MalScore
100/100
MalFamily
Razy

svchost.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 47/67 Related 2690
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 516.00 KB (528384 bytes)
Compile time: 2017-12-01 19:40:08
MD5: b2f191927b78564337c098900caf7400
SHA1: 91dbfa7ee170be6c3b43f855cb34f8a86477fdd2
SHA256: 57cfc80398c4c8baadf52682957667fe6f424c691f0594baff7964f0929a65d7
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-04-13 16:24:11
Last submission: 2018-04-13 16:24:11
Filename detected: - svchost.exe (1)
URL file hosting
hXXp://oa.kingsbase.com/sites/default/files/languages/svchost.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-04-11 22:40:07 [47/67] VirusTotal
PE Sections 3 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0x7dde4 516096 17d99b649ab48c6f609d09dd9b1abf6f c78ce07c1ec54aecb98d4aa2f328c72c933076b2
.rsrc 0x80000 0x340 4096 6fa67bc7e35e41fdbe0cf1fbfca67df5 76ddf22458bb78bdfe220fc002f4773a3067d1e8
.reloc 0x82000 0xc 4096 a1f80bdb62270ce113b0c4f1436de0ec 42fab5e27a6b637939eeb63ebf8e18250b60c269
PE Resources
Name Offset Size Language Sublanguage Data
RT_VERSION 0x80058 740 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright:
Assembly Version: 0.0.0.0
InternalName: svchost.exe
FileVersion: 4.1.1.0
CompanyName: Sandboxie Holdings, LLC
OriginalFilename: svchost.exe
Translation: 0x0000 0x04b0
FileDescription: Sandboxie
Comments: Sandboxie Installer
ProductVersion: 4.1.1.0
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Library
mscoree.dll
IP Found
No IP detected
URL(s)
No URL found
?.9
J~i[
0{<v
iu
2r
`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&
KeyBase
hiu0z<
iu1
iu0
iu3
>q#buzcH^IqbSzdt#v>
iu6
InternalName
?hiA
=3k^IqHIU
u=^ut&
Qhj
OPU^W
Qhi
Qho
Qhl
r]aD
1^D2Y
hT$
Comments
U}~u
iu&
LegalCopyright
s0^
iOWuBQwhmy
WK~iQhiU
Y6&9/
WI~iQhit:{<|&`s}aEDK~kQhiu0z
<$>a0
hz0|
7#v
@XYIVC
<t0
Pgiv
S8~K
G[v
{1H
bQ`
Szio
$?P
'os|
Qliu0
`t&
t+E6|a
zhWmns'|<
meE
lpgY
&8%
E*svZ
AyrarbiLdaoL
N9G
owk^IqHIU
2,/
44 8f.`
<tF
\k9$
hTJ
yiQhiu0;
UG~X
PG~iQhiu0{<t&`s}aOWK~iQhiu0
3P<U
u0(]
bTW{
t&`s}aOVK~!Q
H~mQ
yiQhiu0{
qlaJ
<t
<t&
<t%
QUV
}\p
$:3$
`=k6&!
km0S
$ssV
N2O
)8K~MUh=
<{&O
0K4u`
OVJziPimu1D<t&ds|aOWK~iQ,itf
spG
?2/C
FileVersion
}aI
}aL
}aO
0{<4&`s}aOWK~iQhiu0{<
WCE
ProductVersion
}aY
0.0.0.0
OriginalFilename
OWH
S_T
aOWI
8j#sAkN
W1^
iQR^|1y
SJiN
D&X{| <$.
<b&O
sMO
!&;o2r2i`s
&`u
&`p
&`s
&`y
aOW
aOT
aOQ
QfiZ
Q\at`
`<.
C3S
&mVOaO
2?)
4c<T
u0z<t'as}HxRJ
E?88Z
6/
B.:.CJ
t}a
(9"
B!>
=~&x
2291d2ec3b3048d1a6f86c2c4591b7e0
QeL61{
~dT`
i]2zp
WF[.Qh
P|`.~i
6o
}aOW
Ol'#]
1t<v
LUQx_S
Vhiu0{<4
t&bs}aOWJ
'V0I
G}7
g&WV
&/-owk^IqHIU
4FG3Y
!.
"WK}
!6'8
ylbmessAgnitucexEteG
VS_VERSION_INFO
m{<
DUY
a3'
2as
um{1q)
=t&Cr}ak
<$<
<Ij
869
~hQ
+mk
UUO
OWM
LU%
?o&M
{<e
&]L
{<b
`NA
W&`
t&f
t&c
;$.
{<w
{<r
t&v
t&q
iH|
f'{<
viBFIT
Software\Microsoft\Windows\CurrentVersion\Run
WKh
=6&DI
WKx
WK}
#8*
]HC
Knp
&";%'#
&]"
.;
k$oXM<
6u0
`N1
QC_HP
0:r-;!
@DPs=uN
jaO
Y(v
aOWK~c
y:Q
jo0n
J~K
WI{
y2.I[7[Y
?>'=
Translation
his
hit
hiv
OWK~iQhht0K
hic
RDil
Y:G
PK~iQ
E?s.ZTu
)69
hin
k`0\
Sandboxie
0(]
<Qh
iu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s
X_LP
/Es}a
;;.C
arh
~iQEi
d4c2e4a3297fe25a71d030b67eb83bfcQ
(!1$~
swZF
0{<G&
}lj
4<29
;&;'
4.1.1.0
%k8<
](T
Important.exe
p0y<X&LsQaWW
u'`sqa
{<t&`s}a
"{0}"
Liu0
M9L
~i`
~eQG
~iR
~iQ
~iW
iv0o
.$8
E"2oCM
TF%Q
|OQ\
%Jsk
~iG
~iE
VG~W
!=9
hdQ
5>'
KsLihi
l,0A
"6,
aBQZ~i
p{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t'pse
)#<
Sandboxie Holdings, LLC
UK}iQh
@I]
JQh
0{<t&`s}aOW
kernel32
<t&ps}aOW
a~WL~kQ*it0y<p&gsqaMW@~`Qiis0z<h&dsiaO
i\O4u
"s.CM
q<UIzjY
2)^+#
aOA
OWK
OW]
;y.
OWZ
&ew{eZP]y~_pgl"a.o4|a`sQETlICI{W"X.P4E`[uhCcj@EB}^$W$Y>Nk}qC
000004b0
7.q>(V|.yWuHT<B,4$
FileDescription
cQs
&`e
bZ69_
Aowk^IqHIU
PsEmN
'ks{
uFM
/S>.
?6%
"KO
BOW
.dll
y{PYQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOWK~iQhiu0{<t&`s}aOW
!us?
Qi:
yeQ
VD~m
C4g6\
EssdZ9u
~ m
@S]Aowk^IqHIO
reaF
Sandboxie Installer
ST~[
0{<
&ps
<|&`s}a
iQjiu0{<~
dcW~|b
QiYE
VarFileInfo
ntdll
KC8
NWI
svchost.exe
`s{
`s~
`s|
s}g
0{<t&`s}a
s}b
s}a
qmaE
`sk
s}w
7*%8
s}s
s}p
OWK~iQhiu0{<t&`s}a
aoWw~UQjiU0
@S]Auw
0{<t&
KCV
0:6'
aMu
iQ~
iQn
iQk
WvA
u0m
=6&
?mdQ
YGk:*
u0}
u0{
u0x
'jsB
22;
~iQhi
OZx
Assembly Version
iU0;0ui
CompanyName
u}aOWK~iQhiu0{<t&`s}a
B'_
I#U
]$!3q#I
l6]
TWO
kho
=$"
1a6cc6413db9446f95f90a7f55bcfb8b
Q\GD
::.-
0{*
K~o
&`s}a
8t$
K~j
StringFileInfo
0{:
0{?
k:L
<s?PM!L
sqa
s&}a
i[0+<
s}aOW
E.5*
&4*
u t3i\e{sYn
wTs#
i ]?0
4{]
(<jy
p="?
`lF~
l|2W
S5<l
Int32
-.z_SU
>D}v
r@;
cLh!
}W L
=lfm
:ddz
a#t!n xuFYl
Gt@x
QR b
u(>|
[kR+
tcbG
*l8p o
4GiF'
DyWo
:@{!
rI:1
e?'E
:-rs
YU"AWE
ZKGCNS
Misc
Ke"* L^1
D){"
1;$<oX
',f|*
p(pW
f!^
q|J2
Z]<Uu
<eHT pC
f0 :
3 /{
&*a s
Q2,_
b `(<
tb2hO j
O"u%
eUH_l
3>TH
Su-o
{4aKt
`]bM
lYd{RYg;pCn+e E
%ms'
Qp@<i
2p74
Eohcq
1Y, L
5N!d
Hl n
Aa*uSMjbE
DqzF
-N38k!
C .gi|
gzo*
c56|+G
WKuj
k8$rm
k\827gS
z1O s
YJe2
3Glr
Cz92
=\%q
UU] 7
OTMW
6;C?
0@|H
Text
U/x6
V&ER
FHvD.
GmxSzuZ
21v
b9sXU m
btH2
Q| )
SoL<HUi
@~!
6ffqu
YK^B7_,t
Wt|j
Format
U|n^
dsuI
= L
l(P *_Q
w) J
91$EhK
LIkK
Wb3Y
~ m
CompareString
]@rv
FS%`(
x^b*
c]$lIlY
vL |
.@<_
"y4j
R[rZ
IQvDK=
h;\Yp
ix1y|
<LM
Kkh7
}Ol
: S;<
A_j{P
RFXC
/4X=
FQ O`
l JC
ixDK
KM`6
9- {#l
o}B
3d};o
be e
3}0x)
g T5
4Aj w
?-S`
t muORj
o5[D
Copy
t,?b
c<O8
&VMH
Combine
<eIg$
1(S#
nB7CJD2:*
UJ0t~
?i#
4d^5
Ig_^
Ztp@
PV}K
=Tm`
F]`S
J#+b
{N&\
f j(u
q\G 5&x
I Y8
m4#&
t6MW
ORheicuo0v{e<rtB&r`osw}saeOrWsKQ~
6uL$w
EWP^
41MN
]K@o
o X-`r
Gp*.{
u1`
^u;L
*-W"
Char
/xDtB
b>3C
ffLl
:Ki6m:
p=OT
4X\,]
{2Z&V
l*%i6P
\\y|e: %
"JNF
HashAlgorithm
( ZhT
HR%R
||2`r
P\r;
C6]J3)
r rWK.y:e
System.Resources
8!B4
w6)+j
Dsky
< L7
#a0x
``~yE
IqQB
b~$Q
SAe0
Znb`
Iv0#r?
{l.u
w}kWb
w|(3
mzK;pSl
z, 3@%
'T ;PC
o Gf
^ f!
OJe1
{ NUr
duE^c yLt
dxN3RKj
.text
f-qb
%#CT
9^H(
OAKE
*J1Bg
GetObject
<=D-
6 5=2
pt
<Y- |
^?Vn
w]4UA
SKG?
FS=2
\5%[
/x%>
0UQ3
YT#i
;15l
4TEY :*
ih6C
y>p
AWax|
P|Or
nr*z
5AQxs
s k35
v3D
iVF
=2Z6X
;K@E
XV-`UD
V4Y/N
r 9 H)s
CipherMode
hG` q
m t)
(\-4
BOsI
%g}mx
ES#}
D:o'
7.AA|P
QIfMv
(m6T
(N^'
q5Cis
rXx
0 m34(7
j?eZJv
hC4#
Dwwf
v\0n
&Zn>
%USFy@B
CreateDecryptor
;tdA
ei765T]
JjRv
sw5KC
q,&~m
.ctor
oa0t
U]bz
ProcessHandle
ZPL3
6aUnt
lMq;
CHC2F.ye
t ZY=I'
"4V.
lX6p
b|;
yq[a
D<A(
WW*0
{pNg~
i;27
sIf!
76V>
A ]AY
%a g?t
!R0T
gfmB
gEw:T
@7n&
- +"
6U|@
&V21W
/u}'
w"z*u
wtUN-m
*o n%3Z
!Zh>G
:U^"
c]m$
I\"e9
hVm/.f
f,W
1z%hW
dCQV
CFD6Eg
/[<wqBK
@ll`@
6WjJn
pOf\
L;T5
qsV".
Q8$g
4E| S
#f6z
ReadAllBytes
U aD
DGvz
505+
b%u9
-/f
Yr/p'j
g^Rd
|u~i
&^i"
]:x.8,
y`kj
(0X7
0X~I
/7sQ
X2W~
I"Ju
fucSh9uZftw`l
r r8w8a
&(6s
nd9oE
Si7,
`M5z
Reserved1
<FXD
jc(T
jTXY
wnZ6.
;1
9H1:$
IUO
-ss
P,x5l0
Y9aq
{0l
3t'1
jb9g
z1m)K
D4~`
21p"
a|z_
k#BG
P*J ~
>'q
&H7O
rd?}
A R:
n}1R.#
ky#o
uOs>k
?37Y|
#cg;
Zz]p
XIgt
l c%i
J[k
o*f03
4qM4
NBJ`
7\"u
uPttlVV
L2{/
]}1(
'6EU{]n
/rNZ
`SR-
~Yf eC.1
System
Application
Q['
jD='
\yN9
~U-
)NC
,oa
7v:3
t;x"
!TcoJg
yr_.u
5dt"J
iu H
U+K{
MethodBase
<R$"
0 2='W
xuSo
hpx
OJ?+
9ApW@
Fh3@
xz/Vr]
"lgS
"Yx5
e2_c
n!ZU
bROp
| {
KF^y9
[F;"
\>#
u,&'
;D5j[
Cm@j
=YK)
pg}}
;+p,5
gcKv~
mD>gA
M#o+
<u!%
%,H$8
Dy@eUKz
s8HN
/8z%
R s4
bytesRead
V%n1
f\Jc
mjz[
IEnumerator
f[-m
9A1PqD+
:} k
LX*]
H%>"C
&sx#l
3q/xn
NU"r
hBv~
g|!R
/l?vNA
kzJt
Oh#EKAF
.sXM
$rB5
:I <BJ
tPBi
@-t<J
Q?uT
r5&B
$P+u
H"A8NG
7Gw,,
^V?
luC_p
:Xb~
{ * m
+j ^
,.!'
O?Qu
o1!~
'6}TV
cXE&&
gn)&=
8%/A
^JC~
62h*
1T m
2t=i9gKR
G@Em-
!wI
:*}*<
J$:v
i n$
Pee/
hkkF.Z
}w]y
mYT pCH
.8 h
C|m h
?47~
hK2Igi{
vx$9
8 4
AG+w
24MJ
2 GBa&
nI_W
S ?;
R1b8
g. _un
a0*a
G9Bw
P[ $iq
GiXpv
dA[iA
cU6B9N4
|# $
sBBB
kV '
n2r d
lV :
address
s U{a
&c.
)a i
PTi[]
a<eWk.y~R:M
i>n;e
`?0-
o e>U?
uGS`]Z
(xtlgw
nV3p
AKg}
N-~nl
7_v)0
\Y(`N$
L]CY
~Z}>
E__2
2NU`
ru4
lbJl
Ynv
)W,#R
@ !K
F6Ea
|$i8
(:xh
t&V+C
2WN@
PV\j
,;6B
[/{
VZ^j
nAUqZ%d p^
g^tgpz
IwP!j
<iBe-o
z$"s
iB MI
% +3d
6G Io
h``<Lha
IcbQ
z@Hd
hR[F
P*fI8
?#u
, Gq
4ld r
O F $=~
=?G[
ToLower
n 92oU"
"13-
sYPW<
tQl s
5*)z
Y?TC
F9Ck!
AH`
.vo mO
LrI
euACs
="d8
&LZ
@~u?@
$-H 2
hs96
aEt o
O\/e
Qzf"r
}.,#GB
&-9$
9viq
f$e
,?mZ9
<QF'
E 9P
I}H'$T
$5[*
$oij8
yG$i5
e3%`r
3 K
-'tE\
mNp=
7YG'
538K
ToInt32
iaJJ
D+qK
q(f,o>
|##q
3w LY
ic%O
u"OL
MarshalAsAttribute
F%$-
AssemblyCompanyAttribute
pC"'
=t1^lsp
z@%n+
dr" }p
ClearProjectError
sPo@
-+|0
nZ"k)a
unZj
-SFA
~=ZFQHja
3_Po
P*2
>] X_
P2P/[
0X%p
(M@^
/Q1"
*gq
uxCB$Z
'|<l
Qy%U
douIB;
&sCm
jmPa&
I4%E`-
Z[PLi^2&K
