MalScore
100/100
MalFamily
Malicious

controler.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 16/68 Related 2056
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 512.00 KB (524288 bytes)
Compile time: 2017-05-08 04:58:59
MD5: bf0731cba56e2d3af4ae63b12f2d9751
SHA1: f4a30842217aff81bea206bc0d67f2a0da372822
SHA256: 737e776c74f1d3e18004abe3763b466e766020a8ed39ede2ad6a2f5c7469019f
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 5 P;j{E .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-02-15 11:39:04
Last submission: 2018-02-15 11:39:04
Filename detected: - controler.exe (1)
URL file hosting
hXXp://prosciuttiamo.it/ice/controler.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-02-15 05:41:18 [16/68] VirusTotal
PE Sections 4 suspicious
Name VAddress VSize Size MD5 SHA1
P;j{E 0x2000 0xddf0 56832 3b60a64791fbad99dfd5b9fc9b0965af c119d39e5275a72a3554654baaf53f8f87660121
.text 0x10000 0x3dcd0 253440 dfc5c8cd9138296df99b250298f879df 435ef06c278bd2b8fa43f21f4b22638ad6464a61
.rsrc 0x4e000 0x33a48 211968 4878be14bbdbfffed7765f61a83198c6 c621d0e91997603cd024649717eb119c022ee68f
.reloc 0x82000 0xc 512 4e4a67c1ffad72c688ad19cfcdc4fd13 d14eeb3fb7574ba336983085b070684b350f4b1d
0x84000 0x10 512 da8c3884b98792b6bef8967fcff539d0 68e0303f596b209249acb6097527889af6738d8b
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x4e130 209740 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x8147c 20 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_VERSION 0x81490 968 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_MANIFEST 0x81858 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: Copyright \xa9 2017 Duke Energy Corp
Assembly Version: 0.0.0.0
InternalName: controler.exe
FileVersion: 6.8.19.2
CompanyName: Duke Energy Corp
Comments: ibadaqayubowigar
ProductName: cobas TaqScreen West Nile Virus Test
ProductVersion: 6.8.19.2
FileDescription: cobas TaqScreen West Nile Virus Test
Translation: 0x0000 0x04b0
OriginalFilename: controler.exe
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
No packers found for this file
File found
FIle type: Library
KERNEL32.dll
mscoree.dll
IP Found
6.8.19.2
URL(s)
No URL found
Assembly Version
43522aed-b20f-e142
VarFileInfo
FileDescription
Comments
43522aed-b20f-e111
43522aed-b20f-e110
43522aed-b20f-e113
43522aed-b20f-e112
43522aed-b20f-e115
43522aed-b20f-e114
43522aed-b20f-e117
43522aed-b20f-e116
43522aed-b20f-e119
43522aed-b20f-e118
43522aed-b20f-e131
43522aed-b20f-e130
43522aed-b20f-e132
43522aed-b20f-e136
43522aed-b20f-e135
43522aed-b20f-e134
cobas TaqScreen West Nile Virus Test
InternalName
2017 Duke Energy Corp
b6779bec-615a-cc
43522aed-b20f-e137
FileVersion
43522aed-b20f-e16
Copyright
43522aed-b20f-e143
VS_VERSION_INFO
OriginalFilename
StringFileInfo
000004b0
Translation
6.8.19.2
#"-,0/32425262
0.0.0.0
43522aed-b20f-e11
43522aed-b20f-e10
43522aed-b20f-e13
43522aed-b20f-e12
43522aed-b20f-e15
43522aed-b20f-e14
43522aed-b20f-e17
%q^
43522aed-b20f-e19
43522aed-b20f-e18
43522aed-b20f-e124
43522aed-b20f-e125
43522aed-b20f-e126
43522aed-b20f-e127
43522aed-b20f-e120
43522aed-b20f-e121
43522aed-b20f-e122
43522aed-b20f-e123
43522aed-b20f-e144
43522aed-b20f-e145
43522aed-b20f-e128
43522aed-b20f-e129
43522aed-b20f-e140
43522aed-b20f-e141
LegalCopyright
controler.exe
CompanyName
43522aed-b20f-e139
ProductName
Duke Energy Corp
43522aed-b20f-e138
ibadaqayubowigar
43522aed-b20f-e133
ProductVersion
P pV
Sydu!x
ohyK0;vkNR[i^kk|B*#0b#M=
%1xkd
E-=x
Cm87
!I0v
T5y0
R>`4
!@H>
N\^&i
Int32
PoRr
>Vz_=T
^yUX
H_Cw
2KwL
:NIV
:9Q=
-B7k
81+I
_)kO
ObjectHandle
uu$$#
KmwK
l_sg
`gD!|?S}8Pt>7_CK[q6kBc1*(
Z~R>
q\jz
^ o
_<xW
phz
6)|U
V~w
@,[b$D
ResolveEventHandler
@7'O
>0egI
H? n
\^Jh
q. Q
`Mw!=O@""Q8JJJMeZhz)XG5_0
u;VN
ruWq
2H0P<x
/e5D
;*nc
s%=>
scm(R@e_#sTVb|^J)6:CSv0U$
W%6=L
Kr: b
0xUj
-T(%6Uf
6\Nt
Kgh8
qc'O
*H%9
B..
KmET
RbCL
NYYs
$ jZq
9sdZf
U4qN
y `])
gf9ns
{[&1
NwG
+xGR
FHWvSL%
n 6cC
2E"I
y>M/i
#5.
GS:n_K%nU~8PI$_%2yB/XWu=6
CjG5
3(rNp?<b:se|dMsQ&%!s^T]A#
^aXX
y"p;
Version
/ZEERxqbKgijA{{\pOFN, %_$
gE Q
@3Gq
(}jL+2=9; KklWMnH/CSMC7f"
+0xx\<
w;glU#2BPK7O#PRCqD@%?N9_#
X (+
p;eY
0fiO
u'r$W
set_EnabledCalc
/P]C"
\c/Wv!u(v=!uh79SaYX1wBwX)
;;B
b zu0
$gE0+
d 8(
T%`~gh
4f}?
\7_<Bh <8\h\/@<F#4?Yt35P&
PNG
AssemblyTitleAttribute
pOvG
0&033_
N0GX
*X`}
? VL
Q,e8
y^d4
6(0X
v YWX
ControlStyles
jM4:h
Marshal
}T}f
~@&dn,C
|c6&
wV'Z
*?_u
/ g/1C
?K/
Z*5$
x*Hog
AsyncCallback
NKb ,
cvg9
=j $O
B2wD
~ v"<{
y05"5!
