~
jz6E
b,f
in_#V
-dcD
jZwJ
q?PX
f"L? \
tcRj
yR-2
7Q $
HX=T
2AFJ
QoJ2
D]`O
S*5S
l~YS\'$
c4 N
KJn?
.XY~
q]1:G
UX J
Uz[D
KcN#
Fa%9b
/`@ip
:x\]
J2SD
)"8h=;
DQ0x
DnqLn.
Qz/U
._uW
'6EXa9
>TOS
Cp&`
!B&(e
~`@ %
$=O
\\`u
<*&*
%[j)
GgKT5m
XKFH
ResolveEventArgs
F-t*1C
q\@s=
ytmChkF
<aia
Ce$sH}
k]C*
L*SD$
JDX s
vSNEM
urfMP3??
Iwu'
BoundsSpecified
Tj+~
\LJ Gj
iW*z
%j{-
FY%>
}j7S
"FS&< |
set_X
e- M
8ozc
], 4<
}Yk;m k
62~lW
M(8
n6Uk^
1=6u
vax,
Jr7yC(
a &[
S:lxI
x!T#
,4[)
(=7P/
!-Rb
B"RIL
,Pk=?
GG2[
<'gJ
XJ\\
p"vI
R O/A
&IUv
<zYB
4mCWY
pHYs
j); A
PdIA;
gQ(m
zAbo
i~DM&
57c
{ eS
&gYNL^
- Y1ydw
uW+
{2},
SiOL
y}^hI
;b_4n
i}d\
y)l[`P
pchk
,Jzk
l^Kt
^.,T
>K@O)DH
Fr[Tx'c
S+>_
Z"<t
F Le
BYiy
e1}9
[R>4<
a!dhd
ZKon#
,E 0W
qg1M
!(
fs>3@mF
o,k
?1F:
39-:
CxA(
dgtt
GT^)
+ >z
/0F }
CFxZ
!u)5;
J]e{
}#?mJ
]&(1"
I&F?
n%Q{
V3eV$
\G0/
> Qk
?W[^
3ax79
|^?~
qf<S
snaV
[T'(5
K_S=
/*]'t9
_b$J
q@1/TD
[A%u)
pxN.
;N@_
B$S8:
[^@1N%5A
- aG5N
ControlStyles
}2!D
r]Zf
FH.Ge
Q\itC1
zP:]
Glk\
5O 3
W7!V ;|
&)v*
# se
7#QP)P
*uP z
)_RVr?
L9J6
V{)+d
pz%d
sJ\
d_^M
%QbH
SSR|N
><`~
EP<I
s8%FI
<:qZ`t
6{?k
Mld>
_DD6A
]R&zK
rU8tI
$S!,
+TpT
<m>%
D~7g
`ok
}6noLu
RZCT
v^Ny
p\Y
%rl>
FJI
psC'^
u`U"
\;I\
fX^q
L=3]
'f\>n
I2BK
7MDj
+qz5
Y<fiy
?o9
u13Z6
n@Kcp
-!5k\
g[H&
Cz'[
ZG<
f/xX
oN>
T|6
tJV|(
TN.B
7T|&
Lk^-
{W >
q]IE2
A8'r
dp$}
Y2R;
PSjw
I Aj
-2WBegp
wT+,
6b?;
nuN6
xsk$
*@J0
7m$
f6ex
v,;cU!
]tFe
js"A
Jg1y
get_FontHeight
(7E
7c"-"J
nAjt
uY{,
?c[M;
uH_9
t g
%Nqgs}
g!)T
<* 4;
yCF,yL.
\~lm
{>-4
j~O<L!aX,BhP
{WsN
0 .
N,\
i_Gn
r:wq
8A'=
+GvAA
39D$
iZsD
3h<
wjI?!\<z
@UtTi
t:Nn
9 ky
D4eDe+
o c%
Ya)x
_-"}1
jx=K
&*8_
J1JU
8wxn
; CG
U }%
/~cb
Me0*
X,Pz
"Q!N8K
Y ?4
q"y&uc
( Jh
bM(=L
imLy
^W7D8r
]Llz
.mnO
VgAU
slr_
TYgi
get_TextBounds
B!/ B?
pEM"d
?{t?
^a0a
'X?J
#c4
c 6"
FGU~l
Ax}k
Wty<
>WM7
2#|VW
t}XF
e!;B
?PIX
LB1z
/FHjN
KQ;o
RuntimeTypeHandle
3:HX
V&Y9y
nSk%
%oLWs;
"=U&85v
!kN
0?.k
~)Am
1L9`
MVT=
CZ:@T
Oqvn{"
,EDu+
{_ui6
ko^(
-1h
B^P^
nPi|
5 ((]6
+SVM~;
2^?A
ER%a:
'SJr
?"4`
gXD<^glh
\M=C
C/y>
Eq2QA
}Vc!
B!2*^
]F=((e
b/8A
\]PsgG
8wJ/
Xx" V
& ?2
i&b[8
n;m S
#5n
RSF#9
^+:<u#s
+q?w
wwVQ
Srz
4!sMf
gx:X
E}9L
&*8\
LlNO
SbSI
dA?`
k>_/
\}&k
matemdeea.exe
IHDR
S{b >)mR
2XZpUJ
ufc
H/=+:
%=`Q
uL{B_ :
v5fv
&;Tw
m4IQ
leh
uMRBw
mjC+
4$1Hh
4RT0a]
5?iy
}IDAThC
bn4)
C]bL
m[^*5
avH
L7T
D^f6
+X^
7C?x
3W/8
&*8a
K[7i2z|
R\><
p Jg
&*8n
fTX<x
1Y 8z
*]4m
x]v@
XnKtY
J5?vk p
. ,h
qd;Z
~fb#
t2#y
$-?q
w;gI;
[-z%
KzrA
aNf)
UKGf
8ec T
Q*fpc
s'..
v=TF
8i;C
taA:
3+{^
%b\)
Mo Ix
ai],
0?OS!
l^'Z
=lPv
vf n
2\Y{
=1n&
U6'\
d}'J
! h|Q
Ty~n OTg
hmU
e p
DDa;+
m v7
V'5r
X&&9
u3 46
/YFy}
Jcor
Ng)wx@b
y0f|0;R
-=#lQRE
%0k#
X"~B
&H|5
n4httZ
5SG&
4Z`WK
xymseS
\.y4ng`@
d/\-
bc/3
/>=1
&*a%
[N
<I%cr
MethodBase
#Strings
[+zX
Font
B XUO
w0Mt
@oX.g
/ >!o
?Gh!Y
ZR&g
0X $
.(>^
] WQ%
F .lGq'
=<lQ
Ig=k
i>CI
m l%6
OlE8@
Ds??
-U-j
%o a
$F7LB
ka79y"
g$V1Wl"
rH.]
,QF)
IbY]
;j}|%
1pz
D28rN
VG}^
! ^
Z`yp
SV}E
,gZN
EVfV
!!NJ
_S\EG!,
(Sz3[
`juY
:<i
OC -
pkl"
u, v8
3J{i
9Et
SEk1
Wg@_
=8W@
`?xG
VB30
Zd7q
zY@ E
7f:,
B"m5
` ; E
LHB44
Q0%u
y\YD
mscoree.dll
get_EntryPoint
S,$5:x
R-S?
Hi5/,
8]~~m
RSK
F."f
]Vc)
(in}QH
6cc`
37~'
y~)~uB},@
zob#L
~Z]D
!-Sb
,6.b
?&C?
kB-9
wxQms#
\ iN
:Az{Qo;
%qy4
;E n
9hX}t
wXu[
j dc
zTBkX
^mE0
b}mSYd
k[L$
*6x
01 #0P
OmG;
K8}
'LT<+
KI/Huit
*u~v
#' @
1,vU88beVS%`
Or?Q
;Nk$t
add_AssemblyResolve
tVc &
eQ8x
IDAThC
(Yvh
`f,~
TextFormatFlags
get_ShowKeyboardCues
BrkJ
Gw~?t9]
ks,l
x6PR
woq@
~h>:o~ :
AssemblyDescriptionAttribute
#[j_
:xC(v
%(v=
?hGU7w:
eDPe
IL||
Fb7$
4ml2nbxP+(o
+@ E
G9tO
BSJB
.Y(i
[N<!Eb'
3r9_C
F$Hh\
U/ 4
+H%aJ&
_Assembly
B` 8E_
4`VSv
< "V
0zhm&
jL$O
h~YD
LAUr
(%Pi
3* D
TabControl
G.zX
^tezx
*5[U
0RFE
'x K
[1t<
6LNM
,{xc@M
Cy93
Ck'
BOyvx
Md+)
}*((
lbiC
jr:I
5%!Y!i
yQRBC
'{}[
i.Dn
Qe;3
;|*}
.+q-
0#YXv
Color
yZo2>
IEnumerable`1
P4V!
1KK1
u-;-
Me+(
d1 "
4{T&U
uWjg
|I]`v
0WL%~
8*lE
.zMo
1,>g
(+Pe
set_BackColor
_CorExeMain
0<FE
AssemblyProductAttribute
R1=h
Pt,$k\vd
u5eI
{Ny96;
:e?P
$ ]Zl
!UtV
%-iF|
^-k`I
`$v%7
**[%
Og)4
f+ S
get_Width
t7e1
b|o}
hrlg9
RR`=
W&HzP
P~]$
F!xE
H`|z4
';^}
b26<
i7s&
Q1i!
M/UJ)
I9b$
tS=x Vo7
~s5{=b
oPP~
X4 t
/dL)
5ZkZ
fE 4
so#2
Cdsfssrd
g}0K
BN!qs
5dw(dl
tT4^1
%\ae
`J@t
G!hm
?Ybn
9 |1
S+S]
%$12
@$*Q
K'vf
%OEDH
Ure^E
bJY^
Lf:q
n&1J
`)R<
YEYI
6 k2
k.0e
gE tK
HV u
EanW-
XKdY
t:\A
S0j3t'
`^u7
w2Fn
s47/X
56g@
a`Mj
EIJw
"'aF
]n&F
928{
|H#5-,1
Gw!9
1`) <
>d4>
NM\m
0>'<[
#}> S
4Y 8L
2WtU
=7Y#
/V_w
4H^u7
fUt3/
C)G+47
Ta3p
dO]}RnkXP
;j )
;"Ch
-S*E
E ]0
HA&y7
1GrpB
|;Lm
v=N!
& 98
W]RZ
\zfl%
xva
XK@\
cS4[n
rkr6
y&-L+
{p6bHFo
@K%(5
P~a;
O(s
-#'z1
Q~;s
j$;>
l^6J
ZX|Y
biS
xUqj,/&
W\s V
[O%
n~ED[
{RXb
!D F
OJ,x
yxUx
</t6Tn'
4q:I
{@NL
i]UH
F{3!
f~v
sG<I
O280Y
sO`t1
mDCG
<)]i"<<f
N*vo9x'
3GaT
&UPFf
qG 8@
bNvWP
p*\\
t<&Y
oX.'
'Pe'\
!]?_
63TG
height
7|a`
3^7y