@b&0
Create__Instance__
2U=-EB
R9iO
O?zr
x4hc
J4xom
,-{.o
X/2y%
nugUt$PNo
zg)[J
uZzx]
7\CR
xFV?
~f~@
BitConverter
?85
aIh
RnQ+z
GetFolderPath
#eC}
xz(w:c
R 8:
A,t>v.W
c;zA
vP'4
J nS
`l'g
:*`05
#7LU
n%`w
0k`09
acqa
n. 9rJ
a"l=l
''{X
e6d l
O;fn
0e?_+s rQm7U
xL;ru
GkbT
rOG~
~[ARx
w}pw
Invoke
&&Mb
u7In
buffer
#\zr^
{EC/^
80(X=
UaIn
)1vf
4go,
o[p
Bb6[0Yx
2~*W
}f%,
6( sw/
Array
XF2
#9j
OpenSubKey
= Th
;)X{
fb ?F
&X\"}nP
,CWa
tX'`
So{
a !U
]Bq
w=GB
e>_\D>s;o e6_
Mh'`N
9[cG-
Zn
1IIX
K5b~2g
MKyz-_N
E^ P
obc
F#1&
l8s.M
pVtd
H;8vT
Hfa4
ak-t#
] <}
b,X&
LND[
$Ue]
S&i<Q
OR#Jwb6
Vq:(
!@8?
{F42
n suCXr{ERd
5l =
!%sx5
7]? @M
^Iqv
3-K>X
Ky J
ZDmh
W(c
xC;;r
cwW*
Bp(yEN
8z[-^
e&d_
'L7,
UQ )
7E)q
JT\2
wZw(
y04S
u2|m(
[ ;Bh
rEEnIh
Z+;-P-
rwbGG 9
XUOho
u2)qy
RuntimeCompatibilityAttribute
dk)$
5j '^
DSBP{
5w A
,VF0
e<sWK.y~S n5N
Fd,N{j
_XgV
)cg$
Me[-
y u(|
{ 6+t
2a+P0gf
QK
ix!5?
TxU_
tpo=T
z@*U2
}SGn
"^
&6CYi
D 3e
g{MQVZ
>=L1
C4[y
yO(:\
1aDe/iQetOVe
Size
l&N/
ns(..
tUmUDNa
FXGi
z_~d
d>xG
m/r5
siF8n l
0vUu4
PfIV
TargetMethod
A$=V
i G3
Yh( :
IJaLU),
N;<
iqp+
pDF6d
3iJd
sOC8m;u e
[r[%
S-:h
|vnN\=
cuLYs
y2 EJ
;Nra
V/y3
- e
! 1t
4V b
@x<$H
ycO10
k? f
TjSN
)^&$
Rx 6
jKz-
q>H"
d:d:
8=bB;Y
j$K&+
<E^u
ResourceManager
z9U]
qb6A
}Um%d
svchost.exe
_bue
xIyw
8Gun
('4{
eaN.t>v.M
a?U
K9 Z
B?EP~
ToInt16
YCLb|
`IZ su
nG}
y br
>;E*
c=`4f
78SB
Bgt=fb
h;~ X
o(Vx
Mr|S.>
d r$`5
duL_a
in#N
tL6aG*t
;7=X
@ {y
x~xP
&*;(bz
p a
K !wh9c
eOo'_
<r .ef
EaE^Ro
H5,I
?]i6AA
,mfUT
solhF\
?Y/
MyComputer
:m,j}8}
6GPN
[26
h^i M
^_vz
F?w&"
a/z'{
^%@:i
';]q
::ii
\N3S:
_]l_O
X<0b
F H6"
KsR
0B%U
~ BB
"Y|_9
\=-f
}kE\s
yb1x
UbZY '
oLr+%
} W
e<.<e
yugUt$DYf
iOWuBQwhmy.resources
, Ko
XG5/Z=
;PxN
,Y2H
7!6M
xa^Gi<
kEB2J X
a m9fmT)@sAWW
Password
H%l
&&~Gq
id2!R?|
XQA63
X `|"
{RO&
:A,IZ!.
we lIg
r67XcJ
jMXn
wM'u
Hd,R<
0 m30
zm )g
KYytsSb+e
#z-"
nj>:
o9i3e9
2,g4
H%1Y
mscorlib
>6W$
$.Y#
Neo9
[jnq}
"#7"-
sserddAcorPteG
F 5iBX
4-h k
m3zc
GetObjectValue
}k|e
G@q
m_UserObjectProvider
Zwu
T0R]
Z)D-C
kLSJ:
u/BhO(b<
pd/X
ipAetaerC
m1.e%e
J|7%
HEn;
4),3e
ReadOnlyCollectionBase
~cH(
yO, M
Fl`9
RuntimeTypeHandle
method
z(df
c s"I
P[('
B% 2
>gYq
I$ /W
2b_
SfzU4V
YH|5
A,2V
?PfR
0^p3L@
&4OY-k
'1h]Be{
9 bu
&I%~
S/n
HIC
cUsUPNo
40_3
t2mKg
5dBr
o!Pjc
;, U #
fgEB
(w7Dv
E53\
^D_2
?; h
L@,y
fM1qR4
enRN w
)cZwmH
e]'/G
X0])g@
&P>\
XEFS
m=zoL0
S*`j
\%oV
;2()u
!t = !&
0q }
~;Gkbih?
b/z^
W[(m
je-
kV -[(
41jD
get_ExecutablePath
D#_x
{ot_
RDAY
'y(|
_Thread1
#h#G
^l 0[
"bE6
c VS
(e#_
(KCd
e$L3
_Thread2
-5&m
S z.0
p n:u
6E@[K[
"gul
8eu9
%m3U
2Pt%
ZxF%{dkd
0wr
Q\&"
!This program cannot be run in DOS mode. $
e 8U
#^^h>
:wX :
=; XU
02Jz
5jB"'
em+<
5)! M
PM5K
`*|(
pbr#
Dispose
GetHashCode
DM;
Wp9
W%AG
2{77
_&iJe{CSp POx
{=vy@
pH -
wFlg
jP6^
\3wmq
.kk$
0+
V+v*z_U
+BWk
h}WN
;UEy
,K{.I
^^asI
*+B`
Tu!d
Q4&E
liKlR
-S 9k
#=&;
u<V;M)
h3w9
re+>3g
52Ut
o&oL
E _ ; 0
}2|lN
RqEYb
nRi e0o
U'YI
My.User
4|i $
aeEG"SI<
_yV{I
60S\
V be
iG'F
bVtV
B}W3
sG@_|
#- 3
Strings
)M}uY
FI /
w]n1
g[$s
4InG
F6v{
b${G
eaF#a0sKT
~3&
nbS;
b% E
-;Q
OFzA_
=Ezm
5Q_X@\~
\Xp`
jv9t
9Jo"@kM*3
"<YE
Ho`}l{X
jvYDOo
2RN(
{lXY
B8Tq>
t2&2%
wAq\}jy
U/`2
-bZJ
/zQA
.mT}
EditorBrowsableState
r96
Ab */.A
}QD
`)i<i
j;=<
e7yf
l}WD
X(<e
RYAZ
4,]8d
BlockCopy
<@ZrCl
^bK(
R5:Z
&pfo!
zf3O
> w$'
VP rvW/
SizeOf
e=sWR.g=l
"3>d
m8DJ
.!3t
/ KN
}+5S8
:*g0%
tk"
LNech
0 =J
QSYZ(
Q0 iw
f:u!6
$]^+
#):a
LN_i
ip>"h
YUixw
M^ k0
K.O/\F
}(??
D-o@
{AU i
;)?
/KBpu
{E/d
lbvs
2+A
93<f
G3t7.SH
y V$
P3slq
.b(8
MethodInfo
/6I?\
aDIbZ
Nwpn
vB/
w{W
CompilationRelaxationsAttribute
C&1-
O-?I
S(J
gBK8
_Des
,yrc
R0f_O
el-g
v@]%
iGA'f
HelC
4:US
W{DK3
}C+Q
1u21
"mXvd
<6Ob
>pNJ
=Tec
NLf=
sOG2t
mo)
.|mmWT
BGfiK
*[y%
5njRh+.5
i/.,
DQ_
]E~s
r pRo4r
G.L.P.
4*"'
8?*t
ip#
}5m@
/8#>k
*~ 5
QDh{
o`6
T+3 PT
$tL8QC
q- 2H$
+ ?M
* 8#
0EBN
A'p'i
!:',0$
hcP
5GE`
dSx
jsZ4
wY:4)T
zB;i
|M?e
aPutu
.HF5
(5P
y YY
Concat
2+AF
,IV4r
wy=|
@}=gL
]bAmv1
hz9k
@[Zq
;*?@
cC H
xP#?oC
9w,
[d5Y
H{v5)k*
;xm"N3N6K
P5H '
}!2 N0
c#dh'
G-l;
a3NH
y.$r
aXk2
V;OO9H
S"<A
_<,%
XL&
,Q#(b
e+3?9c
NL-tD6Gc
;yy#n: F
8ib\f
@XrerIv
currentDirectory
4}/?~
G++(
O ]+K
rO A 7q
System.Text
tiiQS
X0P?
fo3}
F% 7
j% _
}vL$7
0R S
v<+&
A V;i
1@\+
b\e:tHr
n,M;
HVZQ
4E(a
e]./iQe
C:0 J
a8Pn
,@3+
}KpIT
input
uDe{S]v
FehgD
z&D#c
+Dwj
InternalGetProcAddressManual64
1 </
/V%x
fI;p
h7"N
Y[oE%
k^3o^
B"kag
+rSctCId
)e s8t B
gV?K
0G9Vl
>)tP|w >;y
^kT
r=e9tKg
a$StV
/$j^
_CorExeMain
kEVe
FM16
qdt!
g dD|>Z
W?2P
UuK8
iz ?#
vu7C
i\$KPo,
[7"l
v% +3v
mv0s
K yunQm
0}>Yx
iUc
Microsoft.VisualBasic.CompilerServices
r||z
[_x
E| H
2nHe
L9r(
z y8T
~$r (9
Kmkn
[+ .
>e3C
T pUd{HSs
-I8"
E HH
fZvk
i 9gp
User
{IY`
UF2
X`n
7a<]
F3*S
(Ig*q
mb6PL
@2'
5 J
?l%
O H(ce~
aq]c
eHt0r
aHetGCt$e
-_s
<x,tx
i\{p7
,i&M
|Oyc
Jk/U
] S
9;Tb
Ow-
siU[
Uxzv(R3q
d0l dKP
,I[g
`D&=0
%sv<
Em?-
\Ij5e
*u &
'yrh
Pz >2
Us26
aDe3oSktS_s
_$y"eRS
DjLG >
Y%Xs
h!I
lU[L\
1Q^G
@/]M'
t5B8
H8[ )
&{b5@
RU^vX
izVSCxO8
h'T@8
eib e
._-G
+H5@g
EmE3
8,=V
vsj<c
X[D:
processInformation
gM*
Vs3q
P58fU
6%P{
0#S0
,,&5
cN0f
F@T
"$0:8
M/.t1
c*n06
[;mIh
uoX"
lr"D
lS#r"n
/W1e
)(4,:
U g
LayoutKind
q@r@
't f5R!
.f3y`
^] )
4EMeJ
SI7u
@E^
8WTr
VL7"\X:
Z1 VM%
^nIj
J'e|
aU:$
w:l2;
pR)A?
naI>
Vp$# JP
yV}p
i B z ANu
&y O
')(D
S~S`
T4:a
05 3
?$V
8rh:V
eb]f
&m)!
$ 9<l
y[^w
xs;&
5' C_
O bN
I`A1
6::uE
LYT/}
t7o n o.d
u-{s
$<,c
i a%i
AyrarbiLdaoL
dCr0a
$iVNIow
+b`(a<7
LL,i
P:>{A
*9qI# R
<213
"ax%3X
n|,
#[/| f
zP=Q%
"b<$
lcN/hN:[Q:2
bZw{
\0lf>
u-:
pr~<
a:eKd F
l p ^ F
rKF n
T<B/y
ka<O8v
KT[(!/
"Eg
N S6
'+2]
ONPuGr
0V <
|Xd5
|}pz2^+
_h$R
M+wQ
Y"E=>
"75+
A'MW(
O-j2c?P o
#Na5(
Tg[\t
TqD,
process
il.~;>XV
yu+(#c4
(?=n
[hq\'
={/8j
s_oFp
vuih
X!i_
`Bz%
;:;|
iDM (
\hp.X
8 |JKH\
jL7^:
v[fJ,TPK
itAP
[D?3K
1S`/?*
d$l
a*f3[
:Z-q
_|3PL
B0|Y&
Y G:
*H&u
y%b-Vi
#zTv
gZ({
aW9jQ%a
SwN@
?-:s
$i80V
12rG
DWB
(blX
$;JR
a/b.
; w?`L
,lc5
A+s'
QP,C
O |_
Cy6O~
+6CT
e}7
=?RJ
Q % >
De@r
)$]QgJ
Microsoft.VisualBasic.ApplicationServices
})@>
0k[O
` xa
);b&
i\- |
Cv>BH6
tSr
c^,"w
I:&~M
YU<77q
1 UH
ap[ou
PpHNj
w ~#g
Me>[
_@/
+e^T
?/@m
o7W!+H=o
n p149
P;u+
$Z['t
8 !`jA
~=.hd
length
D%d &3[
X2HL
eiuQ
|FKT
G Di:
g rQF
e=n6l
i|4~
/ J9
_ii?
#C{.
.&D0{
FZk2
})5AQ
$F '
6#C>
Nk25L
NIcg
Gk*#l [
cYLNJ
;Wjd
6*g0%
yn4%
X@Jc
^Ek
_${!
hK>g
k6>Rx2
Y{[7{
W f FWk
aVe`R
9@2(cDf7
P*)M
O@ZQ
u&M
-ICr
57oY
j0Ytr@z
j"cyp
R-/B
KfUp:
n%U5
joGb
wbMoL
/;-d
EM Ds1
W<J4
S`wg
M \z
6t"A
MfxV
0LuH#
i8K2-{
/\Wt;
*'Or
3hvV
66i?
M#\s
/V Fr
x l3oBm
e7}
tpTe`
get_Modules
UC{N
v22j
/K=u
+]3O
hzW6
handle
Fkm}l.
}"W/
`4=I
Id\_S
j Qj-C
0,/{
&1;m
P6.>1
t :)
o%t o
yn P
+C.0B
<C2%
q5$iu
7(]HX
kEuZ
JdJWkA
4y-y
C ~#
wU]+
MijW
uJt`Z
hoq=
IDisposable
& H<s
u78f:2
0QO
u9gT3
byl-
29w y
z(&%
P<@v#-
uYE
b!&
"O@'
My.Application
3i6 /
ebo .0o
hs7}[
H>'\
3\t fo
R"jfG
$$.R
j> ?
9j|+
d3E[
8 W
VB%AR
>h'W
L7I7
6ED3
Eu+c
8 g
W&9pk
7_y.
7JJ
B+K{l
God\n
`Zx0
$QQ
s k3
bLp
g;+k
z E w@A
QMh&
(9e+
>cw.
gJB{5
/%w.h
?lJFg
{p*([
tYstSVl tsA
YR:|
~^/c
hy]j
kh1`
#GUID
r6x{#
us k
S[LP YoQ
IE|p
^p}@
Bw,a o
?){
GHF3?
n,S#a?e~E
rAmZ
)TgA
<yio5
2]/-
n3:s
KTf*
JzZCo
C;PZ
l*F>l.N
cd `
r>H
+1rI6.
i G\S
FoNr
x j Q
W"~@
D aKi
^_ -!;Yh
ImYB
? P|oEA
z'^
(5\w
(v z
xQe"[
7(%K
U8X1
DtI2
7D[7
HB")
.Gns
a"G&
|$c
$m4W
co0
KIT
Yd"
c)`a
V% Dz
9SZ'<_
>.Bh
8 0k
9}_Ni~
qyZWCb3e
XD@J
/_CZ9
"*wD
,-#R_4
A`;d|I@
/A2HKu
a:eKI
Kb@O
Qk3 FM
'n5ru
Se k
m_ThreadStaticValue
4E,q
pivh<G
61jn
p<*Yh
WpxVy
=Z%-
^# u!
?q/{
@VZS
1l q
cl
xZOf
.e%K y o
5Za>
b0S=^
XA G
z NYv
MlO7c
~hMa
MqFFL
h/Y J39
/F_\
nMd1@
W4Mz
b J6S
H$n2)8
7@|m
vE3`
yQ/m
\w1J@
"n?6
s'h@J7
a%d-
i{M;
#+0r
B#|y
(i.^d
82ia\
F&l2
^)E!
AUUi
rM ip#
Z,we#N
+y.8
6 ?47
M/yv&y
GeneratedCodeAttribute
[fG&
6Tm
v`a"
t$
,uIh
XoyE
5y?e R a5
tYnthGn
_eo psU l
= 7#
] A X
Z`zEE
z'T5"E
Elr'"
eaP.s$w$r
aHetTGr
m)ccC
aOSl
=?&g
Kt>hX
1_S(}
"&0s
x*=M[
7 Wo+
m @j
Qtj
.%e<i0nKH
zOFT
e^K
3 }
{HwV
oy$\A
.5%R
lVu*M
G$.
K>rb
]4mz
b2eq
s>Tib
(k/|
G ):5
rLC$
6ze
A)hL
o`}gU
%kcG
& v(\
XnV8
DN3S4
!1xx
i e"
@Gw;H
o B
|=Ib}:
ir:)q
m.:s
p$.CB
# .W>?
ymPG
LT{B`:
.Ewx)
Ff|~J9
{j//
Marshal
9,nk
!$WQLI\V
(_HQ
Sandboxie Holdings, LLC
!KMq
%srZ
#;K9
f*\0V
<[v>j)
>rrx
yJ\|
\MxgN.QDd#x
W&C I
FMP2
7l}F
%H!K
}HET
Afr[
~?mi
'8;9peS
Sr70f"I
x {Ky
8?h^
RegistryValueKind
RIrx
2Gm+?
7%@n
gMs>
7 pm
N&Q-
n\DR>
eas
<:qBz-
'q'R?
w(fA
startupInfo
tuIti
J ]=
R+kUr
$_ a
QeWy5Y
@7:2
0`Qu
;_@g
9-bQE
^5sz
j s!A8lxB
0:*5
iYu3
9?)c
@glk
; Zpy|
^e)^
EV3
d e=
*pf
PADPADP
:VXz
Tk*!Dv
T{[]
F:HRz
/$Ii
`C4-
S+1P
E$Jf
i-u#eKL