!<(
v]55POg
UYOL
uv~K
K%*qx>?60]U4>is{JY*K-K5O%
G!%m
/=gP
op_Explicit
RuntimeFieldHandle
pMtd
@"1
=nX2
]re'cN
}IDAThC
320E
#PB8yU
S^'N:
~,#!nLn]NYr"T?5W1|Fpny/-"
L[
t $D:
0B-K
3tN@
!@3+
a@NU
zI&rb
<w[T
smcDI
;lsXp
m0MqCe
I:m{Z
a/Ws
Rbwx
Hy>$T
ZXJX*J
{D!
EndInvoke
qCuqjA
e(9[a
0A=ba'hT3=:cpjMOpT*Y8&+g#
)7QKE
++ 9e
te2/
TVu
3_%'
[=2j
V$Qg
w-NM
BG4m
.L.!
Np
!rzJ
wImh
&~~R
E~$8
r&l3s.
)(+M{
~ RZ
Nylk
YH(($~6
1/ON
5>8
v"lR^
`}}k
ol*.2
,)KI
FR4 bHZ
p|C
xUjg
v;bJ
[c8#I*
V+!gC
set_Alignment
AWZw
AssemblyCompanyAttribute
UL#.
G76 n
{w'L8
uhii
8(A
fWb6[
/,)K
I]!CBv
x(`.P
%7 ~:
3+GQz
47{1
bk3$
k0U2D
F@jp\u
9 HL=P
*27W
:+V
'daX
%0%J<c
E9]wu
j8O_Pd
~#Ndu
c0*]LV
WH[C
:h!( Y
Y9cm
B}s:
-} mb
7u!M
Enumerable
eV%$
>-$d
~m~p
c++
0&N7
AppDomain
ui(x
\f)v
>/)fx
X2z s
az8d$
a zJ
get_CurrentDomain
&z<p0
Jov=Q
{- +
=\ ;
r88:
#n9'
BHBWf
m(hV
C O$He(D8
"{6%>C4n'81FCz)631K?FR@)'
p:EF
so"K
2R u
c2=6
$!HtV
e*Sh5
e~Ao
OWa>B
VOE:
lx0!B
F:&y`RbP<K+xGlE,-WR"qJ!T%
x1G|68
%V5[
aZ'b
A{Rm
R7 %
nC}x7
32C*
y*'{
?ZS*_
ty<q
_j"
V$+K
s"%d
ZD(]t}
AssemblyTrademarkAttribute
_B'\
<g?FQ
LC<)
]H(p
?WZD
U 4-
I[ZXh
`U4
g-Ra]G
1 h`
1rR#
&,I^
xZ[?t
G:(P
q<c2
0RXT
w]B g
GR,/
g9^eb
KJ\_
H1B%
,LA8
#9?M(
B|Fs
0)Cg
~"js
m *K
p5L:/
P/-D]
?>6+Y4";^C/LejK--=s2&[3!+
U0)
#Blob
Control
g5Yj
9VVK,
GetFunctionPointerForDelegate
d{Lc
s2fr. f4g
ZD+k
YxG,
(XNNk-&_$,3ZJ?YyH1{q|&[V%
M6_t
]ifSXH
dk!
fur/p
\-v
kH 4
#_m,&TTwJgF94R=]=djvQoFn#
kgQn
`F0?
4P3F
2J+wm
&Sfg
`jw4
AS #
<A2? +
aZMy
l<$p
EJ!!E"/`H=b(g}}u;V4mpt`F"
re:b3qX
BindingFlags
YdQX}B{T+)&lhZd}"-Ok)&nj
]^dc
qc
Type
ad P
4V 9V+?
y%N
^&'gg3P
mh 61Y
~"ZYo
\o#
bwr-
@O<E
(l-n<
wGK;-=
5-x?
fU9S
,L1y7
l" @
d9i~
} X
L!$~
N9=4
9+Lj
ZcQ1\
!.#&'
Bx;$V^f
|{CE
d?Ly
S4eGAS6
RL 'b
Cursor
=ng?e
Pp[H]
Kx Pu
4^
UZ}0O
Uxnq
r :.
Hu!T$$
a$+ZM`
!g|o
, d_
#d i
#fH0?L=[-HJwr?taWG0~sIb$!
2ygT
f Li3xpB
Char
V7L
@tG!
2o`[
2~Ia
M2{s
N0nY
d\lO
c~'oV=
\z{xE
SyKg
I )at
);)Lf
?JQhP
H3jMB
dZ lW
#m8T
GetValue
}NoZ
Cvof
/TEv
hE1.Kg
MLF
W^FKWz-7"i,2'^-&!((39S,<%
Ha(R>]>hjCh7Q02V&Lkhh}9P"
8 q1
@-RW/1u+#E#GT}C#?q\1%/Sq&
get_X
get_Y
eT"^
'1#X'
=/ X
`i:es)BU{zx-_T[P/phj{2r2
rRc-zy
.~U(.
rcCAI
}hNH
&n[P
dA_=`
:nRo) 8
Xs.JK
VirtualProtectEx
xQAE
get_FullyQualifiedName
= < < < < < < < < < < < < < < <
eF.?
*1DXd
$ 3x
93;&S D
b@tK
DK"l
^[Lg
Oz0(&V'7TQsXoXEPPn+^4Y!2%
1GwF#
twwLL
1JmkI0i(YuLhI~iZx]'7% W`"
[wgJ9
t40x
;jnM
2iN{
?n4K
t%M
k"O]
E;Yf
=v_~
sPR^#?>m!i u+b0ebZP*ukc6$
nQQ$^
0U=_
iZH~
2}i@
_u6+{
61lz
;.<Zl
rm 504
;V
a*BH
9L&<+by
J`vk
+R"Y
qfFj
}. _
pf*)8
qH..
{K5N
s6X$
.text
\nkT
`TcD
WBM@<
:G%<
;k7
"cVI
GetString
yN>UF
$S>Lj1?0|7<s*G\g?u"Ha{C;"
y9gS9
OU='Cc
#ae
PnQJ
)?
5R 0
$jFE
r0l:R
's&b
'm/.
h-Fsp
t(!!
%@ :
if_\Mef,C6_[%+9x7oo4Ta@)
?z8^
:%;PI]m(\KDbDoStq%,KN3+`!
\C98
6=x'
6( }Q:
object
}#b<
Y!qg
PsSl5o
i*'j
R4gt
J 47
C&TZ
y{E
p @A
8go r
FBA07=,MNS52"IPrV|,#Re0J#
E7Z
_`vb
T&N}4ci
Y:c|J
d4*D
>xb:l
3Xh)
G6v7
VW6"
d'V3
_EO
ca{~r
e0@`
H <2
Z= ,
T{pT
Y:#>
QND~cR7
fdJr4z20
p}a~%
UWtAR;kQ}fq &^G^F>o!8)4m#
$n+Vc1
3 _@
7GyN
e+#
i>%u
rCCh
`$+#
.hXm
L<zE
&TVl
Pb@*aB
/Z/d
f~H@i
~2I)
I}8!/A9VZz'G%p$[ x47G226%
<^7y
:zl:3
ePHAE*RtwPghHJ##>T?$=U9\"
G( Y/ 8o I ^J)y'PnjH`4Iu!