xoL*z
=#UE
[v(s
Mo!Z
] U1
*UNO
MW&!
+n!'
ET +
8j)b
%& k
CKE N
$f089f16a-3a0e-4dad-8b8d-898e8bdde45d
ALOQ
ug#."_
!/ v
Kj_W
pHu
e _d
GetTabRect
8`T_
U=7H'
d>^C
S/Zb{
NB@5u
+Uf
DZV<
(dk|
U?Dd
#Me!?
^N59eD
#%jl
hi'7
. O Ox
eovw
Ecn K
\wRv
Ta3|
&oaz~![
)Q\4
Contains
Vb_b@
quoW
VAz2
{ lI
q 4
7nU3%bt
OnCreateControl
!-RbO*YA
%HP4o#z
;I-b
r~{
}TR"T`3v
L$WlaUT7
F3>3U!7
1i#L
Th8;UT*
;Pin
79q
/m -
ih:)l
tq?}
T'A46
x].W
qs>TO
v-:Ily
IDeviceContext
=My6
r~P~_
uz :
q |-
05>;
/hr }
8"F]
hBNIq
KGdV
nSNZ
<b=i}W
!n ]
$-Og
fcL7
N-e 2
"G_(
ebL!
^C&X
>w7h
_J_'`
aP0z#
_^9YQx
&7) Y
2&-kg=
/%R`
:}3P11
auFn
Yr3w_
}`F%
(u H
j62i
2ex
],*Gk
XR]R
t eN.Y
}:*
Voym
,;@
]* '
\{;[
u@0|
5xyb
L)zP
7`/#
_p P
'2[9
(>+#
~CFL&
>H,4W
/}i"
TVXr91{T
bb&T
7btZ
BO~ p
[`OJ
^Sx8D
X?v`
XCgK*C8
=2 z,
lwZn
lYp"d
F=N(
[0\|Li-
:zV:8
EUI9
gPW
wgGm
1ucZ
YvK]P
SiCm
TZTG
J^4*
L6R[
-U"Hm
5HF8
0l&E
VK)
;JPfN
TT"X9
7y$k
Jx]z_c=
NHB46
Z1ui
UePZ
ByN,_
wNf
W>C9O
I CU
v .d
6W~-
D/*5k,
#$.QUTz
iqM?h{QM
8Lk}t0
=a"p
hy[
wF?P
gQsc
^`g}hC
get_Count
FIht
..01t
s)!7
n%O!
d5, r[\
k, @
SFZ[
HpG(#:
A\bg"
'),dK
xJK1bRV
,1Ll~(
& t<
]gJe
EditorBrowsableAttribute
MP;6
;H3}h
`Df?
Q-+b
ir7 i
)Mv@
j'a@
| Px
>(t?
j hp,
_O.e@
IronX
`xBGQ
EK9\
DjO?\
qFd2;
roH/
`y Y
b|~F
[["#
6btA
V;$
z(Wd
jPN'X
v2*A5
c,3fw oQ
t3 (
H\;hR
'VIF
e<\~
F\9[
<0Wr
sm /
q.*y$I9Tn
erRx
"'`@
} /-
9T`5Q
:9T;3t
ZAD,ME&/
xXbg
;f_<
~Jmd
]f r<
"/'qNTv
jmk-
M Zpm
&T;
joJ$
/j@4kBu
l" M
K'^l
?Nni
0K1o
\C}`
7 asZB9
Vu\`
J&vsn
kvw[
X/1k
%k6>
K X=T
Z(I#
2kN Io
6_AyM
3_)/
}foK
QgtC
`^V`
M9;HT
O ^]
;muB
:kVGF
j6}b
_L'D
'N!q
E+R-
LvzP:
d@TZ;6C
5?}
V(6a
:Qtm
TT^e
\i(;DP
+$J2
\Q:5R
*s|#6
5n&g
ALRD
bg4.
s<If2_F|
mZ
dd';
!d|M#
&i]v
NX 9(
= e>N
4|y)%D
Mi[>^
q7AlTw
<PrivateImplementationDetails>
hJL
pz#G
gK A
`?ltm
~ZH8
J!,
|8}+
t\}/
tmNmv
"c7)
"7).U
J-+U.
+!yl
,`9_
:VeWi
0ssO
H2sv91
x1iI
o oZ
7_XmE
Jf@{U
T:"{
D w\
%..+)p
ZMR
:x^*
"Jw#!]
:(:K
x9t1Q
]:6m
FW*d_
{j7
#S9C
<1;+Xp-
/.K;
1dtVk
%+ `ua^
kp:{
TQD
w)/i>6gh
Enumerable
(;"i4
ttB^qo
AssemblyTitleAttribute
F*Ar
ed .z
1.K"
ris9(
`4S-Qr
m on
.Z!fb
u]8%
Xt7P
3n_\;_
xyrb
1l-$
6\/_
S]vl
G2oRv
;3B`
?+Y<
Xb(rr-
@"=!y
BY\z@
a;"xg
Vu m
6EFAC0EE8C248566D5441213E5936E72128EE1FF
Y]!/$
5f,])
te9
CioP
P|YL
A_^&
Hdp6
)V_8wTx&
O%;.
[ Y2
ke q
9 g:
&b3a
9}bRD
Y 8A
q1[}
R /n
System.Collections
Gff-
;qgd
njgF
!vSX
xy +!)
=aXP
|&63
z}EDLHH[
=}C
Te4f
rZN
]6Dj
:5@%o
mq4#
>Q)Z
Y <2p
l7[h
UyxQ
>~`,
w?}p
+Qg]c
11@SM=
&m$\
]Lv(
? zL
kqR5
=fh-
!6A o
A#'<N_5 i
get_CurrentDomain
Data
J[Wr
Y^!+
%qq-kI
Ro|T
.U6U=
Ku R
=<no
Z8L
T #SN
get_FullName
5~wtP
2uHh
KUM'
@L U 2^6Yk^'
[/pI
niTg
I }{
lg>V
MintSeparator
K.[B
jA_x
}3cR
c;e.H
Ui&5
07Hm
k^zP
c7M].
x}sE
i:.(n
"_?8.
,;'b
|WPd
co }[
eV:}
,F+m
<79!
*. E
.ctor
?c_9
r^OrR
p=,B8
FM:G
~XD
^E/F
JuH%
B:69
gBy,
8W
|r^pG
|e$T
#M0<?
~/}O5
8Tb8o
Gj Q
jah\
6ns
n>(<+
+M E
U_m2
>Y4A
*P-i
), 2
3 1R
DH[Kac
@DQ<
ld]n
o5su
^j]B
wRB 8A
Agqw
Zf'<
Invoke
Qa3p
}VP
!?rS)1
0Y +
TB 4
vJo-
da"v@
(r6@
y`eRo
) BB
79I
LH~^
label
t+k'
8"B
}A3
0 K%
nhY3
q-v_
!Dy`
h `8
Mm~e <
qYSh+
n\+Rx
..'b
@ Ph
c[l!
(^CQO
%5%H
$#sS
,',Q
G~R
.}
=1t
ren6
T&>%
k(]l
q"ce.gPA}
5; m{Fi
K0X5
Tjn`
5pObH
21z5
$/?E
c_6fm
-c{P
Z??JG
graphics
3eZ%
\Ix Pe
SEJ8m
PaintEventArgs
BMvq
=qJ}
`"<:
`1aA
PAl/q9=
j.%
k U_f
Array
K`[GS
QWX$
width
s?Fg
I5w1
b51w
I;+@c
su"Wb
W<=ZD
>0E^
0bgu{Q
YtT2
@.reloc
C6[[
L0c
Q# |
_;T"
iYW I
;x?
fLi\2
0T%{
'&AZEP
9c %
j+B&(
D.n3
n|y)M
c_$)h,
Lcj2
N-)Zx}N~
0=&OM
Q{0:
6=&S
E(xJ+
YTC4
n^Ny
*3QJ
B2K}md
D7yl
t\xIL
TabSizeMode
uw}>
t?t Y
Byte
DJw
0vn,
CBr4"
Load
XGTwS
CE6qq)
`4kkp,
)=gL6R
pcPQy,?
!|K
U`^z
\Gb:J
7 kb
/:nI}
jo9K
3!!z
-x+7>k
B\Ri
n2;e
Oju^
-se4B
W20t
&45p
&L2/j{gz
n9_0Q
2kzo\k
fCU&f
}8,<
+N_w
F|) 9
"= ;
#snM
Vy'-iR%9
_;T[
z1~%
+GTf$
i:q"
RGAF=
\=U=
b/v7
L&H[
S*\\
$I/
08g&
gVc'
5ag-
n,Sr
x{(~
\y{
x@+>
s=Bkb
!0>f`(
> 1~
(h+y
'y[t
H\]u
V[DLhJ
bAFRAk
h-@a
r +9
G z2*Bk
v=S8
DCTx
K,/D
Q 8L/
Fpb}`Lw
:Il]
]A Q<
l;Y:Y
820 J
)^IVI
8Ksl
/nj_#
@ Bj
T\Kb
N[;1v
0OdF
get_Location
"PQ+|Lr
hu7>
7e N
&~<'
rOl4)
B 3L[
2#:Z
=}wM
L1 @a
AVjC
Y 8x
o2_;c&
?ZLZ+
K&@| `*>
nNAc
/7 0
yDI
??%qT(]
GivD
1X<
4+h+
G?L[
&! U
*^m-
]MLM
RmBo
A-M#
Rpxa
*Co
.k+~T#
%<Cr
;e}e+T
n=K I]
(P}1
`aN%^
A\<B
2V D
RvrTx
TextBounds
u^Y Id8x
.ODC
pkIG
Y 8+
pd,j\
Ed;
ZXE}
[Pl
L(IZ9*O
52#
&e;J
cdPFR
<HN\
[/0F }
DKS7yP
1SK_
cB<-a
-S'7k
RightToLeft
-}'*
AYh>w9
WriteLine
r"6O:
)HvHWFg
{ 9Q
CE0v
bNlaJ
+QFt
wIDAThC
Zn=n"
Y"Bz
Q6pO
%MI]b
~0:
~9X)
\ aG
\5 's
_33
Assembly
0 O6i 5
!HpK
~p6V
Copyright
4pbY
L=41
9G@z
rnt#
rsj?
}}u r
Ii"@gk'
A) Wf!
IKE-k
j_93
r*Em
4pisF
k)G:
xH=l
#%'5d
OSHr
/,,k
I\:o
1J2+
nA4}
'6t
a9qq
A:$%
Io]AI
qm \`
fg@Efc
Graphics
c/m.
CQ`f
<Oy7U
Kx4f
Z]BT
O8PU.
3a*d
jPy;
"q1 R
3%f[
?a>
%e<E
<N\~
set_OverIndex
TC`
(^~
"'g@
9 @Q
'{Wo5
"YM|
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD0A&