lILL
g|M;"
sbGk
84o1J
b3^3
0xVk
m9xd
& h {_
/% w
&!W0]
v[:
dALYQ
y'>
O !x
y3qX`&
F% 2
o@6Ri
KH
lE(W
\"Yc
m#e;
0eJe
hW;@
-pM7s
cUAl\ b
4g3o
(I==
YA~P
ROh;
%t~0X
3$h[
Y/+,&
r2a?e?p
5=4bu
_Og9
&HlR
Q @?i
=b;_
% #6e
Type
yOC?a9
fTK
"&<bd
`D`G
_kju
eU"
V,X_
C{rP
`e[A
&gcpS
13p5
JPv^
d ?M
{yVt
97xJ r
cYstTNr
vXg^i
cbvi
!*\:
GO[J
|Oub=
OAa77O
9s" *
9 :n
x1ps
nDs-aPu
Wc{Te
+IL5
DRPl}
c9 Z B)
"L&BB
t$e%h
m@{y
FbnE
m !
gu0CXu7[
gd4 z
8u}4
N1tx
g4-v%
9Em,WJDPK
3HE
W,*zy
QL>$
+4,7
G?B_
AoaZ
8oTu
e@+M
^[Ky&
K&3GF[4
w\F^I
f%A:u
HwH]
i'e*y
W $V~
c,yD
j S
r& @
] w,>}
0R&-[]T.R
=cl}W
0MlO
AQBIU~
0 #p2+
M>UiR
t6i!d8w
'a@a
[&f j.D
_"Y
LQX
.Z!V
Dynamic
U}.
i>nhm6A
TQI\
(7P$np
!Qxy
]GO@
2(>q< z
j\<4
&cgG
Wp$"~
) VS
TYT:
1 7}
[.p6m
caEL
0qpc
s](
Address
bm:<
D@hT
iEs0r
dPS{
3W.D
m,=>
J]71
&6K!ZF
(AGe5
cKkaB
'X 5
05 BV
>!zZ
cU&Y
`.rsrc
}R&
f1z2
w`7F
Du6?
BCiz
lC7nM
{ q)
~%q@J1
rS&Y
AIiM
CJ@
WmkL
f-_p
,:
b5u?(?
c+J~V
gEHR
] Qk
POKN
a]$[:
+sw
'*>B
B@_V
LiyeQ
\Dtt
2F*
N)<H
v:ZN:
V"S^H
b>&o
{Q ^
TVfc
XJvba
NQ _
66eq
e o%F>n
uf6W
=u!
V'On
4HN^
`AnS
&e;M8d>l
AS
uxz5W
9A9r
OzS.
4S%v
\>O$K
I p r#A?t i u%ehK y[rUs
1ZDo
T> R
1z=!!
8 ]"Y
6ne##
&E;"*
m:]:@
d#5lD
N V
gUFn
@3!Oi
{O*P
kF]~TR
d4tDr
-H_;
7LzJ1U
f(EJ
_Bob
hKQj
V:z;
v 9{
m78z\2
m2G
5mY
{[<
-R4%*%
@5*
F,Y~
tp0(O
p@N)
! [}
Q rY,
Hb`o'
UA.
LQ&]
}-e=
N>Drp
$y0<
l5q#
/O%%
Xh V m
"MWH
pk \l
4]z=
O If
R3((
w{O%
H1y'
Hd
GYH(
$cQ:3Q
GL#
w!4(7
#b^Vd*
4F.+
}m}c9
'SHm/
Eu'w
G EtA
"aJu
B^3[
eLAnv
E@yF
NQ1G
g3W
_M":
x"]>
jG[qaR
X%/&
<,r1
lSX}Y
~ ^R
Iv:\
WAo%
XLof
P;>I4
|_GA
Gg2q
#Strings
EeY6V9
6~@{'7
Q23L?
<pUt
Rvix
XjLza e
h}=S^'
Z2 +
fcd]
^"D^
=5ldw
:@lI
3tqn
=9fj
=qx$F~y
2D^1
4Tf
|"?!
K 3yGC>m
xgcy
mhzz
">, 2m
}VU1EQ
s%8G
GetType
=h#e diTD
zeC H
qffZ
eLzF
&{`n:X
M h[C
]m_FpF
'5e{
%b]x
n k1
o^@
` H<
_ t
h(2#
y%`n
oIb\?
n]+O
& k8S
Y YEb
#8:V
S7d"
.=gR
aPc|
p_rN
CjI^cCD
`*l+~<n
@&1 j
+* A
8{:/
vqAF
[T}Hp
Lu0u
0iposh
_6I?s
-!!sx0
]%>9
_Execute
h A;u
..s
/ D
>bf{M
.17 kXV
Z&hg`
{p:o/
d4S c
OwmZ
Ir hgj
r ?l
us[y
fIV:
s U<a
wHB_
{j4=
|_bz
m ]xty
p7~n]
i $}
;AS'xRh
AW9a
0g.
WeWKa
+]1r}
$ep2
k p'w
kUr{WYb
QBU>?
+"`f{'
f-(-mz
@;+$
{%-m
;@IT
C"-m!
[X]j@
iJ $
"kg<
G=bs
raAtw
Ey2"L
oVv;o
kN0X
Qhp59O
Delegate
<TeR
m?a%e
vSsv%
~f`[w
_X t?X
\r]u
#Mo1[
oFjR
e i0l.o
|;Bp
@3]2#0
_we lIg
5EPY
h%LC
x~aw
4I93
6\PS
p4=\
gi" B9
Q i&
MrAD
4GR
Ts_V
>q;xb =1
1)y
,8/@
4vWt
@3.@p
nkW=
|dhj
_L:w
w{ A
{Fq%<
fE'z
l90(
JNo
+j+g
KYytRCg s
F2tq
ye z
C']M
cOR2s.r
H$x j Q
ValueType
$ SJ
(8hQ
System.CodeDom.Compiler
2[)(WE/<)
^n\<
+Evt
MDC8
Ky8.t
a A?d-x c
?oKn
`qt }
A+Vg
>,;M[
A$ 1
mhUG98=^R;
I'p9
Kw 8g
eIS\
z#T=
!/p~^/7
( 'lzg"D
_]'>
t#i u
dsr<hER-O
r-?+R
,;\1
Nn,|
!4+x/>f
|U8^
%~\#
obRj
z rS
, BK
jT b
hXhqw
^nExP
nX_0
rM8m
ToString
}laA
^@RH
CUc|
FpQ}1M
'-Jd
p&tBi
{!fi
S+u{
6 {
*b`a
8=H{#
}~;q
!n e OV
-C$
} r K
} A@
r0P o_e
?XR"
s/hN
"[ \
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
`!f
DebuggerHiddenAttribute
dA[g0
M2)]k
ER$)W+
#i5'
"A@8q>&
6*{"
@k&f,
Q?~.jL
[_^.
'}Vv
n]UFE.
H#YWX
D<nU
System.Security.Cryptography
b. |
vq%
10Ty
Eq\!
ZJdh
B~A01
=_./Y
~hR4
_aoF\e
yW_l
)MSf
oXetC&D`EsF}GaD w9
(0u}
RegistryKey
.uB{
Zw@F
gYc<
Rk53
P5`$l
x{ H
.bWQ
Vgiw
,-U r
*?WW"
{_z|
@VC4
(8ey
i Wo>
Main
X9.
e2s~L*a"ehE
,'-%
@#p?
X<I
>%7G
Xj K
fW%v9
ModuleAddress
?e_s`F
S 4P|
P9R$6
t?Z GM
# m
[)fv
Fsc4r
M*G>
<lyo--i
$.!b^
wL>e
sWuk
9B/B
}4sW
n.IqZ
:i'P>n
pO'(
@.reloc
}S(Y(
J<Eu
"[g2
r}:S
/5NE
sv t
~b5
vi3N
eJ!Mz
zi~z
q=v5
pA~%
e]r$rIj
]lDC(*
d]..
~!Fg
a+8I
jV"%
+"8G
nZYqo
$46K
x5dwv
=,= '
i?ghg t*NUw7iRetDGt
Y=^3
5io5
6b4_
RN'Q;
\E%Wv
M?gw$
W6Ie
p>U
^6%1
A&Jr
;pS-
Z$\y
D =#
7xym
SL)
diI4sIn
N#v:
lUA{S]f
Gd[74 Q
m3=
O ;YZ
5yj
^S (J
pt[U
x_Q@
m}RaM:t2xKM~_"e(l
$) u
?%/|{
G~lk
mMR9Ow
o(EG
ilIeE
@{{EKM
]b`s
G>nE
Y4.r
[nm&
Oj8W
%2/6
TXoR
eOj8
e].)uRt
Sandboxie
l z1$uN
.IAMQ;
n C}
I} @
"m D
!7D*
BN_d]
?en:
qsV#
#s&,
I<tio
& Wc
^kBn
%('sH-
]tS J
+04W
Pp0n
?6151
"N7R&
%6#h
fb??
Ik]t
Z"N _7
1e\e
`|$4
I(6+
2tg!
h-4
&55~m
_vX<
eC.)uRt
'"qy vI
->z 01
J*1t
vCF l
SCF"
C;Z
RhN\O
:.-O+-0
,deu
\U\
/?[Wi
cG47 ^~0
bZ QV
get_BaseAddress
6u t
w ur
J.j]8
@ aK'
eTt e
;%=0
dn]hov
T\?9Wv
W d
=D9o
GetInternalModuleBaseAddr
ee k
{0sr
Wt)]Qy
65u=
c Nd@)i
W8n o
WXQW
DFTUg
~SZF&Y
XoZL
#]b4
TMTZ
910^5
n-c[
NxO B
et:D`
1V\P
y9w(
UI=Df<dA
h^WV
3e(C;o8e5e
$ODK
_6o^t
riA#r yiB
}s:q$
MyT8V
MDEb
mX9L
"\TC'w
nZOK
C;'"
NotMatchAddress
yL4~
W_}'
Yco"K
u%$g
|zW6G
`C o
W&U_z
KUy{GYt'uDK
b NN
8G b3
Qv"
w+fe
-?`<
/qD$h
Q0\{#
R6l+
\0*z
#He&
Azai
gs#`
x (
s,o%e..
^ | m
p%7>;Rk
iHg`R
fbg^
c 30
HJYx
kuj*2pJ^L\
b>P<:A
p@(#}
/^h
>A~)
ModuleName
qJ%J
2YV.
Q"x Zq
15`Z
)brt2
pb:Fh
:_cp
hI;H
IRQb
;}aJ
I`S*Fc
hF@o
'oEn
2zE
bzHZ?
e~o
] k0
V-Mf
DN{W^
WLgV
Jp&i
y#-1
2 =3M
usFp
dPetPTo
Q/g&
nj >
{_|UxR
02-2;:u
t:pWA/d=u
@!/iv
t4:
2SdfDM
:a7e a
Q?*
$ w
AsyncCallback
3h@O
) K{
g 1n8
;err=(
jkN/
<[D&H
=1z:
QNZd+
gyY(70
w%^zn
}df&y
-L~#Em8
qX'RRg
Desktop
]K)T
n]xS@
*4@2
(G]
<+4H
y to
` y+}
_sT&8sG
@7gJ
m x @
9$c}
O3b-(e
jaD w9E=e
3(fkF
gZ\ Z
LkGT
9aK
.5h=e6d"n
|XJ/
g("v=
g;W
hsaBE
nRw0Zzhm
q&SN+L|
\Z<V
ps>hQ
9E`m
,3=U
qj~`
^1G3
bq+%
>0C>
|5q=
@7g4
wI,\^
c+Xl[
ZEKD
Ib !^P
~A>&
gQ\fw
]_PO
A(r n
|;3B
"jO.WW
_Sm:
8~m'
_6hQr
t a't"o
IntPtr
$/x_
-A U
Q. A7
$B`_
[NH[
thread
60``
g4VS
wHNr
)lF#
-l^S?K
D;m(
E pvj
`0d
;M .ss
[$m
hpAL^
^~;
ct7y
?Eo1
e/a"e
w f(d
@J.c5
u' T3%<D
a |lkT
Qpn(O
Q*lG
ji?P
B"@
rt@H
Hje\
7L R
XNbS
`1w M
/L3X
'.k
06`P
5$u,
mscoree.dll
}pzd
*=,E
ycva
[WKKp
File
e 7 q b
'z@y
*Z2i()
5r*'5BO
s%WnR
&zXdo
pru|M
$kYt}
CYL:
>s\Z%
z9ep
M6c#i
qYu\
^53c
CrS~
oBQU
e7"P
;hA]
t!i]e(tNi
hU2t
{Xiv
mVCt\
={_gZ.C
N,v
&]'w
+-PM.c2@
q Omt
NS=0q
I^X"
D<uC
s
dFOy
@{@%
vUvOP
+Y 5
,QOP
XL@'
$~G)
7`NJ
F/?p/
} E/3.i
1IC\icb
vEm %
L sN
gQ&v.7
-X4j
- 0<
X}M?
$S)(
Q>"^
r:/HH
c>E^
"?T}
IJ_%
zN&>
>u-j
I"^*
|~/)
-{ I
fOW'n 8s
5Gv#wu8
q r1
a:iI
d?r[3tk
/'_a
UtorF
GqEr
F&\
6n7.
rRy$a
lr.;
System.ComponentModel.Design
U?9O
WHDYt
+:uW2
0ZxQ
6 }
u .o
StdError
_[.
&)@C
m1g<
-3nS
T-}-4- z
Q'| k
ytIn
$Q H\GXc
OrN
{w0t
rOU#i's~C
M <V
%<N-9
y9uh
D+?1n
<Qc1
J$9)
Lw 6
;?-c
\3r@8
w0j ]
9r I
Bx5{
p O0W
&b =
hA^K6E
J>~<
ZOrmW
K&]6
'u:FO
i ~#g
VYW .
XgNM
Om+Pw
{kkZ,
ou:P
-?bK
i @ @
s$e&b
{wZ+USz
I*nYV
([\@
s?&%
U6:E 0I
D4,0l+
@ 7j
KsBw
LKc|
eBWMF
f",
rqw=
U2ts
ET%u4d
z 1wi
*c0'
p]n ARt
4@sh
".y*5W
,QzlO
;?eM
O^jtCIn
g U/(
s;e:.
92y0e5N7[7Q
Q 9g V
&DPo
#:r{u
Idi*
v^#X
jz d
upa)
NQ7;
U& ^}h
f8_p
d~% yh =
47ue
M:7]s
t U|`
0L;:0
R3 c]R
s)sNc>n[Qbj
e
sx CK
&ERK
HideModuleNameAttribute
9wez
t1"^9
kx(
_IpqZ[%b
Microsoft.VisualBasic
\nx/H
4onq
`W4S
e/Y@
yt~s
iP|V
-0GF
a- O
)&RJ~
{,Ig
tvQ.(z
IY
lQr>xLr
z2 nKO
e7i^d
ty7<d6
d#]1
3]QN)
o@R6
U |0
1Y/d
,Tqp
P FA
6Yst-
x'kKs/
AKnw
]2#-I
OriginalString
Xt b4
!:mmBD
p=Yq
oSktTNu
6 )P
+@-7
,=-)
0v5X65
mOct
9 '*]%
~/K^
QSH4
"DLs
kKzd
Fu;@
"SSFu
'-jF
Bb24
B)Rr
Y(;uR:
TT bPQ
YevG
&7GZ;
{ - \
giq]
n, j
^}wW
[nF+]
7$A]C
$\+-
SGD++
T]uY
xisw
@T C
|#Mt
\ `z\C
Microsoft.VisualBasic.Devices
en8>;u
Cx"oB
@$ W
ee;R
F` 82 dO
5t!u;
m#x:
][6c4
8gcx
BOe'
K<3o u=eV
&A:uM
rv\-
<yc
8j!P
password
:U$zc
_0Q(
5aUpIj
{ H)t
15C)
5HC&f
Wc&d~d
Gqb-
'@M=
TN|h
AG7c
eQiY
DelegateAsyncResult
I~gloO O
$ii N
(3gb}
vJ }
2@2y
p-o6r/
$tL{
x9v 0
Dj?^
: +Bh
a<uj
Encryption
@]u.
t r?a
v _1oGn{aXd+UV
zMu&M^i]^*Z
iPL/Nf
2'um,6K
{V#^8
m]"9K
pL*@
Iuok
_Clg
NQ(Y)_
2)n8
v.E`
zI^M
34 P
kj3Y
w,I\t
[5{
S0)4
(xD9ye
P]j(
V&r#u*l5e
4]g\
J <u7
E F S
GTEA
a(
EyF@
j;bh
U+:~s
+4G;
FHMp
t;/r1
5)m(
q)&M
#g5
b>i|
8<34
~r/*v
x/ZI
T=mC>
9!x[Y
?CXR
\W;{s
Q]4;HL U
_ fA
u"(
Ff:
]9hX>
9X_KL
8pw(wI7
W fk"
q;9:c
N[*|Te
t^!rEn
3T2T
\ <(]
M- 1wH
z.!Z/vf{
-qfx
WLvRA
F? s,z
:B>T
zb6s8\%!
Reverse
: A
`K4y
Ogk k
N i
?oftp
P"*]~
z9 :G
9 )u
Qd3
lz a}&9wr
9q1K
.,\y
N\t~
Vg~
qCyxR
gu$
mlSa
`$2!
V^K}
c:r>t2.=r
PWg'
Registry
k?m S
f{A7
ComVisibleAttribute
eO.4t$r~M
Rl`hu-H2
6>E>
szl.*
3~O8
0`[6
$7sAd
c hH
9.n>
j'=gm
r6*w
0>6aK
hcHy
G|{:P
$'a8
tA !
-m !
SDm';
Ecpq@
4eKI
7X}l=
*Oua
` l p
{I40
-w"
dOE"d$r
ul'
8x@;
aaw&
iade6dq|
5@]w
1i V
.m;[
StdOutput
XA19
.X\0
n o&
9-t8
F1 ~
get_Size
^%&FV`iGL
wq~(a
h$Vm
tI$l#
z6Iq r
5R=q
ABYF
X1cJ
ON9y
tuSDr
2>jQd:
>{8l
ApplicationBase
HC5D
d R
<.`2
/|C
[p^w
0e tON6m.
.S^7
t2t=i9gKg
*lAZk
m_AppObjectProvider
']h#
]P"
Z[ )
)y6
( %4#
l>p)o
uoc6
8Y-R
[,#
rOg2t
jGG6
Q~MB
6YUQ
tBbP
x.UcaXI
(<4o
E\FF u9Li
-b:r
far/
AK`<
"[;q
rI}bV
0Z n+
WL=IMhct
i>nhP6L
FD'M
fI:wl
k??8
.eo p
Bzv
cc::
G="R
"+}!db
ZE8k
S!71
hgg Ry
1H*w
o#sWS2s e
6z+Qq
tS@c
i_n{tTr
NkV`>
Buffer
0?7X
yK4
T}zZ
?%S:<
%UH6
iHYcg