0~!(
hYZ
)/=O
vw$f
1wg[79
N{g1
s)qm
:YchuL#ff ]Z^V@3{&0nF%xV
-G}D
p^M1
UM5.Q
DSHus0
x[n=Y}
*rwt
1nA o;
T1@|
]fST
SW?x
^4f]11
MD;'
- %qTV
X>Jf
? 9Tw!
V_~c
wt9D
(`p2BM#
&D[O
K nsF
4yF\
Lj Nh
M?[
#Ge"
xr+jVa
4M@*
)AgkF?Md `Xo~9lqYaaT3ej#
28DJ
e$x:
'{*2
#Nw%T(`
3^5_
M S
e- I
F.'?
8%E
get_Default
<lz(y
i)7hE
Y [ }U
B%N:
&`G-3
-O "
ytA_
78:
kernel32.dll
B` &
3GK,jj4*vL%#]Ep7z^CWS+<+"
result
6bx
gO>%3?~@YiMHs"v]ec+WWltf"
Qv+t
wxFj
o|WI
77YV
hq#
4\^}
bI .
T%Sk
waKx
z?L~
;e0
@k_,
qjT;ri
C+;`
&_@d
3c2f
f{gG
oNo1t
1Ek\K
$ZCG[/`
3jL:
{KX|]
+),{
?0dxR
@[C4
7 tv
)2f
gqbb
_`twH
,$1{
s+8~-7
u\q"
T{R]*A
e_t
W{71"3
QGAMS
7, .
=O<b
FVPj0
0o!
8{g\
,D5i2r
sQ'}'
W:nY
)*A[%%ew &j0}c)J( \8{PXM%
3;L\
IT<_
x>4L
~}V&
>z1Kp
L7;r
j4sLH
}a,}
c'Ld]e!PtM=8Z|h2#6l!7T'f#
?CoC
nseR
i[naY
)^mX33wKvzs3,UcjdV?md!}7$
`#d Z
4i }
n<N}-
DE&2O
rK5$B
3"W>
/J<s
+yq[3=!GLLz]*+e>z%"@xe* %
{z5(
P8t9
S]E@hBxIr))y/nq>,d`ls\d\%
3+%
]*:v
MouseEventArgs
yr5qs
Q=\[8JGV&3Sh{J9[tm=0{o10
nDRc
6fRA
G6UR
XMV"X
+cb
xG'f
zoBT<G
iR\*u
U( 3c
rs)
*=Q4
CzSB+
_D6H
QU:!
ZjQ
vvy~)
Y2C|
FN N
)qSy
|v ,
k5F[9]
+PZt
|oPJR
KpZ/
(
!|EF:=vQ
=!2":ldCNtQ>G:"W4?hql=?M"
+@Qg
FjFUO
Ens\;$M{%B7WDxy^Bo\iVe)g
[( >
L-7Mz
W}JG
'Q3Mj~SDDA<:RWpY]Iy+',Q]#
|:TIIS_9k9 {6-8O9H-FM<!I,
u7Vg
9>zg
Sztw J
w(~r
_&6O;
L7pn
Bo&`
Bp B
f|)w
LhyU<
OmFk
?QMa
QMg
@py;E
v|LG
XJX*V
/XS2yS
jG4 ^f!re&wXH[j`I:G}_f;q"
6-S8
Mts$l
`ZFt
$YPOo
1CoT
L>%
Write
91&m
a{$`y
OnMouseMove
3;yg>
D"^iI3D/CH**jT8y/Kf~]R'3-
|fM.
C<oe
h['q
F DO`
S'm8 Z
get_Assembly
*vU?
W`3{
<( <
UEw<
jm|T%n
-gz2>m
(F([K
4iLI
R@ Wy&
B~m5
|v[|<3N'379>Z42kVxb-1nZx%
O\ &u"*;)$2Zm-i":1S"dVKa"
k C#
v+r<
|B d3Z
6'|xc
Cuuz)
i[W)
"A7SGg`"F7*]5<VZ'En)@;6/
*57
,l-7
i 5&
S,+pp
JmsY
\\ o
56ig
*jdZ
ca *
MMH<
6F?
b xn"
_]b(Q$p&IY(@=%-HzO_Q/TKR!
! M=
System.Reflection
<"c3V
=>fW
HC}%
$x!Dm
o;D!tDb${sGTBIQiC7G(YQGa"
System.IO
0,RZ
WrapNonExceptionThrows
AL7$
#W 6cF
Qgzb
~[\[I
8a5v
it^1
Y$.Q
Z.Cd
fD
~ZX,
ze4:
zeo>+?/FHoIOEJ200Ch_9Q8y%
Console
o&xj
px`M
wv>hrA
7GBa
)0@%
vUNRr
j4CC
",/O
NL!4w
WUoL
N#49
GMK%
T^e~M"
)M_n
d1yK
D+NW
_a2wI
hu4r
hnX.9
siL~|
C'!i
_zK
]=e$G
XUnIm
$o<-
i`EM
a#D2
)`h0
0U2M
< }h(.
!s;(
;n?\K
Fyh9@
\q*M
B L'9
04Mo
\~v 8
*F
yI|D
IHDR
xVa6#
|:?o
System.ServiceProcess
n d>
AuQ
TKlg.|
_{Wq
xSdt
nxgv6
@J!$
yN}`Y
!"IBr!1w@~HaA/2}bv`n*cXX"
8 n|
M`2S
~VJ1o
+Et%
u{]D
W;a0A
, M21
i<&6
PsAq
U?%E
jciH
g*I g
lt}p
IBPo;p
aJri
h6j3
x`oY
v%zp
Oz S
R=l>r
6T\zw$Dy'8};,_"SC9=>hHJo%
w!R0{
xU1
xwd-
NL{KALC8~W]Mj:B"3#82t4,t#
~hb~
"%=#tO"m8-s*m~?#t)c YYA7"
t$<x%gFKv
6c1[e,
XU Y5
:)dfV
System
EventArgs
kQt,@
i9mI
PI^
I-dJ_
jyCg
Ny,,
od`
_5Bp
^n7@
d]Q5Sx
1JBFw
o_dC
oQxi
)a$cU
`A+Sq
1mK8
j|^P|
2ggj
;%&9
''U(i"_^
87ic
(5 J
rK@Miui~G]GK\f"x%0tU=hc1"
[ Gh
3BFt8
X<j\q?7ze(v&ORJG0-FmD$##0
H^>I
CreateInstance
Ybw/
5,;g>Up
5AEK
KK.