-.c7
ExIoAR-%
*v;G
AMe+)
Size
6`C2}X
7vA-
e<E"h{q
&.Fq
Mt+$
H eG
KyxzE~
"K7y
Incarcator
CJ*]I
[bHwI7<
3M.vj
^L?1N
4w S7\
0V"E`
# aNUx
4Gt-
@@Rl
iS7l
WgQA
wSOb
f{\
dR| *
$l?5x
#4yi
iS5
7h-s
G?v6
;SN;
vH=.#
h 3
MA49
&%7el
`Yv,
Lk(
P7+|
z.0`!
I|o}
aAfxr
+ ;s
!-VJ
jI=r
Me )
pW
GwJwIw
)yftN
~<7/
%x]
j&'O
+]ba
Y'zv
5OjC
cC k
u P ^
EjsC
N6y m^$
D\y~$
:he@e
^EJ#lRXrN
yu#$
eRQE3
WvKg
=aNLj
oXWd
:2!A
/d:5<
R?m+c2
XyR$m
smCG
NBs:
{ZDk
'(w%5
)+sAEr
R$+"~
/1F }
J&% fau
zo+U
MAGs+
"NjnH3c
-N d1
x^*n *cr
NXV V
(`~,X
;IBC
uoGtl
./7g
ISerializable
B;kn
uNw7
8p
)`]f '
(21
>Wm>
A*\F
;\-X1
bU9
$9FEG
{59R
kd}7L
^l}Kx#+
HfnTs
J ]bF
[x{\A
I5MI
@\*l
4X]d
yRi u
'W{F
ZI5s
(iN
v_Z& V&=a
w/If
L}xg):C6
M=%$
zcZwNbw&
(B:f;}
lWKMR
|h{Ha+
m M<u
GSE*
X Z
nnYt
r'$ ;
.?f"x
w`VQ
DA@&E
#Blob
$pEK
B#fb
NA$U
twM`
SioVc
HB,RuG1
a\dL
33@H
mEQ-;
#vu;
SOVQ
e:s|ba
2'.EK]
\_[$
IrYo
""D
/8F l
8"
e ad$7
0e~i
"'/V
Q/l3L
6v'JM
jl9s
)e=?G
99}sn
LxiM 5
|M3
'{})Q[
{+tO
oD2Y
RuntimeCompatibilityAttribute
<_i^_
8]k1
65x~
GoK@
M~-Z
~l?EA
ig=(R
\\bhj
/%+N,G{
7+-{
k3L|
\C +
rG^;
c -[
WEdV
\oNsr[
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
/5O0
s?yg
{e"p]u
^`?$ o
;"0p
li[Cr*
Ua0p
-l@f
;UvUwFU
I i@
];5ESb$
TjA\
\Y3q x0
p ntJ
sbo j
7{ c
Ju\,l
+c)0
<>([5
S" 0.
,U )u
6|@K
PAa`MT
/;b;
r_*g
_{7)
,i!U
b#P5X
1pR+I
Z-@:/
P^)!
I n2
@!:c
Y%v1d
$OD,
p<p(
D$Li
nyQ)
NW SD
)ST0
lSbK
1 &f
h]D c
9,pT
Apa-
4^3
'BV^
|r%<6aA
oG#E
DU_?
J"b\,-
75.]v%
N\`Pc4
qjzz
r6I/
'wl$Z
+0F ]'
)>DQ
G-mE
|$
"%d[
|09p .
<c}Vi
V$!"
s*YX
_ze)
P)Y`Y
N{d$
6&Pc
?,qJE5
r!'y
JxDC
X3/y
vHB2'/?
4qF{
{n7Q
B$ !K
Uuy_#z
ec8
'$UQ
59g^
}%cH
ea; B0
8M+2
]. U9
s+b
mC,]
[i;wU
%M#^
?,:"
x%&G
Y 8;
_i=
A|'7
-X<h,
!KO%
V%MzU
r!id7*e@
cIh
,D`v
-m`M
y%\]m
Y 8#
c4^D
;7v>
O}Dyt
/4{q
fN^D
w;V"L
|e+(
2tnm
l]Mg%4
^lP?O h
@%si:<=
4ree
bQA|X
>t Gn
DeP*
> TZ
%EtC*a
?z e<
IyvM
X={a
h&\/
?:hJ
i+#r=
VQQ~
System.Windows.Forms
o_y-
ZElf
xD /
Y 8}
% `jMU
61p].w9
l6@a`
6o ARS3
\I6)
d ?.
>Me+)
Y 8k
ObT}
+q3OT
M!:)
!m0i
Y 8m
Z r+
dX#aH
qeGq
{t~L
n9z1
+;Y:AFl
l<
Iop_
1-5`C
tqv5
$!ijf
sriw
-ibCQ
Y 8]
Y 8S
1X)7
dX<I
VB xQ
ICollection
G6(4
Y 8O
jH~&
xK 8z
ROm(l8
kP)0
S.3]
Y 8D
]q Y.
oZ&n
qE<;
< ^:
Ro62
2Y5D
>rL2
sSN
iMEM5.`
&d/
+0 E
\t#]
*W~3)
iK7`-"
6r}w
!t';|
OaR?
=C.\
{tZ"
Exception
\=}3x
%`S\h
1!Hkt
GD Y
#57+
0 _z
7% C~ vN$5
Hzay
,Uqk
get_OverIndex
/y1n
Console
,OuJ
dOR#@
x?Yd
q~$cE
}8cs
s `R
Swit
cH&q
QTd0Tj
?Dr3
OiW(
dW M
S=_}
I\E5
T;hw
ilan
)yEl
v2.0.50727
a;p&
Kjtw
,m:I
D+#C,c\
>=JJ
&T9
&0FIK
m(*'
U:s f*e^
R)bia
Z]2<
<;[H`
=c H
Q^%<
ii4]
0>)L
Bq>7
4-QqE
6 M_>
XG 8
wM's
Nq#@k
bg=S
FtV@
}B47
r,Ox~
get_Font
HB>Y
/|.E
D38<
cPD4x8<
%;PcHK
q:$f
hMkJ
!,z|
>G
Q(C
( mX
, o
]pOg}
"soAGQ
|.m"
=X6>
\EZs
{9 !
nX)WK
S(:
+L:AT
{Z;
j[L
k_ =
B~N.
mQ 7
bdEW
(d
t4r_
teAZ
9fISiiK
Ed{I
.cctor
E3u!
47n{
Kj'J
m8Rin
|#`*f
n<#c
m YL
+q *
n8 )
/0F }
X"~@
"p7>w
X k]+I
e q
JdrO
&, hR
ADW-:
Ta0p
$O(u,
OS$Z
MeasureText
Invalidate
^`10J
8Ul!)d
;GH#5JJ
0]<<PH
31we
#'gA
qWp~
_X$Z
vX @
X\LB
wj,4U
d}B40&
<M*mT
5O)P]@.
"'a2
.{Ee
kG4R
('&zA
xeDk%
NG)&
RcaH!
Type
`6c
AEHY
J}<
M',x
4p]v
X@bDA
^ plzq
=P B
j4eZy
B]"H
Zrd6
>;t
AX7w
|sXv
>_Ry
6f&ju
6NEwXCe
1FyU
& ^!-
59xN
' G<
};7e
U\ t
y,=r;r
<x 0m
<cJt
0 O4+2
sI~k
<9]* 5u
hicV
"p^mjf
y?fO"
System.Reflection
&k[. ;f
ad_3
8Wt5
[TK82
'c/o
;CwJ
,t#2
.(` zpx
3K" /"J]
< FG
KdgI]_
/5F(}
0 h
uXO:N*$
:cH\U-s
]~sa
|v<^k
,@$I
{G[*
LkG8
#7e
:;ab
,8?Z8
*t8<
I[ i#n
IS2v
V;PW
~r( X
1 T>
eYQL
tb3|
EokC
@pEYkh
`'gJ
v@{J
n11\7u
{?J
f18K
47o[
bdl_
'vc
]&W)
NLRf@
52z@OD
Re+#
<S(/
vWxS
vcvTft
\MGihF
)z>*<
C1I|w
C=&Z
vr(bE_
get_TabPages
khI!3
lR)q
;D:$Q
A8mQN2
System.Core
{,K?
]Y5f
MXep
.m[p
a=nB
}]3`Q
? uv
O<!q
$FwTn
1\aPX
D8iR
x#7M
Z_ R
\n9s(
q-c0%
;Zg1
} e#v
J]tg
,nI4
KgB"
@Hpx]
H4qR
L]
c*$]
"${
`CfH
6K9`
1/DD
k.K;
^c~VX
Vp=4
Y!v$\
]& 3<
9mc;
TY~tZ
C HY
(z+p
2QDAg
de]`
e}0GN"
5LuU.
tKL&
P6X&
'?1
AssemblyCompanyAttribute
:5zG
2EwFB
H 4i Z
K:s
|0I(7
9w<t
9y(&
]i1LkH
{En0<
[$M_r
$AuaB
1OK\
qy P
.>G=
_,*>
w13:
*!F,
Mp\k
W$o R
lwc20
$U<#
CGAt?2R
Go1=
y{C;
Y'.\
& RT}n
Vg;vcY
"E\)
&^\7Eb>
tP'
L319
E
n/k`R
d2 r
,~)d`
cY^,C
\ZjXw
}yYb
Ua19
RGGR
AWG
[?J?He
QP3
zR .
j"+8
-1LfA
|GKui]w(cQ
r{f+
98-<T[
u Uqb2
9*q(hd`
/lR
(9~
Y7'$
!<){
m&)n
]g~[1Z
7QJi
EBJyc
c5jc
<aBCja
Char
B4F0
wfN67
r6Lo
6aQp
ay#$
##JQ
.YtJbRXo
+I E
;I j%i
E =
+S9X
g`D/l
~doo
pSz m?
P2-2
eL8M
J7?Ee
S=;D"x
e *6:,F
ZJ .
EI72<
X1"]
*FSAw
NH]0
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
y~"
T5o 9
!my4
Wa@w
1uM6
]>;O8
nc06
ZO
a -P
aGb}
p eR
Gyp@
} 8&
nEP)
SeBlc
qMb``2
*\<P&o
Y x
_F!"r
_EM>Vj
]\ ^
xv,7
R6_p
e&iTi
,Ur
!This program cannot be run in DOS mode. $
I=*gNb
L{vk
QR>.
9971urf
*Zg+7I0R
7 $<
s)V4D
h@iMZ
dYQG
U?aM
592B
ol;Q{
N7SY8
6SMH
1fM4
gJ6&W
Pt qe
%t :
+CtFn
"'mM
,t}W
e^sq
vP0`
xod}V
eEY)
h]Od`X
dt -
($qw
U~e)