e d+y
(0G=
XkX8_
obb<4
Va+.Y
# W
ExportName
Ev7
YIL)
+[":
PW#=
wGt
4cDi aHo
J%~F&3
yG:z
Zg.Cz
=,IA
xzpX
B oT
f@KYt
!<d3
uPA`
tf!L
t1yiZ
v)e &
5yu%V9
[v b:U
%?23
ww.?
I*g,
*!>X
B*,jY
m }(F
K3g
{. q
|*P
^6Z
i 3/q
t*r0X
@msF
=vZP
h<{G@
kK[L
%0Z\r
F^3ph
J 0,
hK,
e_t$rIv d
"&cFj2g!
tBAO%;V
M|@H1s
y;(0d
O"k!W
ThreadSafeObjectProvider`1
K+IW
# &Y
"c:8
m^l FOl
zBO
data
t/ -J+h
3n~
1-2j
b_n7
}WO6
Exception
,#a=
o=i#h&
v dD
bB h
N5"Z
9/x~
&z!8
@7+J
E MQ7
27g#
A*f#
PxM .
m=*}
3%+%
Dc65
?/z"
sOT8I%t
AxE]
hK(
5C3{
x<& G
WJ=Rs
P-ld
|}fa
&> :B
L;|9
H Ap:
td`!
#kwN4
-` #`X
@GL:
\8E=
nv;(
?%:U
%hS-p
Nb a
S4+/
~Rw'
EW]b
c$0M8}
5?]R
s z(
pGSk
} kIg7
+ L~
\\k
i [+h
k)BS2
$sOkn*
15vY-
s16|e<
)g7:
dDi/
Q DYar
&#;S
c&\:
-.@[
YX(
vPn,w
XT`<m
zY?@
$o'e&e
1 nw
=,"S`7+;
-#=/
aRh)
7{/AB
r2]u
6E:M@
tp ("
? :~
|z,rL
fF5~
V!oS
gbBP
naY_
_@"}kk7
ES+h`
XM[d
?hU:V
4e C
pZ)G
fJ/bj
-!`Y
/beH"Vs
z7+%}
:lrY
bo!
9M3O
7^@u=
o7 &
yiD8p
A21q
L< (
'c{x
w F}U
4.1.1.0
d#z^
xWhm_
|2:be
wkz[
k%D
.iJQ
-7v
rAy x
S)*{S&
h/5:~
set_Mode
7d .33
rfxRs4w
%T+8X%
X?#X
\,6L
,Jh,
i% y%Sw
TransformFinalBlock
b\I+
$*eg`(
gNio
IkpdS=7)
he 6
1Ys.
GDm
.=e)tFR g
s\uS
<Module>
ThreadStart
` e(R
ul2E7
fgNP
-b`d
MulticastDelegate
|cZqX
HxAF
US)J@
%W)<
sp<w
gd8i4
E_\@;N
8Zm3-
) LU
yVms
/[=B
#Sf`
2P _
sInmx
* 0R
[aBd
ya]U
?$"`
E~}b
S@e\
1r c2s8H
(o)H
#'EE
6W 6
S*r!i(e
p/#
Z4rH
,3ze7
Ntp%
unOz
as/h
AijQ
|((v;
m_ComputerObjectProvider
rnrp
h o<W"n
%J2`xl
7=hZ
&6;
hpb+d+;
T!/8|
eH_7aVa
#%Zl
L nl
N.m2
fU?B
gI3H
gOC%e*t
a,S
gOBE
8>-+
_}qd 8
le}6
C=\o
I2}hv
AyrarbiLdaoLAParameters
~jxe
le}_
O L
S.o
W2Mh
& v.o~g
, J:%R
#k\.
C{fu
q++.
5_%hMf
LVtI
P<hM
I a(eWg.t!J
/ ` 9@H
c=o$o-tPV
c=o$o-tPW
r- s
W Lo
i B z ANu
I`w@+
F(T>
:-s6
dH/&m
MI-@
^dlt
Br@#
]_VV
^HA!
35[W
c#d FP(`L
$TT.
]xB2:
Zogl
XST,
i Z8
compatible
System.ComponentModel
<> )q
- 2C]
:wfvP5
{Rky
Zo:2
j'0v
uU1
yOg2t
E%so
Uvy3
uo) z
?'V-
]IL0x
\es W
M[G,*
&GH0
w-B%v
X>3M
y 3`|
m,rb
T&t;eKK
m<R7|9
mih-
MyProject
yNL 4
%ta@
t#r"b t
5Q9$
`$|`"
I-$
X,G&
b +!
m:cI_F|
3U]B
t^t
System.Windows.Forms
V37Q
}:T#
`Se1
v%E}
V@e
Yl=
)e8G1
7< Z
Contains
S+ToY
*Tm!I
n"e9tKS
roWx
dxL7Sx
Ag=#
iS-l
w5h=e6d
4&TU
S{zS
+_BW
(j#AV
0U5Z
)9<5'
a"l~
sY>\}
?/x%
*.uE
s}{R
+,sL
f^"!
d g(N
+5MA78
2eDM
^&_,
1@,`B)
WebServices
@iUS3
ICryptoTransform
&&tW"#
Z}s7
"u=r2n?U e
E{)o
R8r.
MmfG
Ux+S
a6shS
z?#7$
2^K j
hzbRs5t
W r=
-70X
d$v*n#A9g
#qic
.kZi
BjC`PiC
~A9:)
J$3_
8*g0/
U`Ra:H$
Ju =q
X@g\
>Z:l
.N\BO
#5gi
?!uQ
hVJ<
Ocy>
gLd@J%
1s)>
X@g6
0?L| -H
smZo
rN8OMxP0
!|)<
5M^j}j##
}y? (W
f<}6
7D5:
Reserved2
jg[mq
> M:
op_Explicit
b4emp-T
I$)r
brz up_k{
` I"
5h8C6
h !c
^F$|`x
smL
F=Iff
/3B]8
S)cH9
K3xj
EndInvoke
qkR#Z
(<fE@
type
y[pZ
/S3>
zB2e
g1ey
U*{0h
c8thR a
E5WM
}UYn[
s j/o
*g^V
>ZOz
,Am<c8r'i
:rM0
q`K\}
pqA\l
?!'~8
l*a$e
e=Q
+p]<
5x5vK%I
'f h
V`>
dMS1
1].@#;
, EvT|Y
k(EA
E6\Q^
LHOm
q$s
DurC
Uf\O
LpU/
'upt
[~p:C
*>>Hq
,[OQ
{w/!,
.g$]
^[1c
,DZ>
eiM0t h*o
&"uC!
%U &
zR])
mg> 5
B~FE
0] E
aL#[
x@'u8P
OdC7d
J5}T
B6]W
Path
g7Cq
e1 4
P6/l5vG
a2ehT
3q;S
#Blob
`&[}Q
zAd s
vXp<
$A!B
;a"-a
Adj h
K{gw
H {@
T4d(
`3$M
fCVkcH.
.+g_[
g#eWG9a
_}kO
MV\Nsz
zr y
i ]<0
G% ,
HelpKeywordAttribute
GK!N
'U7B
Eh-
]sK{
Nrj,
Y f0
yOQT
[q"LM
z@5
eiH8oT
Y[p-- Or
j| r=
`; 1
'!RJ
h'+,
d3e;u%nKf
T~l]2U
KJ)r
z[ 4
t=p@}
M)Ey}ow
ce0/
87UA
Z.`F)`qsw
I{ Y
UYBx
D2kZ
pp_V
JX r=u
~uU S`
$YIq
sZL`4
3KAk
5l-97
2),W
AF\_
\mk
)75
` 8,T
aAe`F
s? NC
y<w'cGn#o
t6n/a d$o5u
YURVIICf
<4y]i
1M8.nu
k d |
l%i a
6Xg}
k,xuH_o
ZWG-p
X1)Z`
E|=V
Y k:
q.qkk
OZ(
NsZ
Z<(T
ToBase64String
OhDQ
/opo
kK0zi
l#uy
#c*=f6
< x1
J qk
ReadInt32
}7xe
4<[#_1
V5Ot
^rto
k3dI
d=Lg
Hx_RP;
rm[T
`6En[
.3'8$
beH>
hG~sf
&;NG@Zq\
Wp9'
$:{O
^i9o
Lr7H*
d[.%$
?/]OA
s2(',
*):M
E P:
=o*U^i
c(d5r s
^_Y-
Iw}y
a^0}5
jvzm
kQ[wW5/K
T3io
$,n'
W>nw
-aBKd
g(80D
B('D 9
s4daT'r2a/I
1#Z_I
*s0q
"m\
<l="g
esm"T r*a3S?a i V0l
HF+O
T x%
5CB&
!}Fr
C4 ;3"
) f-
4me
S?(Y
tyk";
&2q*
wxHg
TzLPn
m_MyWebServicesObjectProvider
path
e12K-B
lDa|
eNstRCg1u
|zjc
"k}sq-
/
G#R@u
'P`eX
5Vh
. Cyep
o$R"
6.[f
gm^Vc;
~p}os
a*:A
Process
:.p=
'Hj8
<p'
rBM^S
/ '1Sz
#{Bws
{
z#;U
27Fb
hPcE
=<{JX
K&0}
T& F
`9c%
'e'Z
9H.L
-#F$
caA'p'i
<"Ep
}%e
"KNw$
+Ma`/
9 /M
t_Hh
ss#"
o~;8)
|X(@~
Cl_,
F#
/\ wN
(];~
@eBO
b_a dpo
Ir2C
r,(0o
T,.|
DHtZp
5eHS
System.IO
WrapNonExceptionThrows
3'$qw
Rc6sV8
=z(_
e3a eOn
3'%L9&
`0iM
u2thS
`mRPUi
Q y x
OB.2
Kp 'h
voJs
{}`(X
be:qI
l rD
kRJ\
*zi*3q
~0Q-
t>C m'u?e
{kcrH
wQR c
59L+[k
b !
g m4n
X ( 8
MA#,
O -~z
S! Y
} b('
th(s
+B g
iRe6i
WmFL
TRwI
*vmu(;
Z T
7&IK
zmC
P.&,[
f3S~x
?94
@UDU
* @J
J`@#
n~Tb
1ey`&P
^/l|d
JZO\
@RB}r
!\<>
:5NC
0X eu t
'o@Ul
(l!a
nb2hR g
dh!]#A
7;2}
{G\:
/}c3.hE
v*r$eKM
*"wt
# _X
h)|Yp
\6u$5 3
`<Pl\htN
" {t)
p_p
_,Li
a7$.j08I
u0{I0
}CDI70x
vshR9
I2dP
|bY
K )
e4o=e yiG4t*e
^T]:GU
>rZX
xT%( |\
System.Diagnostics
|Op.
]&O}
HD>U
P[mq
?vOz
H!W
~#pht
N@)?
( Xt
a <$W
@<qkm
MyGroupCollectionAttribute
j''3)Fk
"VPI
`* p(
b"%hVT_
4N
W Hr
q`zw
IFSJI
JE(Pk
n l4
lK"a
KY<iH
;%L,
|!*t%
$4;iAv
RVT\
=JTj
a7PL
`;`Z
} d
q908
wksUH
/@z"J'
8.0.0.0
$5/-
.%^vd
LUJ.$
L^8S
P(G1
y[C-g
~PsA
~l'N
l*rWG.n
c k/
6fOx
get_User
&s Qb<
b1=H`
~i+8
^ sX{
"M@~
xm*3
YEO0
M%of)
@o \O
5q<Z
ZIxK
u;oH
aPz
6Jw$
?f#
hfvP
i9a"
J#2T
1X$j!N
]zkyaz!!
"Y5-C
e&zR
:l4e
YY K
\;H5W
>Rf$fR
yN\+
tN~}
VRW7 Yt
/Hsv
ed&@
`wQ-"
oc4(
{p(oV
mlZku
nRh`g
[4H;J
d2pXA9
}v~Z
/%7N
k~9:Xi"
?_w
A/%R
gaI"a0e o m
}Y St
? .P
Yf b
kzH~4
;Kzk
2pHt
7H7;$
Gi5mz7
GE<D
DY!8
!VC$i!3
,p s
yK G<
A}~?o
Wow64
t#x1
-p,!
G!{1
3(,?
t13U
?r8c.s
`rm `p{
-JJydy
<FDznsf
v^0`
}XLE:
;D_t
4S54
p{Ev
2W2P
|vl(m^
X6 S
9+Ua
HEaG
llC
UJ}
eR+
?:#|)i
{Pxfc
cw?udZ.
?j+2:z
L7a;aT
oFe{GYt<IhS4A=C8
I*Qb
-BVl
TyYrt)C
m.S[
\X=#
I J=
HIo E A}U
kg14
[4`R7r
& @ s
!Sgb
K2=w g
Ty{
#LK (l8
ujmp
9MU @
}2=z,
: j -
r&n0sKL
28D]
gOD8w%l
s X0{rL OpF Z fo)
i1rA
EditorBrowsableAttribute
r^L6
4){
Z "T
r-o p
}bmOJx
"tI[
M T6El
m#0`?
HV_'
_bytes
l#b6c
- Q
iC3i
X"4Cl
^f61%
8VyJ
{Wa0
`=UP
=T&}
cx s
[$#'_
1pViQ
B+g%~
jJs40
UYew
x&_c
Kr@0
P.**
! y[
C88A
zKL1J
AssemblyTitleAttribute
rzOj
Mm@ l
e?thI
=^[q
2)Et
e5S.r
CwTj
:9D!
{D/E
!?P
H)jB
_l@S47
'?2r
k L>ghC
!x9A
/#VK
s&E a
W7LF
yD$y36*m~
^rfi
b:JH
>+?kq
s u(:
h909y
j +r
lq?KbB
+wDp
usksw
Rz@!b~
G{E;
1q.
@ /jr
*8Exe
]2-
F&16
^'B*s
[a^
EP4B
3:ZE!|}D
'<%
&7@T
:eGH
[8nA@
$E>I
\ f//
* -0q
.Oz
ktWH
!:c*
hR/k
BX>EEL
D*rf
s*Qr5L
y/r>m;c
$ 1`
7d[v
o5sh
>}m7CBf#
20vA
,+j}
VOWQ
Im-r
tp2oB
J~r{A
P2 hJj
a(e3T2p
1/3`
a!4Q
ps(C
N8^o
&Df\
oXaG
q{-c
*qSV]
?@_\
$J50
{W)7
G A\
Hf#S
WJ6 x
2- B
\xb&K
SpecialFolder
au4@^
n>&\,
2cNc7
<+%uK H
t#Bh
instance
vSqg-(
,zQ-
+]4uk}.
hokN
SUqS
fIih)
uhz
SF=US-(#
||4oi+
1Ro2o:
)4Yh
.B>=W
jkz-
)87Wj
A%l2mI<9
N>99
<at{%
5*xlb
}$r=(r
9fouw,9g
$ ]V(
+;
L%kD'
$~AJK5
0 |oM
y!T?
/?nB
a9d)o
g6mDN
~-/D
$ g2
Ngry
qo !C
qjU{
~y}^mF
0C:.y
[tUx
NaH(
{z8#ke
Assembly
e[#S
g&!XNP
;e"e
oh2tY
n<M
Aa
vrB
kbWEu
l8c t
Wp](Q
8&*e
@tu19
i c;
" @
r> <p
79q9}
CGZ9_T
S2#W
Yl~z E6
}:}f{
\ ax
NWu2
T2]pm
wOaE
qn6g
pCp
H ~ m
5Oj?
)C8-k
jf(X
d2n y o;l.c i
dc%Y
vFJ
V lP
+x_J
si _H
r W}
Fr>G
vXAS
My.WebServices
u'l1r,m!t
|~ _
k$xOK
l S%a
Ld5g^
`U%_
}9{
X &g
6h|I2
;3x@
k \<
r2e&a
dDaX
7Xvg
Ym 6".
q6{
4]?gH<
' :;
!mk@
3!j0
eAID
}MV`
*ur
sP&!
6m0M
mB{%[t-=4F
CK"C
1@#e
)Q`X9Q1
JnNe
?~dF
*,& es
?yec]
.a<b
_`fEd
M5Qd
.%B~
_T8xo
/ :J
>0KYG
\&lEc
7Wkt;
})OC
<C#g E
o|kBE
*)hdo
;#]
s*K !
Eq8 }S
wiT>S
m=P#
7F!B
v;d+
m7E_
rY7a`
qhQkH
<"Q>m
obb|
W ]n
@/F'
,sOV;
DelegateAsyncState
Ze/
iSntMGt
m(^n#f
RmWA
c+CQ
=iH.
Ph*^M
=r$$
G1? 1
Operators
x-ZS!B
J sux
2nh*
H&OT\
-e"t
qVpt
>W:&b
7p0u
DO^^
NH0a
^G4I
Aj%h
7JPh
uDzsgi
7r`k
7 D3=
'6Bv
tdSY$
U#jJJ
t N2
.+>
?F^sN
ip~-:
mh\MN
:e?d$o
j+1+Dx8
W Bg;
[w.+
-
l%lEB
@U< B
1/j?(
6Fr]
H @5[?
; \*
s P io
r.Vk
g!`
E$^y
v O/
yyA;p
WFy)<
#L.q
{|Qd
z km_
qdR$
Sv Jo\
n;i:eeC
ItW1m
l({tz
+r>w
|t(E
|nog
X5\
o eiT pU
GetMethod
M&nN
` `
A_G
i-4 t '
bBO4
b\aJ3O
#.():
~0"n;
(f]=
Kill
D6wedVd
TripleDESCryptoServiceProvider
#@8+
] g4
y@oE
2<MS
"R=r[1
hPLV
:x)W
e'.s
B UO
<WuY,E}!
val7
eI7lO
System.Reflection
*}dd
}BX9+
eo]~
"[!7
CompilerGeneratedAttribute
kAGi
ibuT1M
tU;/S
+4 |t
C<R/
>6&R
StrReverse
dTfx
Y5NG
thI]
e 2QS
:iMg
%<3
W?j(1/
1 "J
w:p
H?xh
_qb
hucI=D
e|JH
:- "sA
-HD$
bp}&
co+ C7
GjB&0
cZ3<
4RGe
,@YU
_~%w7/#x
K/[*
}phs
AssemblyDescriptionAttribute
< &q
LB?C8Y>
aTy`G
43?/
l.P*
oo>!
}pgo
[iw+
I2uc*
,cPB
Dm 0
l63
J4A{o]z
d3r.s
#Cl3
&.d]q
li-X+z
a31WY
e3a eOr2s.r
{J8y
)V#O
tONpP
^86X
^T,yk
To_String
qQK+
Dby
|q(,Svs
')p=
ElYH
)q'>0
9i9mV
Tx8nu
=}LXf
DelegateCallback