58$`
RM%
>Z^!mk
^)&
MethodBase
#Strings
ti{*7n&
og ~
System.Collections
B?;_
#]/q
`'5.
Z2j
MHT>
-m!i
G ~T G
4l<:
Rp_aYe
a)82
9,1<}
Vf7Z*
$ fD
Environment
get_EnabledCalc
WCc.(O
ZXJX*V
5,P
VirtualProtect
vV1)V
HiJd\Gb=2zjVg)F3fj"5,l}U#
["t(
Qyh 'D
yV%
A LY
yM/n65Cc"&5S _r5bv!Ss&cP
5=-F
0xl\
7u|F
]RI1
\!X
H0;\9W)24xa>0V[zoaTQHh3t'
sxN:]
AV;47JoUL#&@CEP4EoUv@LB[+
C(KT%)Q
CPk]
GBi4
w,k|{
get_EntryPoint
gU-(
PBjpi
&OU1g9qFgqo?d,]8h4({I/5<#
a iFL
@9WF
vw8m9hZg=s1-!Hn#)<4Syga="
J _7tUV
<{% Y
HwwH
Fn^t
+g<>
({BeZ
@@Vp]
5]*V
v F)
HHwI
W:{Z+ ^)?bK1V 2J_k~i LD!%
VI6N
ZxXv
T{Ij
A66
n46&
8NqtP
,6 K
G7{v
Spd_
`G\X
!B `
+B9=
GetType
J{$
\U <
O H&
_JeU
9[-k'
add_AssemblyResolve
'c:xgx
@H1C
IDAThC
D85j
qhSdC
~FFS
BQQz
j4]f
g(WT|
~]9ji
2O-1
w&r7
:X75
=/e
QI3&og
set_OverIndex
5"S<
};+|
wat<!
8e>K
$#;)
S~'}
Iu0 w
/Qn
TN=e
{(Uu*
dr T
>+-KG
{OpXW
" 4
XEl
e zD
TabControl
ILK1
IoXY
yg`D1;NT:b%I,XK~^z)ZFt`i%
m]4M<r
5 .7
|LSs
e3)^ c
9/ ,u
T q$
vDnv2
lbiG
AD73dbLB3J?:%wL6DZ]9AgNp%
&JGljT704i1RW:-/?G lo|lx#
<63/
jZokt
X]A&
:1F
yh@dc
Qr#c
7'ASJ
Mt$)
2L Us
|N/
[o8`
0 #
Fe{}
Color
p$2$
] 7Z
cjj@
Intern
g \P$X
c2y
XVC ~
YL9C)
)p =
l*^jqZr
s /r
,A d]
J(u~
set_BackColor
s9q6!
kI:Pc
{)i
/J#[d
sf.]e
|)`l
1l=G_
Jz R\N?B"zj?>mhc[k'}F[L+&
get_UTF8
DNLY
&SF}
$ *F
get_Width
7W.v
s-9h
*E~L
gOR8P
1Ih_
<@ ^
ZX {`
(6\
Z D{8J
+<6v
wIUEQ}*(
<'U
%6[B
tg(x
get_Revision
>=<K
h ?F>
5nI)}~R8LiYWD{yu4zij-Lq\"
9Yo3xV
UU89Ox0
=7Z
2BzS
guN(
]{?2
~ _!
h7h|
w_cVzp
<oP&%
}!h*
f*/"
!KHjXZ,ruvr`v J8D,Q#(Je)"
mYzF
<uNww7c'&
*E~3
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD
5y?=*
>"uH
E .e
in)`
FdBC
Oy46OF 9dlv:5 Ej3yFau%rW#
hTZb
.FG]%G
W# _
=eyG
r,?X
I&l2\
/Wm_
.@{]
u{~4C<
/SMv
Wc!D
*]7%
+4;%`
[! hlMo
2'v@
/D&'X
"i U
G<z
%P2g
kbes+
bdJ rLp`]*l[_Z^!mT")WF_s#
>_`{
vW2@
Hw#
/zaLi*
ag,mz
7?)C|
f"@9<Nni
9GF\
+G.u
`rc+HwB7\A2f]_kciQ9I2^P "
P|7f
koGdi
U6!#
N #c
o]^n6b
dk'U
>r,~v
GvECL-Hx`3XvG?}n*qeE3~!;
-IBD2&ItU?\MQz[]ZZe3~(CR$
-wQ7
BOFi
@qq@
zQs/W(*n=:}3A>/H|^K}1V-|!
Sh7v_
TRJZ
2LkS
System.Core
15Tpiy`nY)=I?uze2dcGN[f?$
y3J=
:m!V!no
7yY:
G5Xg
.#h|+
|Vrq
WVt)
q [
jY~1?={pZ0-B\VN;!;}_q34Q"
T:=Y
m$fx
p}Kr
Delegate
ddU5
( EW
`pF{
:k-<
M0}&aB
qB<98*
xQw$ 2
-A^
?l$Gj
#L+lAO
8Bdg
3^a
tTNi
li&SGZh
6L(:6s
]@28
%rdj
mm ]u
7;I@
P~a[
mdNiv!
]FxSWCqX
YPw*@<f16%FdQ\-5&@3NHH,K&
qg=b
t HwI3BZJZRR
gz_Dr
}^'<
_(fvX
`o9[{
;xHq
WaCD
e !
|bz8
SO"Q
ModuleHandle
XHbz
x Y<
II!_
Z@*h]
b\ I
|rLvEf
Du/CL
e i(
"D$s
:ACG
di+C
t0K:
{IDAThC
-wjX
"7&f9
,_Ts
:;N~2O}Fd;NBVeXkTNZt5%]^'
j> _
>_@]UU
aS7p
^MUp
T*^
RPfp^n
&]+q
].nA
xbrueK0
& =:$$F
c *V~$(I9<'l}'+u}7TlW,?;#
"X@:
ucQjY7
g;: 9
F#Xq
I H:
PW 5
set_DoubleBuffered
b*"K
W2YQ~iV
get_Length
m&dr
}^]z{
'{^~
0)[s
^MUX
B;my
S[,c!1
mL(,f
MB*Y<GmxN/EzK;"5TMeeMWH[$
*2QO
o{:v
`MYb
|}SnM5 /
={Z~
8X@5
mpaK
5`6!