,#eT
1MX
!-TZ
a9kN
C !oG
xB[
nMU,
LayoutSettings
y!.9
HwJI#
oV[mR
T0-X
',R<
UWp-
xR1,
V>\5
8>
r^4'
Sj_
q,}=q
1 Zr
* (h
?XjIlx
8B
U2#D
)2fd6
\9- E
zC|8
uHqV
-v3~O
yIDAThC
v1jKr=g
,#e
3U&W
';vG
N-^dR
"jNc
K)yr*
`A-3
{g4
8U a
g*0b
#WD[
(Ru
5M-4e3
zIDAThC
VXH9
i*`M
$Fm73<
m|mi}VJ
j<&]
Pa}X
5N/y
w f;}
J6!*2
VXH,
5y*L2
uIsN,K
K/Y#'#
vRZ YW
\?(Up
=$)5
tT['
hHkc
nLaoX
\f t
j'eE
|Oxn
IW /Qjr
3 'L
X4g*T$-
+<T <
bxl~
ZGd
fD$]r
M2oGA6
}>C>
f[qV`6
dZ= _
<O$Z
3o ,
/Fo
LL9I}
item
g{o#
(hiS
S:A{
]: 1
N.J:
QxL3
$aA[7+"
>l^"
iFu1
!Wo
lo5F
?/~*
<R_ot
=K*~
UaRf
Of},
3prB8
0:8b+
_CV][
=|uy
}]+>
$gtQI
+vKI
Lu2O
#@wj
Va0p
#e
PfQ qs
}2#D
S3,_
ae8*
u[ :
1R~
:wYW(sBA
\ry hk
0o)o
jB\%
( L%$
1%no
v,c
"FrH"
get_Y
3uL@-
+BWu*
Yz@ 5;a'
jYgV
h-}v
|$l6
a|F(I
Sv,-
Wo8#
<%o<
Yj1`
s^;>w
A<?-
[F0+
AO~<{
rM_=
,+Q$
K40\
=7C$t
Me+)
3G,]
System.Linq
F7 $7
JcD>v
&uO]t
58Y
_AppDomain
.WEe
ETI-f
ko|+
; q4
5^{6O
L7 L
'V=&
3`)V
`"B$
=tWH
a8]5a
?]M[
TextRenderer
_)$p
7o!
_D>D
_DH/
5'46
mKFcm
p{ru
}t<r
7(cb
3,r#
!=z'
<GW3
2Ba@H
S Sq
=;Zw
2[ Sw
>-X+H
4C1z
e^E-W
4s:k
P{e6
}wb]
wr^U
Lfz1
gJM,s
*nB5
&-o,l^
H*dDOp
"eTj
[!](
@6Z{r
X(\
{YUP
Q1r
jsrfv'
aMx1g
*~Sg
EditorBrowsableState
shle
InvalidOperationException
%|3E
3n-=
8oDu4
N +k
"'e@
2v==
Xc{Zp
nxCUQ
rD>
#fER
!&E>0
Y_?=
QZ2[7
J :HSa
yDXM
_}dp
^@?C
KW: 7
?iI'G
eelDM
)O A
hp}m3
1j]t
soZ/
C/&;mi
\0$T
j1Gs
-SBu
92ho
#'g@
LQC?
<TjO
T91)
t2#D
P(L&B3.^
/@Fl}
;lZmC
/i<Ir
]|}m?
^C`g
[Q4}}
~M94
_\%Tir
E Qt
NH>$
U&H$
Tg7x
Q F`
QXGy
a> b
'<Rm
qW-.K1
KyR<
S|m/i
0t6W7
#x_L
K2Ry
-o^K
$EzF
2QI#-
[ss?
AssemblyFileVersionAttribute
}g :Fq
5,`e
-i?C&
}fZB*H
a,m
&< A
#8$}}
]P3Zl
/}1z\~d
Iy):
2V@P
3JF]o>
|o/]'
:0KS
E~fwg
zP>*Ta:
:&,E
JHB+:?
?xB<
!YOc
L17
q 1.
!3?R
.}cg1
t"7O
k4c3P[*'
a67a
N1"m
;Vl>
m8`lF
,VE.
aB1F
5WREhX
;}qM
;jiE
\B5FT
2gR}
v<*o
-;{''
@0~s
M^U
X '}
Ht|l
KT{
3R,!
[$ws'
A 9#
a #v4
4C{-^
dhT>f
&yS<fRA
I/*/
.b%
DR]X&
X t
=1i
=7O$
0m \
y6LF
Ig;=
o@ A+
W0.O
K_?i.
fa\q
%^gh
f.Qc!
Ph^g
(X&r
q^(a){oE3
[_G$
,!\4
/ckW/u
}rwB
LDSI{pp
AF$w
=a\p
>v;v
bkn tp
K f/
UZIE
g~5%Jq
oA0p
ZMPy
SXs=
@TRw
wg?X-,-
0/57
`C>}
T*1W
8h,~
}J[u
bfKkZ
iWx2
%V:IPw
P7~A
}zJ[
sl9-
Sb$d
%*`pE
NY5
<#hN
/SZJ
SJb d
get_Graphics
*ak7
o >8R
qZ16B0
CqaQ
Q{WP
}2%dC
YH(>
D5 k
|m)
mSj-T
Bz3
sq,wz
% 9z
%y5?k
s.DE
Wg$SOu
?p\t{~
sLcx
)"P3
GAf%@b
LHB4(
1w$`
mg,|g
SeparatorPaintEventArgs
bNw;
OnControlAdded
qasD
{y& Ma
(o?4
STuA
#uXx8
get_Message
LOogrOc
. QEXCI6
fWN\
N>7
W}y*s
;j 4
`-vb
}Q}3\
a
CWX
p:fx]
t6?
+D E
LHB46
M#eq
P<h8
7),O
onL>
ad0r
%5p*-
OnPaint
=7B$
|.K;v
RC3^
&5"
System
[A P
NJ _=
bfr^
1C9.
5|c\oW
3SfM~r
8w4YY#
Bg>3ve
D!L
y-=x
D0OG
M`+
{vV8
\,IP
'-]C
Zy|v
LHR56
IEND
akaZ
s<-C
3hq&
d@w+
#]q95
= < < < < < < < < < < < < < < <
wj;U
EH%Y
be%N
eXT*a
Li)?
ResolveEventHandler
}*x8y'
vm c
_.tU
rjFC
8kxO
fnLU
[Fqb
i7#M
CY^ck0Y
^FK|
<nc5e
eD&/B
("6kh
#GUID
ON'
+]La
l(u>
Gf)Gg
>qQ9
$]zB
q f@`
(N0@
"IOh<
Z?Qv
7 Gd
wJu8
M.$FA'X
B@"Mh{P1
o[zG
Z Db
j,3I
^7S=
PZ,t
o. ^
>F)[
D/G"
matemdeea
$nxu
\]20h
[,Xm
}yN_R
N p"
MHi 6
Y]+.+
<*u()
c9jU_(
w*_<
FVl2
OYK!~
sV-B
Zi$.
j:=xx0P91M
OL%M
K/scsz
Rectangle
S@1U
@:L.|
LV(yC?G
C}T|
get_White
!f'P
-E 5
EFxG
(q4"
a+?=q
U" wC
|@wzT_Im
i$ |
'eg5
7N W
M7NH
,DF'c
^+8>
/_` }
Concat
UI-v
,BYKv
=U\?i
lK s
(rd,
,Cf }
{l{I
b: n
)E[#
< cQ
Dw?m
oz'H2A
Append
NcSN
4Z19
2 .I9G_R
' Sc
5Q\w0Tt
F[O3gA
`x+q
He+
`:'@AI
bb&#r
Pk/.
5@S~Z
;L1C
dcad`
yf~)
A5X
20=A
[Z.O1
Bb{j
/J%8
S-]&
Rygu
@SR5
ltO;_
li]8
~O J
tW1J
>e9Q
NA^J
r5i|
^dX
A;YX^
vOK^
5VEZ
jKw ]%
d=Vm
F=Km
MethodInfo
\=YnV
9<Ts
[;yS
WIwP
System.Runtime.InteropServices
)z =
;zIfK
,+ff&
~H+
@MHQ
:C(S
f5hh
.fe:
-DA=
T /)[@
1 Xa
LjzC%V
]1Vn
-<he
Dnjp^
:1-
get_Assembly
.3"4
v+kx
/Bg
e?s
cPf~
H")!
$v'?8QZd8
ToArray
dgcq
B2[ 4
>sA1
;2]o6
+ !b<
Rui[
%QsWa
]^ B<
RI v
a Ao
~(n!5
63zYD
`&%)
O=FtFF
W> z
flC
iC:~
.@H
ncsbe
t3];
xA M
22U:
1agA
Zj T
e[=C}
>)YD
r"5"
e"3g
Lue <
HE+;DZ`o
O$~N
AqJ|
o7n
Me*
`[y1
>9'o)f;
# _)
%CB>
l^ y
5y J
UnLpr
"ksM
}Tc1
AF%Rv
E^`d
U2zfo~
mr,'
XxZe
5. U
|vmx
mLw;]'7
UH >
Lmya
a/J
ykrJ-l
i _
CompilationRelaxationsAttribute
FEW~
C-tA
JX;S3
eg *^
d'o?k
j#<V
ePcg
oW5V&
S?Bm
j.,i%
_%9+
wfCG
|.Zf
zO \
BGRJx]
v[SzPW
*r"2
e4D\
)1*3
"=4
O8qZO0
:oAs
yYTDq
hE"K*
> Xs
H=$<eg
k'u`c
`tL.
fGGS
\s_G
m<7h
YZk6$)
DtCwe|k:
l[5?
W-<A
RzLt
-|N^e
&,w%)
@fY
)ubJ>
'rX
O:}Rd
fI\R
f2 7
CreateInstanceAndUnwrap
#yP2
( 9\W
:Mn
r,y]T
,i 9
Q)F y
?,p Y
vf{CU
n`"1
!Z]9
UifA^b\
].r.
K5yi
w]g
p/xm
bi:f
P/Ut
dmcM
)Kn5
MarshalByRefObject
ML!A
E0P.
0K D5
9d*
r 7I
U@7VA~
V+]4c
b6Bk
2&43
K ) !RQ
i'D
"V 'o
,mcr'b
;sKI
!F\#
f&g
DH`@
7^/)
Y0Io
oUw=
{4y#
l&JF
'-1B
",Vb<
9(A~[
rt|G
=juO
X5bk
_ =?
c =;R
Cz5}
XHv2
By 6
5z>`
v o`
SPq-F
yzNjI
E2 w
H M_
*g-T
ji+m
XML)
hH%>
8%U5
?/h,O
>];= h(
En "d
AA116D4CEEC324F997842E90883AC815F1858929
;2e5;
sz?(
o5#J
,@nW
yCBX
v2!D