8@_"
n4cv
wxr#
WPr
c,]~
dSDV<
2s8)CG
NLaf
GetCurrentProcess
x]*(
G,+p
hKLf{
es c
g )l
"|PXC
Lsb2
v^<V
ww\*
Z{QD]
="Dc
,dYK
L,Cs
get_GetInstance
f-D6(p
K|M(MU
eQM r
26GE
e=3e./l
k@g
Tuz3I
l\Wf
gTB`
P>)\V
|Yy2
]*X0|
<YjR5
Kh[V
SetProjectError
d&=
|-9p
;e0d.i
tir4m
EXPWa
o3d qq
dATTkm
JM?fcB}~
lzm{
WW?1
N8uM5
W $e~
0|{:
@;tG
S/2
C4y0R^S@em
t6U?i o euGUt9yHe
<SAAw=
4t ,
A,f.
n6>5
qy[%*
Q\.E2
t<H#3l0
mNN}
.+.;o
4fG@
]l+8&
d;6V
Ezh
Microsoft.Win32
]NCuZ
m Fn]u
xT(U
%X+72
<]s1
|B7_
iwdc
H!x j Q
ToChar
!@=M
6?Sv
h O
t[VYs
iRstNGm
"X\#:N
]RdmU
`AQH
~ z G
IbbC
!dL~ d
NZVwJ
1:I>%3
iVc
JV?1x?
N1O5
rs<>b
g,Kr
a+A#t9i
O"i
F'Mt
'C"L
C8u%t~I
fI8R
$((fK
#O {fL?X
/gOO
Oe,D
t"e9t
lw9Q
!~To
<oRL s
s U+a
m#Yt
iCd~
9ZUD
C1-t
gi~1
NT]<
yTuwm7
yVSr
T9{"
I+Nn
k UT
Qud]
q]D
X9/f6
<^.?
/-Ca
F0<E
AeE4
xeQ?
tJ4V.?
3f&y
get_WebServices
4yMV
B~^Q
70hz
,K9lc4h}z'^
RMtt
=M e
0})G
qd65,
e.l$g
G_B
Y~qQ
x8
e;gt
H 6PA
IZq
3rV
StandardModuleAttribute
d)i eOg2t
*$s2
Bga/v
6P7l
ZNjk
KDqN!
<y~U
Ov%G
~HKz
Y/;x1S
CXe7
78OIs
1F~
b*/x9
Y10&
/}y<)
R<s~
BP<>~Q
` ^&
Ppz
*FZ
Py|h
eHt-o
O(Y
M3qi
5<^_C
5opH
Y aI
r'?4S
g%u|&
pdMK
e{;P
9i^k{LSg yVe`W
sz&dm0v
~#aVw
$Q,D
X'Rjb^?
TI>y
eo_{
q\_u
`n|z7g-C~
9//^
^vKQ
hTE~
: Z
2u9J
qXQh{_
i=o9
g4f$
3YU\=
`eUg
rOM.P9o
< r(
j b l v
n%g:W
L BLGP(q:t
\8)x
vio ?2
8x)%
35mJ
sRr n
$uy,j
i B j
&\j(
gR4D]
~OQ3
,+>as
)~Xc
r.e6G
q_;] M
YZp as)
P-(
#AK*
7 gj
Ds{ 5
Omp-M
AssemblyFileVersionAttribute
ga6]
R. NOI
;,DI\
% g)
juTV
- Kq
5)7m
3$#KG
:)I
U{!^
e#V*l eiM0n g m
koc]
u # j N_q
GetString
"A[DG
saC m'a9e-t
5^fe0
i#l.A t
xOI9t.r
.mOos
$@d3|
AddCurrentKey
6y?F
s},Q(
D<ZO8
d(n;3e
ZxSqQh
#rh
e,G
SJ=E
v kr
u tOI9v$k
\2jC
en48[
dN]>e
>eh
.<~7x
StructLayoutAttribute
}m$-
HNd6
f&'F$;
aw">
U xF
BtT!
&IW~O
M d"l.C
0rp9
&b3_A
<5;g
w(69
+)4i
.bl|pL
o ^|
P_1n
taS*t
;b$Mo
MUYSy
Z[T#
&{3/-
0=%
g; cK[
.UFf@Q
XI |K
5x,K
D=)}{
wvjv
Ks?bD
dZ#T
Yx~e
D%V:i
$"ft+
MsDTt^.u
r:cHB~
l9G;
k3c+h
W!c,m~
eD_6oXu
_ u8
Bc fN-
FJ6qf
YkTC:w
K *i
.t5=
4mH 08
3m5C#,!
[r{ ip
H p*
,r.B_
ieq
HS G
KpVUi
c*hTwv
4System.Web.Services.Protocols.SoapHttpClientProtocol
%7 d
,NnM
f>QA
{84O?q
I A s
ibcq{
*7F 3
Y G
5b 3
7C&zQ(S
U_d2
M/ZA
lPZ>
|1wJm
C=3F
ToCharArray
q'8!KZ
x[ '
i|yo
`. y
e2z|[^
' 3U76
?X,^.
YNkP
vn?]
sDiu
B|i\
ZjglNfq4K
0%Mc
n^U+
+t"e
o;zV
RLik
tsA a
{I>]+
}9P:|r
s:a;B*s
jP(U
jCFs]
8c59
` H%v,
m%-/
spioC
SO|?e
1] O&
5dBH
rzU/
`fF!
a#hKG
Y5 K
XkXy
!C8c
In$B
I;RV~
FT#j
+U(B
f[G#A
Q D }CJ+4*
$YM#
J0P
wE .9
-JC8
p wz'&|
-]E0
w:*[qq
a]Z #
{S.s?e
KnH_K
x c{
Za[d
`m4
XNGZ
RE2X%
MmTj
vLj2A
%mJ3
dKG,
]1E1A
}Vke
)e|l
gtS[y
yrSF'
FZjX
a?a=o
A{)EX
XN(z
r|}X
i80t
R;~J!<
82:B
j !r
##3BG>
LDSx
r Ia
`'# ^1
oFe
~>\;1
VupY
tOc!t
&S}q
L>{i
d"QF
-XB-
IsNullOrEmpty
O Q(
Nkbl
l4HAJ
E [f28)vH(SK
Bco_
I(_YArt
.=}n
bgSB>
_@(k
Ow&3>-
qPm
1$].
#k{?
g\Qt!j
n.+
"Pf*
vJ :
O Q(`
KU0*
- Ip
!w7V
St\C
jj k
wnS S
b'YW
K m
k2}y
J/Y@
6DL1}:
A<JL
xR('
lamw
')6m4O
eiS sDe
zsqxu~
Dy3]
N 'M
lG +
M}/a
sS}b
t>i?d
8%pd
xq)
^kt3=
_SW u;
&9O#
+D0FD
NzVD
7V n
S'5
[] G
&rWgxM
` !X9
-t}M
0w9tS2s e
:<\l
@`;y
56`8
n5yq
AuCQl
8jd#
T :~
KPOt$*3
W|>Fd
'E^c
9h,giL
s9PJ
eErm{
` %o]
% I :3;
#trB
y)0{s<
wrU@
T^_m`
\'`NW
Fi^7
:3MA+
Yznt
KV %
o8IL
Ca`Fx
bytesWritten
VOX%
4Lm6
ljdc
t YEQ
MK,hh
ap='V
+5
aHe+_on
Lkz9
G%R|
T7WY
W c?~
($$_
!9xu0V
.e+bGr
l%^ce
H7.r
*~~Q_=
My.Computer
/$9i$
ewC J
el[F
I G}k]
v2.0.50727
k)hKJ
dn:t
Z \|B
[ x ]
{!vAh
/eT.
z"SR
`a'U
|tI!
B4#$
ipy h
Z=Njp7N
Q#Zv
aV[E
D1Dy
B+[W
\F+:
PS)OD
-_Lg
a6FXl
cE^u
}1TW
+_@N
GetEnumerator
SymmetricAlgorithm
@z?ylG
S^,A
VIdi/
s& T?r
)~.=
vYK4
^L]2(
hSB6Z
/"/'.;0Vc
D5HD
Dep
Csgj
3]OD
dDgb
:?|W
ea"W
5g)h
HZVoV
Y0&Q
=l3}O
_U=v
5je?S
HY,j
H7h{_
o%g:W
7`5i8
-B9
_rB'6
q)Cs
ztI#
pSL8
[~5+t
<H).
D""8
9 S [0}
Na-n
Cqo`
]GBEqu<V.
Y[b.og
LP#a
! y z
p@q!
"%lX
+kQq
( }V2O
<?|z?
HbOt^i
cM )
47qq+
__x-
:,`k
s<e3T#r
3ZwT
'aO:
45>$
<BnS
+o^[F
Ku.?,
a{/
1ozp{]
dHc#
<Gb
oZtZVOs
|csi
aw"'
^QFb
=Q'-
?-;?
'KV
$ Sm
a sOoWG.t6a
F(Ei
YUxO
R[O/
(d[\
K5jN
z2Z%
e e!tWM*n
k%1(m
-54R)A
Fq[i%
Exists
]+C
>d;NA:
hGl`S
y0=s
;Xj
q,".
X-]jJ
@p -P
ciCr
InternalGetProcAddressManual32
Nhaw
?$ip
VWst
a Y3/
I*+y
N#Mxv
F884
H:e]P
cEGHLO
_c 6[
Equals
k]@W
Ysz!hp
w0Y77
$%), *
i{a M
fwxX;`
H &B
VTxd85X
]xMO!w
x%8x<
3?&a
vb%q
qh1>
ComputeHash
NLFG
R _(M
j #
tIr`g
o Q4
C9SvW
W&&^
K6DrP2
FZl'
o#8#5;
~Q H
)Z<4
s"#`
t %(
A|^pnp
Ac_"
3|I*
4r4SF,
#T"?[
5fz^
y-VZj
[T'FG
& v.a~g
MQp/yLetGCt7i
W b&eBv
l*' m
9Et=
(zmB
<Q]
Va@
=o6hQr{SEs
8{X(r
Kw3
eG]NSJ
Dv:_
Ejj#
S*Gf~
9Ja1
u`+0
;JOB
+m{
mrL3
9wW"2 #
r&b"t.
Tg,vT
m AQM
[Qt]
6x o
p/h`
`Z!
Qf_pR
b=i K y!o[e
PI\N
;O?
<q4@c
: &|
d.6.
Z FqQV*
5x`{
u *hr
W) SR:
qb?E
Thread
0p34
b tuDYg
,x /c
nh n&
Release
r L>g
Y/O )nP
[.YL
u Bq|
=3< :
e:t%a',^P
>/G@?
0V z@/ D
'y _
k E+W
n_~ s
ofs!
"< ytC
q(A
/-:V
t$o5u
?PL4
fd%>*
'E@b
, ]z
eOQT:
#N76(
+5'C
a"e)d r
.Sv
siD4b
Q ~jz
W;F$1
j}a_
rbD
kH"a
rN }p
MyWebServices
>~j>=M
z5VH4
~}:am
)K8
:";&
6HeS
PtrToStringAnsi
:aN#
3]}P4!
;9mcU2
yP=x
>f ~}
9Y=om
ep+D&M
GcHtE,
U.i6
"K ;%
4RAi}
_S )
:"'3
sI6ULha
,nm.
j$-H
mglF
IjK@z
F( B
uRe`E
uRe`O
.;qu<
[z'iV>G
4V}i
qh?{@
((`~
rK
1}N)cp
BzzYf(
Dp%Vq
oQc}
9HbF
gv%&
%mL}
ciM(A
!&a
G n'
tNjne
n2.&(w
w]{m
7C<y
D_
*O#}
2W8Z
DK+r('Q
?cZ8
[gcB
GetInstance
6s(~D
a5k2
B*?g
'3?
j__Pl p
fs Jg
64Hz
h:U_
(NN&
ZI#K
\n#zP
BuF \
EH{L
:_%5
;~r` a}a
%@ d
i y?h
3}H^
/#yM"a
>%g$
Gc&
vpK=d=
aAw d
'w@2
Q @<i
.cctor
]rk@J
.2SY
Zx2Kp
a(n8s?i
6Vj%
: }r
)s&v
([C(L
'aGy
I}^M
>Vr
4!.V
Cu_>&
9Una
`veS
*w
yH.7
Q k(
CJR{
56&h,j~
>uQw1[
j^ t
Ce8H
}3()
6'@8
n|vkE
qu$
'\qH
?2D:P
0@zD\
2n5
;{qR
TR>E
XsDXp
,7z;W
5n]H
i`orp
KOHv
#%Ua
%uPi
v3|T
j %r
+jan
N*c,D
g)fmj
get_Computer
a@IT
U7JA
+*i\~9[
hVa|
MA//
H0'[
K/vY
}GdH
F>n
;tXkHU
b_WY#w
\MYl
Fmr$+ Yv
ggG">
2BJ9h
>}\t
W A+~
NL`g
>(2G'
j::4K
get_Application
FromBase64String
) a
q M%
;EZ~5t
6(P
^r#
niE)e u
X 4
,ck,\
t&b>l"t
{-,?K
m^z@:
>o V&s>b'e?t
sD]K
Lo j
e'a<ehE
u0.O
k1gI
+LbV`
3&/B
a0a{CPi
.U_H( Th
:q0y
;;6.
6hUs
<`8b-
s.PM}q"Y
"$RM
Q- B:
R8aH
eHJq
gIXs
@W )
o.h?
jDbd/6
g dh|bZ
wg#oI
rJ,=
ip]U0
A0"l
nm5Uf
%bj
u}Ee\
^+]W
J,Ey
fg5]|
!8`eMS
&nL6e
l<kZ`
ey q
+oZ]
!a=N
`L\~
v&r8n&e
y[v15
}9@|
\VY^
Wd&A`
<$oK
YE60
L:{qL
)00Oc
qi[k q1
>T<
I T6
X,=?Gs5
}Awp
>Lg
'hx[
%@Og*}
+Ma"
a u
^8ez
r$k$^H
isR"L
hk78
Convert
99oew4
g::F
Ice+
MyApplication
)eC+y
^!D9]|
3O {
d@Z?
I&qt
0}kZ8
S`L9
R2P-
cW8Wzm
*Fh6
gg}v
!z]2
.(_it
.@/m
`9*,B
HPYy
F0~@]
hX#Z}
p<,:
#?=2
!j][
kLnI
If;3
&ww9
*sAl
.ok(
Uc 7
U>c\,lG
khy5l
ho=nR6T
!6*
kK5n
qOL F$
~h:m
D$ki
eu5c
4z b"
|'Y.q
tS K
$x4y
)dC4
?mfj
WIn(
,Z\m
r #_5)`
"D Z]
>OQj
q1\,
#]]M
lqs:tHr
yNx7uy
_7[|
Q9lJ
2yt
_t6}
&J*/
:3r.(
Q-@~
)g!b
^d91
rb A
O* @
0Sq
mXzo
protect
1cUo
s4n"a9a,e
EBK-
Computer
_MVB
-~*r
.~pv
guTQk
UjfO
JVye
~ R&
E8D!
o-ss
oluP
WWUp
W 8$~
U=
uz@y
D>h7V
$p S/,
1QtCB
`: J}G
}+gb
yV01o
+_)U
l
G>%x
)w8yP
9CG.
D "=
GetBytes
|{1m@d
w;1a
+a?<
ToInt64
/: W(-
Fyj1
-Y{_
Fst8
#>k0
#\I
vo4
{NN
hufH9
8W 8
f[Pf
b=}3w
GetDelegateForFunctionPointer
dJ V
qlLV;
ODpS
Z1"6z'uP
sp"r
j&'OFE6
]\M?
Rh9-
hG<oI
} k+O
dCd
v"t
_rk
[-Lp
:>&$
a Yhbx
eK.-a
$3JC1
t 0(O
ae%2m
q=sZ
*fvC
`l%h{
?U0T
j 'r
Vtg$
id <C
gbX@
lB+eTi
%-BN
c= <
[O.2
aNttSRa
iv19M
oLu\
8t} X
STAThreadAttribute
[ 0Xh
6%Gt)Y
g$(6e
} I<O
KT A
SV:>
e2S r
+rSp
)^l|*
vo@K
vNY*
0DQD
-]/2?
6,k
T?+o
t1e\e
mQt{M]r
dwy
0RZq
za@a
t,)[q
p'mp
Qjys[
{| p
D'0X2)
3&T?
q.H;
MD524
\AQ}KJ
CreateInstance
0i`h
NO_8j
$WS:
Xr5oS
gctz
pM^@
(2?
System.Collections
o2U
+'L
AJhd
e tQM
+z~f
Environment
B,9@@i
p%;FVOz
/;KV"
^$vD
& Cn
$kS.
b0l1
]T(/
^Ed5N
Ll4V
@CL5sI
C~FYN
5m84
} j('
1 WZc
K!$wf]
+Qg.
A'$fO
; N V
u!V9
70}Q
Zj/
ThreadStaticAttribute
@Xlm
rJ upB5q
`Y*O
:hk1!
l3zI
h^?r
Activator
88~J~
vD&^
}_)L`8
Y; ?$
z}#$
7 ts]
]bn,
L f?
Export
B +I|
16dZ
FNi3
|bYW
T@`1
#{vs
H$O8
2'M/b
4oLo
n76$%
& l+f
P=*4
]hc|.
K03VD M
J$ZO`
dY0)
](Vl
W-"
(7Y%
#q 5
YHJ
mn)hdK
sAI U
e*n$h$t6o
Title
Urkn
"yJS
irAS
X;I)
Rt?p
x-+M
1&E"
n~o2
environment
ouc/\
WH.+
3 OL
p'5
sf5
5t{!
%?[B
0Ft{D
gwP\
}|+{
.ZrD&
> ,pnA
~r!G8B
sW:X
~C, 3
(kX]
(Va{
;kWSe(5
s*rd2KS
F;gzs/
l5iKr]
<v~dl
Guto
N9As
f'V5?h@$
)s=L
@c<5pfj
=:oq
?mh5
O H
9}*x
nXY
svif
'xF>
#Z'a
P 8,Kss
Z`P9
xT q?
JwDO
&,U(1
{VPbh)
WND.
mu
PVRp
i+F3
Y0CD
z{q4
3;lu
1uoS}w^
,^GFe
ZY6Va.
xMuD
<*|pQ
JPu
}pI O
oEo s]S
PzRHEd
R69 ^X
/*/W#e1S
ys0eEL
ZDJ+
x%2E
/X%J_
!.S= <
6z'YC
-" }hZt
],Io
B."C
ZM#q
}2j'
ReadByteArray
H=jS
}(UI
14a$
vR W
\TVC
w6d8
X@
6eT;
q9G?.3
%l[;
NGE ;
uF:X
yb@q,Xb
qGEETI
8Mz,
'u^t
w2,nxN
d(l=L
nU a
6 G{
}Bpk
F>tp
'(e4
J`,.