4w&7
(K_s;CcVln|WE~Eh:2{6tqQV"
z5B#
Clh
Contains
HM~K
0"k[$
b0Ql
K,o6L
222
w6l\Hu+Sx0lX @Syi0]!xlEC
@Of|
hY~
q7+;sxVDyz~j\nCAuKZeq\ps
bmKU
1Y$6
(>ZS3q
gxs(
4Y~m_
4;*8
/OI
&}*5
~q}]S.c
Sf4X
|&2dT
ValueType
]'f
JTu*
GuidAttribute
^~:.
<>Iu
E&MX0O^`?L"k%O/NB'sB$)MZ-
3.4N
2&eVT4
mCEc
Q*L,
U9?
-$ec
|I `
Xu|Ce
b^`[
;5xY
g" I
vYU$
5-#8
h;8_.
A[pR{
M>q8
pEq}
-F9=
j{i
get_Count
JXL$"kdhqjk)[DF2GEOtgb:'%
Mr'T+
Bz}@
OEC/l6[
Ke6.$
D`Gn
H\i\nohuh
.j'4
C8_h<W\+`"?>2H9{kz3kX#Hg!
!FKj|
System.Runtime.Remoting
sDZ[7>
Q}AI
@A ZF
(:}]u
&ww GH
;{p_
2$^x
G|3
QYB7r
`:#r
\:GaV
W,*5
![<S
IEquatable`1
8e^(
GetField
A#X'
'B =
= k
*b`
cY8Q*
4 9nL
Xs2T
`7,A
G=O{
[ #
N`o5
}TE;sx>s
63k$l|I#
>lXxSz7+~YHQ3qz]4Y!6)!{P$
l%v\
[jrKU
aTvP
SmwK
N6OaU&
?>Ey
@F"ma Mx
qWC]
t$$"z -
zh0
jJ*U/GVW;`8b_{8F";iU_A:W
UInt32
X,,|AHPH
lc-@]
8;<J
Ka8/*i~
sp}Q
:NVc(,
get_Version
Kn\\
I l]
$Q!V
$bmC
ToString
btAQO
Ui^H
V.mT
V`qQ
wdvF
_l=mNvs2f9O?;t%V`j&~Bj}<!
~%TO
hBBl_
O;E5
/M6Sq
fqb~eg
0/>g
`2Hl
|##B
o mL
Cursors
1qF6If!T]"NgGU~3L6gq(vs_
Mnba
<l-R
HX[ ,
Glu+
@a|X
Wz-w
uBJF2
)5?~
2Nrl
WL$k7s7G)$~@V#w@|C0F)P\1$
>m!#
XDin
V{0]
ServiceBase
<Qhp8
V&Y5
[EkV
SG?<1Im;Nd50S~q(^/#c~*l3,
9h <or
xu-4
(nah
r'm8
3/n<
VCGfW
1j^)
r=YT
\&?Sd!
$zG}
77FAB
Bdg@S
nQhx
)DU
;\re
W45( O
fc/G
]_/$
ky!S
clMI
?as}
$pHr
M/6A
% 2 > G S j y
JsV%
HjEk[O-]m>+mha<r$Q94o$91!
!RC@C
{$hww
7"u>K/
Ew9k
ZSW |
=Xw[#Uu+' DsVGU1&5W8Rj9W!
zfX!
Q~H}7
:X8>eZ.
?`.f
W f#
\!o45O
([X|
F#{Q
u^C7@G]8V=LIB")<sOr?R*E[$
scfO0
XRKBS
Twv
4)H mZ
d/:#qr
1@ZFHw
_mjj
(Z?O
h+ R
m97g$i
r* $>
|NuT
6FP [U
n`y6g
b|=r"3OaE1 Nr="lJIcI0we"#
#, E
%<eBW
vOcy
@D#u;
%!bK
r[^1O/"E\qu^0 cBr/abPphr"
)#G'PUF8zF?P~\#tHF;vh^, &
_\jw
.' A
6?n
< tz
H9nq`
vX%L
<]-,
`b$Cm
J3}D
k@p4m
Wjfu
bp/>
^Y`J
#Kg
^OMJ=G
Data
XP&3Y>\$n
KMs
jXjH
bZd t
*\+e
9M@
Enabled
`:oi
koTF
ey>
LlAq3wH!6a@U^,JU*mNG~fMd"
e?Sy
B%Qy
ZD'w
gK(~6=f_
~>4
PID =
get_Height
41PmT
k@{f
b2"
d_ XcoI
`wu{
pHYs
.ctor
~Wn,
HQ4`
]Q H2p
get_SelectedIndex
rsx@J
5,"5
get_Message
Container
XUn8ug
? +VOE
?Gok
Ap'1
vwJ
/hML
-?Q=|E5zo6R!F/dm9T WghFW
+E"_#
N}<I'
Main
8w|=
U qzw
U.2
vQg:&
ILRb
S1^ nz
Invoke
#+R ]I
-"(
NVPET
y?o#mh
7MVpqiWHw2OCKEDg'VLmh3@x'
#0P9O
\PpN3"U
ZXJX*
9Sbj
t}3
cd%(}
Tc D
hw|\=
yD!2c<
y%br<z
buq1E
)Eo5g
Fw2 %}N
(20p
Wmny
f?I.
$\ds
RilQ
Bk c
X]xY
0fDup`
Nga\
~#Wph}
H1k9?2Jt\KsM;:grXzAgs+2f!
s\04P
n Ee/
*8;]x iNNq$P\hb(Hm|eZKO|'
7cj"
To/ d#
8Knu
sYrdO;L
}Q;z
M~[T
XIG/w?
Cv w
g=o1i8SXzVEfHqnpNwL/jC9)
r:$M
K,X6);`4
Module
5]&
nzFv
U#YK
Q\fkh
0A:!
_,ub
Array
[ [D
HFY1
D!E.U)w
PHI2
5:%E^S}
>.] =
hf4%
F3Ky
[5)
hK:,
aBME`
j!:
Z!RXumCb*!s>'*MDY{!evimh
~R
K*4W
wV@l
@.reloc
V>G
y ^,l
Ke;\
aPe#
9k:>
7z05
|}sj
meP~
W>S
>wmF
7rB
MMn;[*lI
U0`
Y.&n>
Y,F[
m;dJ>hMP#G[^|=xfBr}l|IxH
Lnq!
W#M(]J
=1LD16+PO})T% !mo5kIGvZ!!
0EX'^
7Bt!M
TIHcb1vFx(P<CP?Gk+KN;eBz
a{{/W
/J?E|;^iNY>'CSKs v&c<Z"[#
%;:w%Ioy-&Pj"}_J:S_^#= p$
TabSizeMode
szJ!