y!]]dxcC3
>h}d`A[
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
`)4
b60=
get_X
*, >
DL0[>%
^ )p
.;G5ngd
get_RightToLeft
Q$jL
@<7tt
)&[b
,x&8
JC;8
o8x
H, z
+D0i
e(J
b$>y
jpG1pI
&'tF95l
[O3&
InitializeArray
mW>5
)61Z
Gh s
nXr(
mFIL
jg#X
jl\A5;
!Ao>>
UP>5
nRP[wF
2OE>N
W!{,
T p~2
Rt7s
,BaL
_wzy
TabAlignment
1Q]+
<J'z
2elb
\5Qz
>;Xj
~zXq
get_Text
jlA +
#)dOl
z 61
3REk
T^ Q
=!xb
`QWd
),C\
B0_x
nu6)
I77S
get_Control
ziiW|
oQd Aq8
\b
3g@b4
GAD5
{IDAThC
.5!Ho)
J"x?
= cS
>g#z
F4zy
5AC>
Xer3
'RTd<
O,Ff
jN!G ;
q+Y'
i/h
s?Yw
!pbf
MU W%V
w#%+Y
KmkQ
get_Hovering
al%>
T~Rr
VtsH
GetTypeFromHandle
V^ [
aF ,
\0s\
l t~5c
(}G a
66Q e
Y`3ZH\,
h>Q@
}ob-2
!1 t
4Z=w
PaU
ck-
QMe+)
vl {
,=*Q$
n3,l4
V2$@y_
\zM1
}D\Z[
Tg!v
\E$e
*$K
QDe"
t?<*
dDe;
xt`!
{M!\
:_S(
],Ty
>XI[R
-,2`
System.Drawing
[93:&
:>M
v8++Uk
9A $
4[=%(
y6MG
c<C
78.R
W7U3
x#br
0%7nvZ
ue#"
%F2_SI
yN[s
tTm
x2SU
lK4H
JpvE
o'js]]
Ih(m9~n
bs+6
VJB'
6Mt?
@Jb
{{8/:k:
+0[O
.[eR
r(6u
System.ComponentModel
a;Y/
)y)H_o
($j
3aKv
n+Vz6
UIc!
fH`0
9 ](
,K>_
hPI4
qb$Z
gEZ] `
.80^
_| $<
4C328BECF729897AC2F385EEC7A4AC09D7AF383F
}Wc!
g/z Si@
VAx&
fS1m?
{eP4
f-Rh
{Fgu
0e+#
*6SX
.@$T
P82z
^KR&
KlZp
Xv+s
5t<E
l6RN
#%_r
1`k|>q
\0j4
s%m/P
br"Q
{ eh
v3-8[
!)rc
PH7%
_uM
^UJ&
pVO
vw_K%q
%W/M
3M%Rr0
X?sR
Q,UO
95 Ai
+k$W
nh~xBQ}}E
lnB[
?qx\u$
amq2
ky%
D@eA/
O}go
9:xJ
m^Zv2L
Vc!3
3-Xz
Esp{
!H8@
o8Y~7
G#iR
=LAl
T U-
y(H=
MoY8
Qr|G
e#RaO+
J] A
*5 Q
*e0p
,3Byz83
zg8y
gNU}
Um =;XZ
9^_#X
I}x^
7H1i~
@;2|u
6%XmPp
XpTpi
V3<(
-Q`/<
Q} R
yfJ?7?
R/q
bo D
Kd=:
d)|w
Object
CZ "
ZS5
v[4'D
$4q'
0lQ#
5Xbo(
#n]/n
]X(U
VUI.FWS
8l&@ '
eU"nn, F
t}hz
Zvkq
?@ lV";=
0gP%
n&OZ
^S%CN
kU2,
5XB4/ #
H^/8m
eP`?;
B7_'
QV_\
^x[
Y[Vx
'xQ)
, X6
lsk|H
q-F"
c/#]}[H
8<c/jd
f9E0
*Q|M:
>a0]
Ev0K
A+UD?
(%GT
]( 4<
R"$GBi
MPr"
R!wN +
H\# /
"X="5Q
z:FC
Trj
R`t3RB
. @r'+
'qb`
RuntimeFieldHandle
_w>
'ho^
:I**
#;oW$
3{~:
+;6{
S;%.{v
?2_m
OkVb
\595
tvj:
/0F ]
OUEK
]jmaC
5= KU+
nlSe
ld[oP
jww
nQ5g3DZ}
;Z%H;
~J@Gs
VzOwW
R7.V
DL$~
:.H0
W5vn
&k)?W
a[>\
Uk'N
Rq$T
et#-R
M jcJ
aU>t
H8jLB
OnMouseLeave
K /
. AT
w4M}
1.0.0.0
3 B,
(\a{"
[G *
0R[Iu
Y}sd_
$'Cx
F )Q
FH&=
q3LFq
#JC"P
""1p
Y{bC)l
8zY 3]
>dmM
; K3
7k/<
wO1%
S yp
2)_-
,b"
\E?c
.kz\
O!{h}
8w ,
OJ'(
K1;g :V%
2t`
DEuC
get_Size
B5Y=4Y'i
G[jv
3h]NN
q#|ym
!)Rc
@)b+B
.>a<.
{HP2!
"=iC
]e}TJ
6l5cl
sRGB
2J,
$*wR
^#PIW
zWq1
xx
KN=Z$
InkX
wG/m&
bp9n
s P=jD
utmH
&O y
?4K~
E"5k w
]JHww
K& UtUh>
JWHD|
4ZLN
X 80
_C$m
q\DNN
?v#dcr
/\Zo
0O*9
z 2
+ T:
?N=dr
5ZN[
/Hv9sW
9 ?C [
1,M^ T
zYN\}
4+XP
.ivt-"
\.&;
p -o
%9X`
A_P,
.o6}
>zt/r
NGZ<
r/p;gFP
Uot9
~ZoX
ipDu
&:^w
Hg#)
8i[=
xcQ.
W!t7
SetBoundsCore
CYeq
GbN;
941
s5dd
>|Bv
mY 81
;J'0
Hf
1/K1
SLo*
OfSe
m%(
<!"K}Xc
Vt7o&T
q`mI+
/ ~L
=!$"
/&n/ 2
|[0p
Hnx3
k{IoJ%
!C!}
pur~`
DmgWq
,%bFkSZ
|^BQ
/;kh
T8,B
tz`U
q{p%Z
~}DK
:W#{
2lhs
?#n5
0a]&
m_gx
AJD+
.vp
,_Xa_
L7YR
;^Tx
X.$!T
wgP=
75NB
4-d
#rb z
XJAU
uVH8
bv)
?a'M9qu
ComVisibleAttribute
{=Mu
0GJ`rr
2U-d
scS~
*geA
wsI5
yb *Y
n+ y
s9|8V
5YHx
k&4^
VXp
wLTR
"wkV
!'g@
?~G
Tmz}
P=2`
=[E#
lO?hu
Q2T&
E!kO
|I=s
=^l9
WrapNonExceptionThrows
b)L
g0 &
ghge
AssemblyCopyrightAttribute
+'5e
:iI&
:Lb7
Dwe[
=6Q7
K(H<
Q^ X
'*` 1
pR~(
_JI%
U(E{\
_fz,
[D4`
\<G1-
p V]
kh/5
Y ^~
/ R}
SuppressIldasmAttribute
nk|
MS|q
:<F-
gj@|uGZ1
14$n
JaC
!Oo
R5GZ1p
jvW7
\[,
Ug%E
5M3
e)y'
8zrg`
+1n[
)^zi!
set_ItemSize
,gf 4Q
B#g
WO6{7#"
a5&psVWh
oa+!
<*\e
( nMk
"| ;
0k$
#Y +
'xr9w
ValueType
\;J<v
Kh<1
U5{j
w%*5]
Rbnv
@wMG
p+w\
;|v 4
# {Z-
..K;
Q(E/
4,p(
Wt#y3
}CoS
9tc
%*w|h
sV+dt
<BZ{(
f[]`
0LJy.J
U'e[
v/kd
jL:
0Vg@
\Om~X|Q
0E0FA1A62DEEBB1E981471F7A1F5C112CB0A9C65
{C=ii*
#%=/
SmR>
-L&2
e B
ne!2 }
skV/
I;{
.%*IB
VA92L
+vb`
}= ][
IN<Y#s]4M
Z_6f
.[,,
jpADq)I
aH?/
Y0. }
~=GiG
y*
8DCo
bf1/q
W)L]
/d-Pv
{-Yu
%Og
{0H-
I?{
m+j1~
-:$<A
CP#+
LEJ/
;{i'
TW'1'j8k
<x\g}
f-nC!9
s/OT
KL+Z
a@&6
up;F
|Ho7
qM]t
CZ]o
ZtBz
;5AbX
P=I'
Ks3y
's{L
0$n&l
07}.
=7C$
vER
.6jg
o3Ze._
-o=p
#nB40^
r&`j
3WO~
NM66,"R-
l $O
fb)$
3u~n
)hw]f
VY8t
`.rsrc
OverIndex
cdMv
PkL~
/sSq
*a9g
451`YaN
bM74
pK} N
W.*WS
;L2o (
KHHwJ
E<=\:^s)
$69%
w%T8Tx~X
r8ONOM
DE^Ze
84Du
E\6H
N}0y
}_TO
hpoE
{:U=
cg]!.
Vr {
+`!(
K+m1
<u =J
$F98m
/xLM
fQCK
}ft%
RI%E<
sryZ
$C_!.p
vn|
g\RD
K/zb
&&)+L
Lqro
1J4;
9D.1K
Z5l{YV
}-5}
[YC}
N./t^
m/g1L
s^9N
s {{
MF*fQ`
o<q3
F|
I<Uq
u16S
gfCs
2Ub_
]knQ
3R?C
}Zc!
OuF~B"n
Wb0
(T~{
x4(U
OgPH
Point
;vQ<~
ScZ+
Q$L;7
>3+)
9AH
/@O
7( 0
17#e11Q
E`Fi
R q`
\&eLx
u[P+
um'e
bQ+
_]i=V
-aAnf
&?`:
2Cmt
owR1
T7P$
(P,/
^0hD
h T
)hup
UF"J
"sGi
n2{j
StringBuilder
zq?x
JI{B 3
12QpR|
>s)2
ECl9
O "]
'pkGp?
, sW+
Yx|}A
A- a
ZC?D
ZQ-n
Tvm)
7Z`&
$a5D
b <u
-lo6
md,&$"
w|`G-
j#cc
Ox}~
ewRw
U-#D
q!Dtrm/>
{HCx
/i:w[--'
p#Vs? -
3W*M
GxJ`U:
/1nK}
3X?G
textFormatFlags
E 5:
7M,)
9Yio
1+#A
Tx.8
n9'Vo~
8. U
>mV>u
> Ie
4qBi
s"J
B*1#r0
HWkMp'
;#-3
rnX9q
)k7x
l/ J
c%A@