nVYgUV
# ;
Q] l
eG \ L
^S7
h z c
R{6nA
nim]
tp$(J
gL+h
{Aev
9xd<
uDDX@kS
jnx7z
cGcL
z1\0(
'B_ .
\?= q
U1x8
Av<O
ZS#~FC^H
WTM^
12_wm
name
)I#s
e tQW
Hh?<
y=R<7
+}D/
A.!>
(d8&5
^/lA""
KTYu
gw=R
p^'Lo
W cA~
?i=;Z
*1~cEg
hNuC
lmt}0
=i)[
bJe`D
H0n l
dRtI1
DHf`z
@ImA
DX
ThreadHandle
+oLll
Me9@
Nj,|
=UydC\+
M8?c
%HI3
7iRb
NONf
B'i?.
7l8g
;0s_c
_]`(
qee\
=g $
Start
W&r78J
]I
[hxj
`!Ftl
9!J#
4kBQ
f2 Q?
jyGT
i;e1i
ME7E
LX~o
wVFn
`3cr
J2:W|
hZj0
[7+I
P\ d7
~)y:=
l IuO
hO"
^]#Ib
lPGd8
["LK
13;a
\]&KH
GRl
(tXO
#}cHLc
Ik1e
@mu+w
E!_t7mB
svchost
| Aju
:4GM
W w
K@_+
1B,G
b ADu
v#]C9w
Qh}-
CM2A<
ijwxl
GD=@nA
s/ M
uv]8
nT8m
~ q(4
d {
Xyw{
7Vab
U!i4o/e~V6C>d
q+?[
T'\ w
0s>(
|3^Tw
_>[Nt
3w>#z
O|2B
)xKE^
@Nx|
r%I:O
ex|:
1;N[w
h&H d
aj@t,,
.J H
{f6x|2
%n{k
| l&
uZ|@
DY~$A
f9ZA
#]f9`H6v
f{Ny h
W_F48
Byte
X a0a
cQ5O C
@_*Bni
3i?
W9b+9`U6
A U,jr
MoveNext
0JfGwa0
jiz2
be/k_
h b8'
N[T>|Fp
2X\D
UnmanagedType
czE\
DH`V^
$r` <ps
/.iV+H
~p[pD
>b!.
'X*P
B_v*
nOS.s?e
@{]o
1#VJd]
c(2u
rt&b
'0qU/
PaPI)w
a e;e%sKS
W{DQ
^y6m
Yf*4
Oo r,qZw
VsmE
l<76KZ5
gw64
,J!B$
U|,d
FreeHGlobal
16 x
_WOj
_D/6
w&
.7a\*2
H?
hHhB
ScG
sH6=\m
t4d+o e4tDr
Se "
t&o9
apg0W
diMK
a 6{
Lc I1
dc;W
!s{~
nCug
AN#u1
N{BP
*x{O
P\6DA
5\e9
kH]
#[[V
f&[3
f`tE
|#x>
F K0~
[I.;
B+Q&8
ZD{w
o1fH
T}<
|93\
lo52$)
J@k>
~ '$ 5
-e+o3
9`{9
(pdpq
(Burqc3ZR
sOcND
Lw@|
-US|
S>Do
?93.e
R"S&
Tf]Y
qAZ;]
bLnR
#<#>
]iyE|
M d2lKE
5E-Rgr
pT8"
s={t
0eEH
2Ek!
ePF-
gQ:[
<>x [O5
|xBP
=_X6
mGR4s
:*g0'
s}t
KPX~q
]H'Q
(`wy
#c8
/VhW{
=^7Ca
<#EQ
|FFVa
"tMY$
%@>G
_t]+
Zym}
|[E],
39#d
Tcbz:
jF(o
:mx:
O+q]
}TT{
9>v'
^( !
TDV 1
B<Cx
jixF
6h DCx
F=Hj,
\ [+
" A/
,|2\
#4m>.
REU~
x0s]
E@R+
d0xC~
6iPr
Sandboxie Installer
r*s$
nBW n
[sW~SXj
_C#/5jA
hAp}
_StartWithWindows
{s/:
W$ua
cDC?w
p#R
K t+i
iF=4
ReadByte
-uZU
yJ^,|z
CreateProjectError
N[d!
\2LbPd7Z
~pAUQ
~
+)if
pDJ?
Ao;e
>pfr
qV:xP
YLO)
W/bc!n
5 &~
AllocHGlobal
ipD[
t6V0l
dT<
t SA
Ewa
KCy(a
`$Zx
,*x\
3x&y7
xw5i
]Hk>
v"IF
X~#\E
D s8r dip
tXS+O
ProjectData
" E
oq#}
rra48x
Ott8
yER" =L
+`q7
_%?.GQwc
pTsfZ
{++=
3GtS
!cC(
'&GX
l}Gg
ProcessModule
^b&|+
SkGE
{ZcS
Bx)=2
:w"%h-
YxP|1
H_VI
V:`R
cPN]\
#=@`
SU9
`Ht8
w;i e
%@?7Ft
>?j
s~z+t
$>j5~6
MD5CryptoServiceProvider
l#e4t"o
f@ o
|%,
Vd!8
+{8r|c
)%T# :
}23g;b
26Zg
~+R6
R6%3
)'&V!
. >Y
gMmh
+/ K
_ j }
Ry_m
O::x
aOQr&
FG~B
mTi{
!s n
uxI/
%|<
V.f8{
$s\
|$-&9
pX&*YN
kCk+z
.R 6E8
a+F>l.
T:] 5(4IM
fqiE
ItAv
l@dw
st~n)~ui
BrvE`
|t6p
euEHe
REt!S
Ps~
Sw 5
i1e~D l4g t C
g31D$UG
kSP
6xn4
*/wl>_
mGXV
L;e
x.w5
- ?{
4o t
oGd&i
SMqq
XF^,
N&a|j
^1Yq
[%-R
[$lvG
oNSOV
`P(Kp!
P6)m
6o^t
r.a e-e2r
j)W#Z
Yjm|$
B >k
)_w2
: !D
GbnH
B/(M
cSf.
G:T~
N5)"
KJ=L
c##Mn
4LLY^J
B;M`
op_Equality
2T@OQ
Y~;q'J
\;(]2
N>-52
W c5~
tIvr
;iw
?sV O
J`Gsr
uXRS
-9 I
=o M
LU8
Ew m
n C
.q1U
~b+9
6^X4H[
{r*s
f.
<DHC]k5
P%i&a y:c#e nig
( b8H=9
.~ Z
Zh|/
)*WzO
Aj*8
_ ?k
?n bG)
:h'BK
bufferSize
RN ;1t
[lH?j
B:P
`SG*
D}yG
uO9_
?=S3
:R{9
+Ohcy
{m`
8px%>_$
mbFf
^==B
Q;/
ProcessModuleCollection
e<S mKe
D `w
GB*[V
x{Z_
{$L&E
1=A)#
kCX\
?7b#
}/)q
=l I
~no!
t00z
q _+
aK([eA
!hBe
e!s>o%
T393KK
(Pi0
|,UJr$n
>|_(
&J Q
$m:
{4i'
.US}
9~:Q
Y%Y(
~I!
z\^;
LfW]
`B] s5 I
htmo;C
vm}C
9SvBu
y5.]
e4l\B
w!/'
U31m
BSJB
LyNV3
'`*X
%[V2
/Fl/t
skO%
a i+#
L9BI
GId 8
9c%%E
@ 8m
LFhi
' nf2
u G`
I=k[
Q: b
,3a_
*P0w
O _j
aWzU
F+0s
vKBtVJ)
.~E #
3Lc4X
N F;DXx5Ql
o5YB
ekUZ>#WX
C/_D
hhH&
s j A
ZgG>
6THj
lOi
x'o9t~I
DecryptText
r'e tsh
G[P
E:d
w?B
Yx Y
t6n@
Gk9
cQt{FUl
YvST
@a4$y5
VER{z
,:~
dW%s
z(D#(
$DP-
Of&(
I,/jE
tlEid0^
ok 7(
/y9A
"U,e
WQiD
KI@I$
166
k[|T
d\>C
:{st
w* .
>XQ3XQ
C_n eNt
4#0>
C26we
V]w\
7 dC
I+VH4l@r
1=4-YX
ipsob
`xS{
'r$c
ThreadId
4=P^e
GE v
RSP~
mgQ_
:+9,
JEv<
*nlA
"!RD
=M`4I
A{)[
l`39
NveM a
uK01
ofnb
G5lt
$2=@+f
/%a1
Z*E9
<>=%
wcm+
nTK`
*hby
zBm`
m]{/
8Q nV
?Rt/
*)=(
uX9F
1hp
P^Yn
.>e3.;e
baseAddress
A n;
0ODyIr`
{6bWo|.
7'k-
g2BR
:ksSL
Wv3:
=[I'
w~}
/4~#
i [(G
f[5z
Eo|.hL
iY2[
wuzTBz
E&u*l
0Iy=
1`7y
3i[)%
(ywT=`P
X %%I
82 n
`8UX
^f fRiU
*Gg/+
b(f6
fi `D
WriteAllBytes
}Aba
SMe+9
HT}%
{g}JvS
3*1.on
0LU ic
2H(,^
context
u eaA<s2m)l
%u p
j)bp
N\w8
JGH
+?#J
,P6]
M)1S )
To_Bytes
J
S],'/
gCZM
[EDW
T@1w
OHl e $
u/)Q
JE>
KBED
|Rpc-
_O <
#4Bh
[b|TkP
KTx,
+A8s
U(@
yN7e
3ruu
:24
!$(Rke
8Qv'
AGl{l
to nPo
XHYTY
JyqA
h.=P"#
?m9P
OsGE
Gux4DA
> p5
M51p
< #G
_z GopN}drtQZ
+Xx
=<}c
S*tU
j=Q@Wkn
-d"$
ON[Q
get_Unicode
u|,oi
.EU"
M]fn1
&@P
31D/
gE7W
+|!a
n&\%
bk."
Zfda
YWf;
n~eV
E
MyTemplate
"7Rli
HnSB^K`
4}^w
w_ f\
qb\8v
KNf
('
Q[w p
r ju
u4NF
!}!P'p:~
xC:E
>~~4@
Dc o
'bB 2
3[#{V
ndw
)&I
q\x~"|a|
H9{7v 6
c s(
SetValue
Wou
$5'jU
RIuw
!}h?
Q:zJc^/|
}[ j
D s2r
t1iBe
Ymdiq
4 e*1
? v[
YSxWKtH
(2SdF
)R40
_:@Y
G!g*
A8Rl&jWJPXR
String
dhS7
< e 7
My:>
B0f3
xt%BH
set_Key
.gT [
l ym
Z 'h
e.S?r
u~<;
b+47I
+E_>9
Q[d"N2
>#`v
M$Bo
! j +
'd[h
/FwFs
N-$T
/|7/
H?O
i y5h
l-`xs
i8v6
NG$|
1S M
Kr@:
-!nJ
*m K@
&)~V
8A.`~
$@ D
h#Hx
JR5[ eK
b_W2
{&f.
HO<*
euDUl
*)ML
S}}<[
mTS\
d|DA
O/b&G
=>FsUfy3
wX+2
_903
lw@cu
`3z#
Hiac
?Wak
Oe2/
4])8/
TQ]^
r vM
CurrentUser
AHk$
&2Oh
4(TJ
Z/Yb
;o,i
:] 7B
BeginInvoke
i (y
X.C.M.Q
RL~n
~wI4#
TDGKL|
ProcessId
Dispose__Instance__
1USF,
1 S~
ovp7
ma]8
<A
*pXf
4Q/$
ru_qQ;
UY$
0{ne
'*!=o P
6?,V
\Y5'
DWqy
RuntimeHelpers
d#=I
G t%r_c:dXr
ouFh
uT4_
1 oc
rUt
} ho
4 F;
m( >
L/'h
=Wp6
$hQU
$^+xb
.UpN
!{61
xk;A
1 }>
F_)PVF +
XI z
#+m~m C
Object
iW3L
mmy!
;*E
_/K%
M?uJ
-q F
Zh2?
x\LI
*>UE
*{Ao
Ytoq
get_Length
V;"W
n2e7_ig
r86
aIjy]
G.qhg
GY~1
6e] HX
f<l^G
*!*g
f~C]
h(/q
z7?-m
sGG4n r
)C:u
Vstp
Functions
'iR;6 E
SCH&t
~ wUn
4mETB8q
Y1 <-F
D<xP
+HD7
?vY}
)`bl
S/G~
QvF%
xK{"G
d}%FI
s|>v
x[pz
-%X1c
bq
!0 7 b
!= W
d)jZ
sJ?kei=
#qIr
?XMjK
apFs
v!tXF,
~'WYin
sY2
!R6i@
'W=
m>Zw
SJ:a [
L'2_
w5gl
cxri
s14f
R'=p
&'v{Nz
=0WTdG
9'b.
wdgG-;
27`0
L7Yg
b b e(
O.6.K
6]eY
$ +I
/V-OI7
5 Q_
)rlD
TripleDES
d2{T
&^+?
#4yY,B
2Ami
t.n4eKM
(y:K
: S;<
t& I\#
Txd/
1C#i
\HXx
,7a`h
:e}#@
u] A
ztw90p
\]Jb66{&#
eBTM
I Q
zYa<
#Ifn
:~Di
~@a_.pq
b$F@E
iJz}
N)7u
System.Threading
zMu^
;sD9Wj
/+c{$
r?>S
s4K y9a
0`UrOr
Y*D2Kiwg
UO w
AqL*E
)w?&r
{!m=
V__s
'pCc a
k<,/
9qe8
wv##
S?I&$
c?YP
s_$j
b | m
@=L"
Y^C+
tOX:
L6HoF2
;di|sh9
get_Current
G/DRY<
mQ" s
iOWuB_iOWuBQwhm
H(D
;ZUtg
fJ#z
@(:>
P2>'-G
IM4uqcly
]d,X
Z -l
$^SC
o4a?i
{:ZF4
='I5
At+u
k*\0U
S* ^%J
,*s0r
'dJD
,*s0z
tPDR
C; Q
<@:M
T+,'l
rg=O
mC.)n
nwe E^A0a
r=e9t
o ( b
X7PT
2w_/
g2<q}vF8
oT;q
RPCC)
M#<f
&02v5
_;pu
Q p69
*X6SY
II?S
c#g"
;\lk+
.2U}DC]w
i o3-~P
%1EO
)L/C
j?[ '
l{JDL
8-J
TargetObject
1Q)3
lWKn
H;t'C'i
`+hO
>t$j
+ =C
J,&JA
Lj?p
!'vJ-4@7
sx%OZ3
eqr aE
N\VD
(gu"
?cV?
eOG2t
GG8F
}h,l"1
^M]a
hAA
Fkr5
z\Z\
M)V|^
^uBa
oKe`F
j< .
& a:
Xx0t
[O@[)
-OZ(
' &>
j9b
o$p+o
We1A
GetTypeFromHandle
IAsyncResult
Gz<zG
5QDC
7M>V
!1,oqu
d,5]
#>}k
21L&
]I4B
hwZ/
uzVy
SHvp
` q{[
Z|q>N
oSk8oLytTIC
^{"0
Pj{d2
AR: |
RMl +
KF
`Bd k_V^d
TlC+B
,4WC
[ O2
#N y
7Z a
at ;
4V8m=
b bP
pbLb
^Tc4
Eg13
GetProcessById
-K>=
)q l3
nf_(
<bM)v
V/q%
oQ_#
Huco
;Qoe
System.Runtime.InteropServices
h;^%-oBwm
e@]*W
R'>~
n^E1
7 PNIM1g}WGT
S7("
OBuGi
)zw~
N+4H
UqG>Z:
"4z*XuJU
N[nI
,nB4
~ M{I
wQS"
System.Runtime.CompilerServices
<LnF
a#?h
P4o~
G\?~_ih
[w?U\
^w0:>5o_kH
WsFD
5%4g
N36i
k&V
=?Aq
} m O
FHp5
4 'p
r|mo
Xg WM
*W<J
_gX.
pjqq
4[qZ
O<%kP
:|KC
6 P0
7xR-U
"=W<
2W U
2_W%
Ytip
8EX8 '
I<T(
0czP>
$%>8Q
*]q *
c"W{l
d_)w
]VY)t*
('
s4Ma
)FwG
qI$q
nKt
l0IHr
IXyG
w3u8r
Nm FB
<z8h6g
hH(A
ZcEt
-z7s
gU D
yHPa_
$o k ?
U3i
_s9
I W)
C,u}D
qem0
i1Ty
{c)<
@ScX,
t m[SUc
XPx/
3;41
dQM t
+DJWK
t%a;aWS.t.r
`peo
s DOB#
E-w~
-RFH
RI9`
l*c#i$n~M
'"C|
CreateEncryptor
|^NmNkh
ady1
+2v1
7ncI
`5^F'
}VV
98\H
lbaS.
eU58X5
euOEt
e 3 1L
o:p*r
pmgA
m#".>
&e;T.p.F o
.QNb
f&n
<?JQ!x
v:RR
Nt(q]+
!b dg
e Ew
Q~?~
wJZo
FG#(
cmJi
B(I
L!&}
0@ 5
tic$r
](HW
9wo|/
2Mte
lA|
1.r9Tvl
#LiZq\
9f!4
Encoding
=aD|
= 1q
!} _sU3
EB|+
_LiH
//X}
K V<i
mh)$O
F2(
yrB Op%OA
m[9U
k$3-K>
s:D}u
_RC-
PaOt`
sl Q@]>
s Tfca
6fW<
!!0
2'a
vZ]z=E
E }|
y.$%
cPF:t
:n P
a \ F f
q[Tr
MW?]
eUf%
;U5(
5;zn
]peS
Zero
{\vd
t6M>d
rY}6
>`|T
qe2J?r
{"i8
HFl)
D)#q
E A>
SvVD(pa
V&>uP
uO2\T
<H;(o
D$2<
L<WTw
Qz[o
,sms
.~{;'
1ss rS
Dnn ${m
zO5
eI(m/
"KJ'
HOp\
S .^
[o -
gp^$
. J
e;3Ws?r~s
>?;7Pn
J|K8U^
4sBH
GC
C~MU
ks>L
+v;k
sY<
G $Km
&JKd
&c*C
aTe
<)S[
w brb
DD|6
w/;4
get_ModuleName
daR)ce8r8:e
-2{\v
t%JN
JN+d1
%Z(M
cUs{ALp
U,}=d
t*z0U
Qf?G
BG
.A6I
!3";)
q|^&L
*,{;
><%8
T Qk
StdInput
|LeM
hHib.
]}a 3
2:Ke(
Ae+x
=| n
Q60E
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05b_64 Seven05b_64 VirtualBox 2018-04-13 16:21:39 2018-04-13 16:24:28 169