-5F H
Byte
get_Chars
lhslR
l&2
6 #
9x2.
hjY
5Ji
ga, `
'nQJ
3G7r
_:L?
k]$E
/o}F
L|?>A
s+mG
rmn<9T
[Rxny6erKHR2oE](l/K$93O/$
-H &?v
BlBr$
xhYef
MU~}
AUo=
Vlxb
wwo~
pvC%
PJf(
;d(i_"
4-Sm
WqCbV}C]#VM,t|`~tT7R2T3+"
hLfS
0)j;
Q[A:
r]/F
set_Font
R0Yg
LoKa}%
=vb"
9v @;r
+EGr4
v266\66F
;SKB
}_
wP o
NeFP
6`f
xJ oe
KW\
nq{7}9>h
vyORxA
ZP U
F5"-
get_Location
d8Ny
9a%0
q07s
gldA
\36y
Z.5d'
1>sn
efS'
!]z9
2Dxn
t<'Z&e
'<,b
=Q<+
MprXX
f'VH
u8l>
%^`S
T<.o
QA#H
FreeHGlobal
Swt
:Jl0
S= h
*Er* {o
Q{C6$f6b9~qMzFs3i"4(z "
VNb#,?a
b|Ui
>[$u
ylL*
~,6~
x)7-
8 13
nxD
;u/]
y0uB`SB<>o|3nE \RF,*J&~7(
9;oj
kf]f+
|5aT
Uo>Zm
p)D]
WLY~
;^wz
z20}Ixvl<ex$LNMJ%uPbT"m#,
7k6R
&]Q7
Ipc'
f?pbJ,D'Zg#*{<LH?'aWaNZZ)
M5`'-
>0{hun
i76{
z}'I7
UNBqN
&.%C;
tnN+<
RuntimeCompatibilityAttribute
]D^8q
(Iat7
"! J7C
}Lu-?
*28lt
UV#D{
`Jvs
+R(+
V[rr
X 9~&
%K75
dn>8
Assembly
FIKbLOg
n"M=
E)m3
%'qT
a9x6
Jc(~0GoPd/%K_xCSQ^0zvO/q%
o(L0
YUA%
b6ok
4n=6
0UH
mri^
!T0F
q1+p
r" ~
Os'2
( E8
-ryvC
W_,e1
q,Cx!B'B+#6DUIi\a-%iK=Kf"
E=_"_-g WY*M%v`{S{5C$2^X$
!)9|}
bv9K
S8|,
Qa P
U9O
CfrFm
`0lL
0d\~!\uV]omu\8Skp<+&StX-"
.,ip
S =%
Invalidate
3I][u
u~Sr
2U#z[<K
_7,r**&XfUV_{t+ wG[G&%O-$
>f=-
'Ii}
(DZ>
S9-
K|GL
Bo"Y
;L:Y
r|b1
Size
tR6Q
ut40
-(yRdh
E-)(^1XrIKjt*+c4f}j7x{Z7"
wzl+a$<
jW~9VN[jG
NewGuid
2T\/m
I K
e,~:YG
FD>~
.WE#
set_AutoScaleMode
QqN6y=Qy\iUk9djlFRE\tm=5$
^yvYP
d?Q*3t"
2Ty:
C5U>O
G4n=
VjYx
|*T7"
qJ`la
ctI8
AaTz
yGMZ/q"Mih_Hnw_@ 7|8DYMF!
TR m
N P i
B4]hjD/NJ :98#,O**i6'N0\(
S3Bb
q&rur
T=E$Y@ 0
,%:>
y{.b5
"QhvC
5v:q
")@
Qc0|
mvY_ K4mp~v
`{Xd
M[&N
* [b
eL(y
kiE
7tM|
[ O#
oV,,S
IContainer
F)M 6
,)MRp5v|uC{o(K\I||vUf:M !
?c{k
\ r+!
CA8v
:ip8
p4Z3
k* 1
hBY9
)):+
I/9p
3Aks
^rP
"x#O
\b,
,* b
te8VY
kZS~
M;'w
ke$;
k }m
?G;
MT[1
@{$<,}D
g labQ
0sE0QI:
$k98
ISerializable
&Vt3
D:X`n
FQnE
Axn2Cn
$1c
x4=g*
n n*K
9:f/
; X W=
1{JK
Z(1
J)01u
z{ZJl`
:$V@
s}W"G @
@^@Aw
_uZW
F9Cij
5P%i
*omY
=vC+
G=A
$TZKhg;
c8C,sqJj[]%>b\E8hr9(OLrg!
Nn2
t;w7
qY9-r^
`{rw(
1=W)
9!E#L
1]0f@
{PlW
4,"r
P" D
IBrHi
get_OverIndex
IZ O
{cJ|
DUqW
klhF
=w|Ms
MCpZTn$s+x$)?V}$D|,tW>)3$
TM+;
}$V;
,!J51
<$+ 6
VYFg
&Ui i
B&-
LC[%
#8?
^uXe6aLFH}gu9^imjZxaug=q!
_!r4]$
3cv}j
mcSH
LHUoQ&'pE5"y3&S]h"KwSE:D"
euN|
t3Lw3
vV#GY]
NZb-
Ti|` %
{WQn
nNBh
yVGS
ContainerControl
sV{z&JT)%hAFcDz 1Af,/pOu#
MmM&batbgtg\ONSY%"OF|cvQ"
29|[
QN9!
.[a%}
kEhtU
f8\dq
1#@wj!
8@G%
4,KH
$N I
-`?8
FVC
V!c\-OJE\-Fwi([MS~vCaw>/
QiRe07C/
DD^U"
~(a0
ReadByte
S2_
NEY]\
< Hn
\EmW
bc"I
7(gGL
u#[MY6
.wyR
<BM4Q*5_$A0At12dD7m:oK\\&
|L3*
yjy(
4 zj
7}1R
3F1764884A245F1B3FA91DEC2E25339F23787561
C2}oo
S:-f
Kg]9
FxvN
KWq^
kJnlR
TkRaM
zXG1
)\Kou
Plp4
-3fr6"p*'he8z6fZk@,dR]!["
s"^+
wqrmk
94\#
/OA@
AllocHGlobal
z "aQ;X4r3kJgjG0J61pY3L[+
AssemblyCopyrightAttribute
F\Q
O #X
$QkX[
,L!Q
F r6
_]pU
I%C-
f8!}
kRyE
Y~~oi
$ H8
dScBZ
x&/} y1Cm3]O=!zE'RCE_aD!'
pSq#
Rc_t
n d~
09`sq
X+TR
?40q;
+XegZ
-`6^<t
Qb/j^
L`62PO9NL:LB'$$1)@8Kf'p]+
+:0y&
Ish^(9_bp)!@6gZ;GLYe*#4 (
lR?>S=
8M19
bzD\
u2Q@_
e$(u
b?d"
Z&`|6
(b4y7
LRXX
t'<W
$j$7%
^{`s
{?f
%lF<7
r91s
}8Y\
80x"
ifE:
}-]6
JGra
'kh_
^[)*
2ce;
_OxCl
(2i2
vv5FG
Xy-f@,
$-W ?