! yb x
ow(9
iaxW
|zm2
n&$64
F'"8
((~[
5s%b
TU<
!&pyq
m\l
~E7!a
m{me
lX'{.
W-6|:Tr
chr<
gCn._
7H: 9
q D8$
a7pXi
kG8Xb
+: E
;uJ[
cFFk
Y:>.
46*`
-&yY
PX.1
M|7.
hv;.
0:KA
h~A`
Do* 9
1V{?3
x= H&
';ni
v7bq
]f 5'
Qac
tALw_
(j>n
9NS_
[.^]
%wvO
T?h8I|
p=fT
/b!u
9in2
TC;a
!uS\1
M8Zcc
S!qR
+J E
='pq
FVo-
00 d+
bpq56c
&0*IC/
/I]q
}VW(GQ3p
7"4m
uR}K}
9@E4n
4SXT
pP8|
ZCOD
9_wW
]&31*.
EyVL
/ u1E
System.Runtime.Serialization
&bo;n
]pZR
matemdeea.Initializare
>BV-
_Adu
JSK})c
\xK
1#Mv
50#_
"~h
H uiz>V
n}u_
>*{%2P
|Bv]t
4?Oo
00du
GTK,
oHFl
tRC
E9v$
Yet!"
u8b9
~IDAThC
RsQ#~1D
DHG47
|W0p
(f j
f+ulF
b.QWb
Zln{!R0F
GMB_
|w E
v3Cx7H`
a2#]=
sP.Q
VW,q
zgy'
SY#`0
}t[_
9/O]
c^_;
eu~={A
E_"?
o fJZ:
itn/!
< 0
tA+(
[0U"
ShuL
75
MI[j
(tMa
4?SK
KSn"(=<
U1l
Ad*;8}K
"P?EU
>kv,
_@3I
UY*g
RY>1
Vc'e
get_SelectedIndex
5Lzb
OverRect
w?WE_h
!w>q
p s AB
- Snf
(_N
\WC
hv(~
?RYo
e^8:
\M&[
"3}3[
_KS
{8Y(L
VQq?4
>:4=`
{<t~
9H04S 3
{Kn(1
E`89
)'U
Yb&T4Vk
I'\Pl
e ;@u
~+9SA
K aV=
$o 2
$_Aw/
ER4I=
, }a,
<Nw!!
24x;=
@eF#
h*z=
%rEU
A0^0
#|H
CII9 z
[{lkR-
'?\$
j1|,p&
0OD3
XGlM
' a v
aZHC
TopTabControl
ButtonBase
H:3g>
( D'
")#n
{&1S*+
`i^r
2Q1W
;Z62>\<
\E`0
KuE1
ZP`dWg@i}
8@Q{
22N
s46!
Im|V
MmZ|\
-Rb
i?ft
;AUC\r 0
j,x& }x
>_?J,
XtI?@aY
AmD:
V49
d%%e
V;K&
J=FT
dZ~bL
laSR
]> e=
f4M|
Y.0 i
|)JM7
*^ O
%(67.
ItemWidth
p %Uh
t,.'g
#g]V
(Ap-
tA7]
>3MP
Uc#D
H]d{
uV1E
21zi
Vb{u
`u)&,D
\C%o
#f}0
?F0m9
J_HFiY
\7Ph
j%S
Q80.K^
}2)|
Fin2d7h
-F%z
*bG"'F
~%
N#ux
K$i'j
2^Ysm
S8!v
Zjb6nDb
}xc8
$0 K
UsXi
zyxo
4]lP68
EventArgs
DN.
<=G1
E0(, |
ygqht
A4'%
y,kV
OF<8CW
& ,l
GuidAttribute
{HO/?
CE# /
}?aH
&m
SOqL
;C9,?m
x{@b^
M35=5
X@I{ng
485g,.Vp
jY 8z
d?za
<q3:
eb%$(
o{n,
H=6M
c.JW
~r-I
xIs b
=PU1
]%&s:
.tqr
S;St<
\`+;
(G3(X
Me+]
*uZnF
7XtS
\\mD
J f{
+/G@
s`P<F
N\PJrS
=Ju*
cvw g
uh}
0{+W
zo"
8@m3
0PS#
r ;(p
<Module>
]sz}
(dU{
T8<i
LK[x
y@:5
Rek
,`!#[A
L qMD
;P
av& E$l
NVW$
KVLUE
LVC46
<ZBP
&bcYh
lq5]C6
-7[h
T!r{
K2G !Z
aim f
vf ~&
zl5FM
S-15
B)^
i'y7q
Ya;P
{3?i."
2.K0
"L"O
9!B1
,lF ~
rA$D
(rMY
!\'q
T@QBS
!i['
cH:e
9QaN
set_Font
3VZ
value
t8x*h
^s5|7
&"|S
Pcba
3,dQP
MM?0
|^$p
/0F }
) H3
6F VS
MTN?
& e
z54
~ K
e{+)
A75
>^Rx
Yu3X
1vn?E#
8n1au
)`v;
GsnU
x<}W
>SAIY
CTxG
B "
G1M2
FZN82
%Tn&.
7KY
M=L$-
eKSc
1IKU
}sG
#`Ro
3$|-
X W
F0CO
x)Ne
c?&O
PvB^
>/YX
:v1@
D: J
fD%#
_MS^
IWg
I_ym
dL#%
|MzO
C8hL
~nv`
-@~Z
341l
get_Height
: f]\
KvYp
YZb5
v8;T
]cjy
WgX{
>@Fm=
:UK"
ln\
rBT5Qn
uz9H
NOjD
set_SizeMode
]r z
.lBw
@}<_
@doT%
UE|-B
4(^
Ryq
xArE
ieGH
'LBJ
y}Sd ?
D}@#
p+ B7
F{cn
AC:76 V
'<;&|*
|37m
wK@
z1$eZD
<j"C
H^[>9_`
nPlJ
a[Eq
?,9Hr%
3E~F
Bw.*e
LalU
ToString
.LwPG
U-OR
W wm
TVJ,@
>dr
j5N-%
g2>pT
,VkAr
I i
4(Kl6
G\|@Q
m)zX
7<n%
b7P0|1
Cyf5
3=d z
9n#X
|c6Y
C2F&
SetStyle
**C7
s*'*Q
%N(b
M2}"
%t )
!&L@A
|5w^
] 2P
Jr5A1t
MPSL
YeM:
ME/`
\F4o
jx(D
r 9+[
r(I
dMjrx=
!+1&!
"[+&
fX4|^Y
HlhC
}Vc
rVG
xi;_C
'Qrr6
`$TVf]y
?tkR
H*:=
? VR
.T}}
#X9X=
'("l
1NzO
matemdeea.ControlFolder
baY]oD
xZ-Q;?mo
f8G,
qs1)e
z9@E
/KC }
`9'Y
XPY
R2H2
_=ni
g$DD
S,XP
Bem s
f+ Uu
lIj
'YxY uP
tx
8Bkm;O
>uYDp
F(8v
I6N.
!..
L [~u
P0`zA
p0[L
p;cKA
MKYy
{lgj
PWc4o
` Gq
{,//
@/&)9
MouseEventArgs
bacae3f8-82b2-6a.Resources.resources
VE%U
s =O
*v<a
V=G
HS4U(
nF D
)f1
l%}L
K*`S
ek1C
XHAP
}U5l
a>Lnm?0
6Y +
Fh 7I
!=A
YEI~
3( |
w Vel
nHY=c
]* 2*
si!l =
1Re_
PEjq
Nv;-
.:=1
INM z
w 6e5*.
\q>
8$[
| Gs
S0sns
K>$9w}
a'@7W
MEbs
IS`f
/H#~
gNoR
x`c~c
*c{e
.xU;
#N"gl_
k$X,m
X/o@
IsKV
e,/ =
Q)?
hGK4
@~=3d
mg3)
%2KE
\R4a
%[S^n;
" sM)
d t^x6
4^#7
uGr,1x>.
AS O'
sSW?
B/0G
1Z*t
`@,`-
ES6;@%
Gp|ur
/'=*
Ox&d
Fyg
Uf0&n
:<_CP
t!oG{
1(ag
5d0p
1J`r
Y =
K#MZ
b|wS
matemdeea
.oC~
Vb!8
M +;
NOM&
tqw73
3]04
Fk:y
d6.dA
yx*t
n3$.:T
+_5o`h+
R=])Zr
}:S gRqj
bwY.
_"wmr
$s3Dy
@IjO
_N K
o#6V
QyMf
ControlEventArgs
S+ BDj
83df
a:%l
JL]^
Nmt&
4[>)
6,Z6g
O*FT
Co=>
=^=;
h~e6 w
uq>$e
.fMl
_ &Y
6+W/Wz
:q~$
XvPC
btW>j
1:"^'5
xLvHW
2018
@VQY;a
ev#*5
\U-I
@"ML
tm6
*<3K
nn*]9
<6ZC
/x'8
System.Collections.Generic
g.TUG
B}~
6DF71263AFFB3296BA91B14181DAF02693B8F22E
+Sb1?%
d4L:
]ZEE
@b/A
vnV$|'
{[|"
:qFR
.T}J
pR(
h9 O
4C)d
-$).
XbA u
J 'O
|IDAThC
5}tww
e]!;+\*C
0'wje
Z@KR
AYW9
):UBI|
3_$[
]}{5
CckV|
], 5<
2quiz
22J`
get_TextFormatFlags
@O =
N\ m|
,#4J
}9{/
K@k}0
0oo
,E'~
XA6T
S$s0
%/f
*283AO@$
System.Drawing.Bitmap
' &Ov
*BU4]
4rPU
Dd$7
D s@
kf*{
4}%M
iqs
=4@Bf
p7|C
AssemblyConfigurationAttribute
zpC$
HNtBn
get_ClientRectangle
^ft+
LBjd6
t,O+
C~iS
<&aw
kTLd{
C)zr
F09%
y[6
_[2
C6R{L98b
,Mz&
s1=O
gAMA
[r b
'WZXK
KBmB$
$+TK
."`:q
5]1/
ci''|
UYaw
( 1\
:p,s
y\/M
2dA%
jW[>
lzCt
`:1e
Eo&DZ
30) ?~DK
aNk_
?J},
uwwOs
Dd%Sk
3ZL$
xp5W
~%mr
nV*hT
; 6+
f ,#_
<8~7I
cl?=l
^*X3
}U{"
x5T?
S~\k
#Oq`
+i'7x"
,`4q5k
NNPsD
8dU+
ot9S
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven02b_64 Seven02b_64 VirtualBox 2018-02-20 13:13:57 2018-02-20 13:16:45 168