9 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05b_64 Seven05b_64 VirtualBox 2018-04-13 16:21:39 2018-04-13 16:24:28 169

10 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\svchost.exe.config
C:\Users\Seven01\AppData\Local\Temp\svchost.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\svchost.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Users\Seven01\AppData\Local\Temp\svchost.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.INI
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\Globalization\it-it.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Important.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\svchost.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\svchost.resources\svchost.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\svchost.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\svchost.resources\svchost.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\ProgramData\Important.exe
C:\Windows\Globalization\it.nlp
C:\Users\Seven01\AppData\Local\Temp\it\svchost.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\svchost.resources\svchost.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\svchost.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\svchost.resources\svchost.resources.exe
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2428.20471968
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2428.20471968
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2428.20472015
C:\ProgramData\Mails.txt
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bcrypt.dll
C:\ProgramData\Browsers.txt
C:\Users\Seven01\AppData\Local\Temp\svchost_lng.ini
C:\Users\Seven01\AppData\Roaming\Mozilla\Profiles
C:\Users\Seven01\AppData\Roaming\Thunderbird\Profiles
C:\Program Files (x86)\Mozilla Thunderbird
C:\Users\Seven01\AppData\Local\Temp\svchost.cfg
C:\Users\Seven01\AppData\Local\Microsoft\Windows Mail\*.oeaccount
C:\Users\Seven01\AppData\Local\Microsoft\Windows Mail\account{31EC9AD6-5786-45DA-B15D-2E72FE116045}.oeaccount
C:\Users\Seven01\AppData\Local\Microsoft\Windows Mail\account{52DB1739-8CA0-4C99-9EE7-FE81B5E5749E}.oeaccount
C:\Users\Seven01\AppData\Local\Microsoft\Windows Mail\account{B6C15F72-0649-41DF-9EB7-057A27B89428}.oeaccount
C:\Users\Seven01\AppData\Local\Microsoft\Windows Mail\*.*
C:\Users\Seven01\AppData\Local\Microsoft\Windows Mail\Backup\*.oeaccount
C:\Users\Seven01\AppData\Local\Microsoft\Windows Mail\Backup\*.*
C:\Users\Seven01\AppData\Local\Microsoft\Windows Mail\Backup\new\*.oeaccount
C:\Users\Seven01\AppData\Local\Microsoft\Windows Mail\Backup\new\*.*
C:\Users\Seven01\AppData\Local\Microsoft\Windows Mail\Stationery\*.oeaccount
C:\Users\Seven01\AppData\Local\Microsoft\Windows Mail\Stationery\*.*
C:\Users\Seven01\AppData\Local\Microsoft\Windows Live Mail\*.oeaccount
C:\Users\Seven01\AppData\Local\Microsoft\Windows Live Mail\*.*
C:\Users\Seven01\AppData\Local\Temp\*.oeaccount
C:\Users\Seven01\AppData\Local\Temp\*.*
C:\Users\Seven01\AppData\Local\Temp\acrord32_sbx\*.oeaccount
C:\Users\Seven01\AppData\Local\Temp\acrord32_sbx\*.*
C:\Users\Seven01\AppData\Local\Temp\acrord32_sbx\Cookies\*.oeaccount
C:\Users\Seven01\AppData\Local\Temp\acrord32_sbx\Cookies\*.*
C:\Users\Seven01\AppData\Local\Temp\acrord32_sbx\History\*.oeaccount
C:\Users\Seven01\AppData\Local\Temp\acrord32_sbx\History\*.*
C:\Users\Seven01\AppData\Local\Temp\acrord32_sbx\History\History.IE5\*.oeaccount
C:\Users\Seven01\AppData\Local\Temp\acrord32_sbx\History\History.IE5\*.*
C:\Users\Seven01\AppData\Local\Temp\acrord32_sbx\Temporary Internet Files\*.oeaccount
C:\Users\Seven01\AppData\Local\Temp\acrord32_sbx\Temporary Internet Files\*.*
C:\Users\Seven01\AppData\Local\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\*.oeaccount
C:\Users\Seven01\AppData\Local\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\*.*
C:\Users\Seven01\AppData\Local\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\4DXYBRDC\*.oeaccount
C:\Users\Seven01\AppData\Local\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\4DXYBRDC\*.*
C:\Users\Seven01\AppData\Local\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\K0BMY8DM\*.oeaccount
C:\Users\Seven01\AppData\Local\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\K0BMY8DM\*.*
C:\Users\Seven01\AppData\Local\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\NSXL8QLO\*.oeaccount
C:\Users\Seven01\AppData\Local\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\NSXL8QLO\*.*
C:\Users\Seven01\AppData\Local\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\PAJSDO3I\*.oeaccount
C:\Users\Seven01\AppData\Local\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\PAJSDO3I\*.*
C:\Users\Seven01\AppData\Local\Temp\hsperfdata_Seven01\*.oeaccount
C:\Users\Seven01\AppData\Local\Temp\hsperfdata_Seven01\*.*
C:\Users\Seven01\AppData\Local\Temp\Low\*.oeaccount
C:\Users\Seven01\AppData\Local\Temp\Low\*.*
C:\Users\Seven01\AppData\Local\Temp\Microsoft Visual C++ 2010  x64 Redistributable Setup_10.0.40219\*.oeaccount
C:\Users\Seven01\AppData\Local\Temp\Microsoft Visual C++ 2010  x64 Redistributable Setup_10.0.40219\*.*
C:\Users\Seven01\AppData\Local\Temp\Microsoft Visual C++ 2010  x86 Redistributable Setup_10.0.40219\*.oeaccount
C:\Users\Seven01\AppData\Local\Temp\Microsoft Visual C++ 2010  x86 Redistributable Setup_10.0.40219\*.*
C:\Users\Seven01\AppData\Local\Temp\outlook logging\*.oeaccount
C:\Users\Seven01\AppData\Local\Temp\outlook logging\*.*
C:\Users\Seven01\AppData\Local\Temp\VBE\*.oeaccount
C:\Users\Seven01\AppData\Local\Temp\VBE\*.*
C:\Users\Seven01\AppData\Local\Temp\WPDNSE\*.oeaccount
C:\Users\Seven01\AppData\Local\Temp\WPDNSE\*.*