b;
Fw-~6
5$ O
Z(W1y@"
2CT@f
s~ue
<_#Q4V
Q#.;
;{G(
j~TP
/+:v
n WK]V8
9z5!r
=n)4 Y
_8xOe
pj*~
6=3y
5l C
ShU{
#5@_ P
J[yZ
ControlEventArgs
995
4z8a<
@J+^
EeHFn
K1X6Q!?
x.#;q
ddT3m
"a;5%c6v]C<>V39QE:2W_lN;#
:U2]DmWr v>/A=E52=tW[W-l'
BSJB
set_Enabled
~l7d|hg}j:P#1_w=T%/K*6FK
Jf}
u~ &
w^ h
sMa
WwPl
8H8l
)E w
]TW{
Read
'>q
Ladi
^^`r
j{ e
WrNKg5
SI!$
7 I:
>.|E
;SK_
nZX&mh3Nvm$K\#Q-3M_xF6?q$
+|+eZ2^B
{b$,
`|aB
tj2B%
$-O&
0OU(#pJR
get_Value
wQ{I=
$rr,
^q\z
_VAm0
f6]d
oA$>1
FT'O#4x8C0z[ogJ#}<XY~Z5#
'{vt
8DT
DN9
sZ,t
OzvG&"
,z-#
Jt~`
f^\'
UZ5Q6k
jZ9l
@F]F
\~l"5Mv
N|.4
gAMA
SH4F
"F$O5
z,*;
\F=K$`{BLo}Y_wQC]ABj]WZw&
tJUq$
gW[W0
v^Mt"sm
UYB>0h
. O#
&_K$
jk1+
Km~L
AutoScaleMode
JNc`+l
zka
H$/G
LPx>
MarshalByRefObject
wE '
vSim
;%>Y
mz);|l`zhoj6B-:BlBW=bGZ'"
Io/G?k
-{ S
=+qJ
hs^
.cctor
}Up
n}
=Dl)O
98@s
b-N<?)
Z<9^SZE:T'!M{ Vuzc`k[+B,(
+3Zi
:%-=
mscorlib
K%9m~MbDkouN|^5INM7kuR;:"
)SxB0
:Sr;-
SBsw
54N+
76N=n
_ IT
(Sw Xe
7U}\j
(q..
2{fK
} n`F6
kjw"
g +
fq7y
QPaT
#YC9
gyh!
p|c=
Wz=>1
3O=v
45Dh
#*wm
\GNfY
){]K
EXeNTw[
4hf0W'FpZ?]>01eURJ]#BmA;!
get_TabPages
r8ju
$"&89(
afK&?o
=Is0/
`(.Ni
PfNR
%-&2jZ^
js:wq+6
Z8 ~
Guid
-^g|
-K#S
|$}`
Gkv$
i!pv
:r4q _+
})y FM05
G8sl
v7uW
b#gg
>ukY
&a`; B>*;g|Cd3K6[1z:P41S$
CVW"1l<
m>zc
T.NB
Cc|U
s|za
y S.M
6PrHw
1B@(=
"bp+
ig~ah
(9Gj
2dyj
G1fS;^"fc#4Giz}edd-beF0T!
O$<,6:_DW1b^1@~xqwTy@#ka!
` 7
~%jg7
w@ilX
E&e0
{-LIC]rI=px7JJpo<j!<HQ'0"
RuntimeTypeHandle
J:s`
913
#{4}
*8-}
"y }
s=XqD
o}0h
;3>'
yDY6
Huj
%$zE
!! pC
51f8h
kHF
Lo2r
{2TO
8,Ln !{
|LWY
M@[&*m
sender
}I5 +Zl
BHmm
"sww
}uf)
~V_
T 6
t0WmL
UF`S
^K$v
Lki;r&c,'6yXp%>2QW}9m3J?%
NK 3
gzyP=
Append
]/SS"uF0
4hB^
m9_j
]H{4
1m\7
vEVe
w76h7
;=0zSOugsdaN_~IB1L:F!hn##
0iGM
}9v)5N
op_Equality
i{#.B
J 2p
t%gG
Pq5}
+~'2hOS)5%!?-(T9":bk?Y=uB
AjH>Q
Fw U
FW3
r?YhB~[Zm- 5DB3rv*19V^8*!
*v4*
6'Fhw
.E"[
+%&eTG
>s@BS
eEo%^:>C nJ7C*o {`q9!A$,
.,o"
\jg6cMEK/Ix*o"jx1W*aNJT{#
CHLAOQ
i@|j
*+0"
E)0w
8zEyo
1vY0M
T*`!=6{c_!l1sI]l-X_DZy?e$
+^.Kcx
AssemblyDescriptionAttribute
O@b`
`V*=G:
h"o
ydME
' Uw
6H8]
_G9}o
xrvb
2 kLBb
xA=]s<a29g\AH6tAbZh~!DQ(#
RMQ3
p^g}
aCfM
^.|z
{.1_
TJH[
zKh!I;D<aP*D^hh15yfXh]he
hFxe
HNsE
NKx7hbJ_&%nsN>pVZw)JTLZ1
0kWF
{x}D
>W0/e6VQBEgY9q{NXv]"CQ_J$
*|@B1[;
a;3i8!a
sht&G
>c$u
^F&vO
E }j
p17vs.Li
/r;W
V6-U
I5_?
U2#^6
v i)
Un7{
9}KK
p{88
@5U
mq!&,`(]L3x/@iJv#$Imus|,!
o1DWJ
ovZy~*V211Rn_b_\"KX#xy96$
f=]dE
Q~.E
Z(B
r#ny}.
P3VB
qtw3ytM3
>$Ad
xJ?f
jyd<
eJ$I
Sh5zDFYbn=n9a*}f)/$$g+-L*
Y0EE
P'[n
2&ca\
l2aT&
KlLy<O
46/
Rf ;
^dx<
N G-
kja[v
85:
EqD
^5z'
CXBP
#X?w
U5Mp
4 UN0-
?^/Ff9-T8/c\{;i:N1Tn67';
SZ_r
]F !H
QK!G
m0eH p
0&.|
<LRK
>`'ed
3J=PE`/
q:;l
IpeA
W%]Y
mscoree.dll
!This program cannot be run in DOS mode. $
callback
~>xk
BoC^P
ClLy
By\X
^xp4Z
Q3Q*J*B
CqE"# 2
S7W2
fK5LE
b& 3nh
?>NY4
Zj"uN(
Dispose
mNU\*
cC\R
84v:
#P\3
jF6
=( Rq
> Q \uO
"bVP
h#OI9
rd)1@
[FU*
]?Vm
4E2BE99140D24066CADC84F74FA899FEE5976B68
',B5
J+Hj
e,"">
ICloneable
=GPw
4@7G
* ^8P
lfP"?6DFhZ+807fk"gga'}Gg'
]RD]
P*nuvZ$4Z{5z0IgmA#C%2)IH,
a +
sNVH
01VXP
GVE!
lBq.