8 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven02b_64 Seven02b_64 VirtualBox 2018-02-20 13:13:57 2018-02-20 13:16:45 168

10 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\idihc.exe.config
C:\Users\Seven01\AppData\Local\Temp\idihc.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\idihc.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Users\Seven01\AppData\Local\Temp\idihc.config
C:\Users\Seven01\AppData\Local\Temp\idihc.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.INI
C:\Windows\Globalization\it-it.nlp
C:\Users\Seven01\AppData\Local\Temp\idihc.exe:Zone.Identifier
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Users\Seven01\AppData\Local\Temp\it-IT\matemdeea.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\matemdeea.resources\matemdeea.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\matemdeea.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\matemdeea.resources\matemdeea.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it.nlp
C:\Users\Seven01\AppData\Local\Temp\it\matemdeea.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\matemdeea.resources\matemdeea.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\matemdeea.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\matemdeea.resources\matemdeea.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Local\Temp\shell32.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe
\??\MountPointManager
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2356.4846718
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2356.4846718
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2356.4846765
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe.Local\
C:\Users\Seven01\AppData\Roaming
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows
C:\Users\Seven01\AppData\Roaming\Microsoft
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.INI
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\matemdeea.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\matemdeea.resources\matemdeea.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\matemdeea.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\matemdeea.resources\matemdeea.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\matemdeea.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\matemdeea.resources\matemdeea.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\matemdeea.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\matemdeea.resources\matemdeea.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\shell32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2640.4850765
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2640.4850765
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2640.4850765