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\svchost.exe.config
C:\Users\Seven01\AppData\Local\Temp\svchost.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\ProgramData\Mails.txt
C:\Users\Seven01\AppData\Local\Temp\svchost.cfg
C:\Users\Seven01\AppData\Local\Microsoft\Windows Mail\account{31EC9AD6-5786-45DA-B15D-2E72FE116045}.oeaccount
C:\Users\Seven01\AppData\Local\Microsoft\Windows Mail\account{52DB1739-8CA0-4C99-9EE7-FE81B5E5749E}.oeaccount
C:\Users\Seven01\AppData\Local\Microsoft\Windows Mail\account{B6C15F72-0649-41DF-9EB7-057A27B89428}.oeaccount

Write Files

C:\ProgramData\Important.exe
C:\ProgramData\Mails.txt

Delete Files

C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2428.20471968
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2428.20471968
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2428.20472015

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\500757a9\4a7e07a8
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.8.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Web__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Classes\AppID\svchost.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE\AppCompat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\DefaultAccessPermission
HKEY_CURRENT_USER\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledProcesses\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\91B5C73A
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledSessions\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\2c6a1ec0\656d0fee
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|svchost.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|svchost.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|svchost.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\2c6a1ec0\37e98b8a
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\2291d2ec3b3048d1a6f86c2c4591b7e0
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_CURRENT_USER\Software\Qualcomm\Eudora\CommandLine
HKEY_LOCAL_MACHINE\Software\Classes\Software\Qualcomm\Eudora\CommandLine\current
HKEY_LOCAL_MACHINE\Software\Mozilla\Mozilla Thunderbird
HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
HKEY_CURRENT_USER\Software\Google\Google Desktop\Mailboxes
HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts
HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
HKEY_CURRENT_USER\Identities
HKEY_CURRENT_USER\Identities\{141B4688-D8D4-4AD1-B583-99828374C040}
HKEY_CURRENT_USER\Identities\{141B4688-D8D4-4AD1-B583-99828374C040}\Username
HKEY_CURRENT_USER\Identities\{141B4688-D8D4-4AD1-B583-99828374C040}\Software\Microsoft\Internet Account Manager\Accounts
HKEY_CURRENT_USER\Identities\{141B4688-D8D4-4AD1-B583-99828374C040}\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\00471e98b7a362469ed97e3915fd4111
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\10b0e4d6eb1de34dabd532a0806a0fec
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\192e64c97bf3a54488a039619c763627
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\32a3dc9c400a4b448b60ab7fe553a392
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3517490d76624c419a828607e2a54604
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\43e0bb79f0f2d84db98ff4f730d23d24
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\6a50d9bd87f9a8478751861a1591a6c2
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\7760e21103136b47946c9c80fa097f15
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\7d19c9e894f20d4780a31c9a9f17da11
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\818ecc2f310b344f807e8af5dc013189
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001\POP3 User
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001\IMAP User
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001\HTTP User
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001\SMTP User
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\POP3 User
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\IMAP User
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\HTTP User
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\SMTP User
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003\POP3 User
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003\IMAP User
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003\HTTP User
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003\SMTP User
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E}
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\Calendar Summary
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\Calendar Summary\POP3 User
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\Calendar Summary\IMAP User
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\Calendar Summary\HTTP User
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\Calendar Summary\SMTP User
HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles
HKEY_CURRENT_USER\Software\IncrediMail\Identities
HKEY_LOCAL_MACHINE\Software\IncrediMail\Identities
HKEY_LOCAL_MACHINE\Software\Group Mail
HKEY_CURRENT_USER\Software\Microsoft\MSNMessenger
HKEY_CURRENT_USER\Software\Microsoft\MessengerService
HKEY_CURRENT_USER\Software\Yahoo\Pager
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL
HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\DefaultAccessPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\91B5C73A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\2291d2ec3b3048d1a6f86c2c4591b7e0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_CURRENT_USER\Identities\{141B4688-D8D4-4AD1-B583-99828374C040}\Username
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001\POP3 User
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001\IMAP User
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001\HTTP User
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001\SMTP User
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\POP3 User
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\IMAP User
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\HTTP User
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\SMTP User
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003\POP3 User
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003\IMAP User
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003\HTTP User
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003\SMTP User
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\Calendar Summary\POP3 User
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\Calendar Summary\IMAP User
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\Calendar Summary\HTTP User
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\Calendar Summary\SMTP User

Write Keys

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\2291d2ec3b3048d1a6f86c2c4591b7e0

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
uxtheme.dll.ThemeInitApiHook
kernel32.dll.QueryActCtxW
ole32.dll.CoGetContextToken
kernel32.dll.GetVersionExW
kernel32.dll.GetFullPathNameW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.SwitchToThread
ole32.dll.CoWaitForMultipleHandles
sechost.dll.LookupAccountNameLocalW
advapi32.dll.LookupAccountSidW
sechost.dll.LookupAccountSidLocalW
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptGenRandom
ole32.dll.NdrOleInitializeExtension
ole32.dll.CoGetClassObject
ole32.dll.CoGetMarshalSizeMax
ole32.dll.CoMarshalInterface
ole32.dll.CoUnmarshalInterface
ole32.dll.StringFromIID
ole32.dll.CoGetPSClsid
ole32.dll.CoTaskMemAlloc
ole32.dll.CoTaskMemFree
ole32.dll.CoCreateInstance
ole32.dll.CoReleaseMarshalData
ole32.dll.DcomChannelSetHResult
rpcrtremote.dll.I_RpcExtInitializeExtensionPoint
kernel32.dll.GetUserDefaultUILanguage
shfolder.dll.SHGetFolderPathW
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.CreateFileW
kernel32.dll.CloseHandle
kernel32.dll.GetFileType
kernel32.dll.GetFileSize
kernel32.dll.ReadFile
kernel32.dll.WriteFile
advapi32.dll.RegSetValueExW
ole32.dll.CoUninitialize
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
kernel32.dll.GetCurrentProcess
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
mscoree.dll.ND_RU1
mscoreei.dll.ND_RU1
kernel32.dll.LocalAlloc
kernel32.dll.lstrlenA
kernel32.dll.RtlMoveMemory
kernel32.dll.LocalFree
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
cryptsp.dll.CryptReleaseContext
advapi32.dll.EventUnregister
cryptsp.dll.CryptCreateHash
bcrypt.dll.BCryptGetFipsAlgorithmMode
cryptsp.dll.CryptHashData
cryptsp.dll.CryptGetHashParam
cryptsp.dll.CryptDestroyHash
comctl32.dll.InitCommonControlsEx
shell32.dll.SHGetSpecialFolderPathA
pstorec.dll.PStoreCreateInstance
crypt32.dll.CryptUnprotectData
advapi32.dll.CredReadA
advapi32.dll.CredFree
advapi32.dll.CredDeleteA
advapi32.dll.CredEnumerateA
advapi32.dll.CredEnumerateW

Execute Commands

"C:\Users\Seven01\AppData\Local\Temp\svchost.exe"
"C:\Users\Seven01\AppData\Local\Temp\svchost.exe" /stext C:\ProgramData\Mails.txt
"C:\Users\Seven01\AppData\Local\Temp\svchost.exe" /stext C:\ProgramData\Browsers.txt

Started Services

Nothing to display

Created Services

Nothing to display

#infosec #automation

TheSystem Itself @ 2018-04-13 16:24:15

Detected family: #Razy

TheSystem Itself @ 2018-04-13 16:42:02