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\idihc.exe.config
C:\Users\Seven01\AppData\Local\Temp\idihc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll

Write Files

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe

Delete Files

C:\Users\Seven01\AppData\Local\Temp\idihc.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2356.4846718
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2356.4846718
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2356.4846765
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe:Zone.Identifier
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2640.4850765
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2640.4850765
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2640.4850765

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\idihc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\410fe546\7307cd04
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.5.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1e5833dd\40ef5613
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|idihc.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|idihc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|idihc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1e5833dd\10592a67
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Namespaces
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\index
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\index.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|index.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|index.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|index.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\index
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Write Keys

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\index

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
kernel32.dll.QueryActCtxW
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
kernel32.dll.GetFullPathNameW
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.GetUserDefaultUILanguage
kernel32.dll.DeleteFileW
kernel32.dll.CloseHandle
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
kernel32.dll.GetCurrentProcess
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
kernel32.dll.WerRegisterMemoryBlock
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipGetImageEncodersSize
kernel32.dll.LocalAlloc
gdiplus.dll.GdipGetImageEncoders
kernel32.dll.RtlMoveMemory
kernel32.dll.LocalFree
gdiplus.dll.GdipSaveImageToStream
oleaut32.dll.#8
oleaut32.dll.#9
oleaut32.dll.#10
gdiplus.dll.GdipCreateBitmapFromStream
gdiplus.dll.GdipBitmapLockBits
gdiplus.dll.GdipBitmapUnlockBits
shfolder.dll.SHGetFolderPathW
kernel32.dll.CopyFileW
kernel32.dll.SwitchToThread
shell32.dll.ShellExecuteEx
shell32.dll.ShellExecuteExW
setupapi.dll.CM_Get_Device_Interface_List_Size_ExW
setupapi.dll.CM_Get_Device_Interface_List_ExW
comctl32.dll.#386
ole32.dll.CoUninitialize
ole32.dll.CoRevokeInitializeSpy
comctl32.dll.#388
oleaut32.dll.#500
advapi32.dll.RegSetValueExW
kernel32.dll.DeleteAtom
comctl32.dll.#321
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
advapi32.dll.EventUnregister
gdiplus.dll.GdipDisposeImage
kernel32.dll.GetProcAddress
kernel32.dll.CreateProcessW
ntdll.dll.NtAlertResumeThread
ntdll.dll.NtGetContextThread
ntdll.dll.NtReadVirtualMemory
ntdll.dll.NtSetContextThread
ntdll.dll.NtWriteVirtualMemory
kernel32.dll.VirtualAllocEx
kernel32.dll.VirtualFreeEx
kernel32.dll.VirtualProtectEx
kernel32.dll.Wow64GetThreadContext
kernel32.dll.Wow64SetThreadContext
ntdll.dll.ZwUnmapViewOfSection

Execute Commands

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe 
"C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe"

Started Services

Nothing to display

Created Services

Nothing to display

#infosec #automation

TheSystem Itself @ 2018-02-20 13:15:20

Detected family: #Malicious

TheSystem Itself @ 2018-02-20 13:32:01