\{Td
BF6G
2|1
eGJ%
-n@i
gw]1k
1?(M
r`_
t3G9
QXLgAK
2W?'*
_dGm$
=urEtLPpdW9+K9\6_BY!>sRX'
S#s.
i&!8
R]~Y6
B+@q
YhXv
KC%.
rkhW?
/1_<T
qO ~
(}|5
_:X]w
B"j<
G@b8
@OdN
}Uwj7
zIDAThC
T5t4
DU+m
BFsi
O'nz<*vuro~d#ZZuv&##Ya ("
Xf(Z
H |q
?j8xi
dt<u=X)/9_AJRh/pFD0c{E?|"
<qa^Tp[
;!?!
C7?w$
8Y>I
59YenK
[lcX
s&<
?^U"ke
b5k
P$'.+
^#(GY
R({p
53}w
Ulv6t`I4^+)~c*|PeSf`C|D:"
=N|=
Et4x
Z>wR
2&-<Qr
0I \x
?uRq
iW[u
r :=
!-dkt
Q*Zk\N
*v2F^#+,3CF66&B3f]a2b|8L%
jI6I-
B]L m
Qn\Ot@
"GQm
get_ModuleHandle
uN k
LG- *
rj/3
w#+jWA>Njwj1Xt}\gouQv!j$"
`} G
hD!-7
}ZLKY0 U
h\ &
"?@CEds
v_P5
JoAK
S>=d
uFN$b3
Q^IK
!Z OU;
IntPtr
/X:i
zi04zAPVNxzjo)kC%!>JO%3#0
;'[i
R")]
0}[]
Kv[Zga{`
S}XI
3EDg
;+U
,ck(
AB[D63QY@Kw&Q}%%`{^yW2,w'
pBss
>^URB
=N)9
iYQK
r_`8*A#
Zl9 q|
TSBm
1m/TCV
E][xr
{JK9]bT~nBCQ(Z"N2!*iD7Es+
BtK]
AkZ+s
|C9/c
p]Z)
z@@=r5
oT~n
a?W(
PVz:
\K7>"
mlmi
System.Linq
E0 |
a8-FF{T
[kOT
C708234F139063BBE3CBE2208BB6ACFACBC50333
! E
( $h
't
]^;{
0r1RW
|H7p
F@=%
\U z
/*;*
R< \K
3oE6
RJ0'R5
}N`h
E.7v
H-`v
X*2p
y\#xj
z*B
oEb|
262%
9+K<
rnQ^@
+8&J:m
S #hl
AssemblyConfigurationAttribute
"FL
uWY$
ab1:
oWCJ
U/ms</0I!u!W6|,m4NGi9XY4*
&De~
GW|:I
%+P,E
',X.
LKqE
mS$32w
m+ W
T|s)o
a`.\B
:} r
?* > rv
.yYE
BlockCopy
2CF-
G;9=@:x
|(6{
wLk=
F&Z
nO+RdR
,X.2{[
s A=
V?{L
c;#B`!YyS_4/A+8h#j3K{+ -&
={mNF:
bbrz
]['WD
7*Gpq
n` <
qy_h4|
a)`<
atO'h'*
(&F0@
&eq
R i)
C"m0
Wa E
gQ^Q
6x9R
B6y^t
Tkv+
o Fs
?_0
E8[::
W\J'
bo3?
aC<W
{,m
ztY#M8pdS4"=~&{7_ ;]F:6}&
O\ t*
v)Ek3
[@p &
x{+/=VO?:ffSjP{pM=/{Y%*D%
y|25hU
&&^.f
j#]z fy3
CYV*L
~lE3
x7 L
CE4LU
uzi0
.IO0
-I(S
2(G vtO
v+te
|p\?z
^k25 I\
V1'B_
Abt
j(s!
% hy-
R2LI4
S|U!
4,w
2G'>
+gU;L
Q"%
ec=Y~R?
&CC8
3q3+
`sY6zw
8/Q2<
ya.@
5F[a
\<b
MethodInfo
[I],Mu
<MkW}
'~Mh)HQ~gGm%1N`~$GXiXSOn'
PDDX
)!Vx6
iYTg
D5f
Y,{9:Z{l3[uv`2xzE*y)J'>)"
CompilationRelaxationsAttribute
m3!.
9l1 cq/
>cP`%
TabPageCollection
GHXaGI]
su a
8'F{
>tF66
TDz^PBB*Iky\QfhV{[dHIc[-"
MemoryStream
^n95L
ekq{
$^)4;ge
!4v;CjE
Z\tR
ResolveEventArgs
/X+,
Ie~?c}
U$0q
[HEW
j *u_
2nc|
W5t4
&NTz
5sL9
]+QN
`t]r?J
OrV,I
o[-%
OnControlAdded
>lizv%1@*T:%(JfNqBi=ek;s!
^zls
Z^ss
=|P/
mU!~
N"k3E
-[&n>@cv0V3/Nley2(>)o?j;(
6:*#
yNc
V`4;d
p$`:
mcJ.
bL>K(
+uHw
$@+6$
"eg~
oHID
mQ'Hc
b>Azm
+'Wr
LcYT='
0c4f74cd-e41c-12.Resources.resources
u6g0
xP3uF84
*N4qc
}?\?{
YIZXH
dH*6`Z6Ny%fg5B=cgM/Fw7+<"
v$i_
F.8R
b(fS
gKy
IEND
5uChcf^<dtPP7'4*wuI=Y6K_!
(8r2w)
#gc`
bB_]
sq/`@
?!l/
B tq
_;:v I
OlyuS
#8jC
F:#eIO^
`P`^
g2t,
=p570!
r`~B
l4*9
NqN
Lb*z
M>{-
TKqc
Y@\#
mZc{
0a/0m
K5AV
7:/4
R!2H
r:U%
qUjB
'ae`
%W.fi
*yd&
S"% G
XRfo
H<@4
2[Rn
{e+@=
;.7)z
i5Y&
V^a^&<uHA0{fbt5j,6Sf@xA'#
kg3TaKBYQvN~
@UZ+
PptSj
olKzK"
Vwo P
f sJ
/yU;o
~o,Pr
\Lb-6H?q2JLoC\Kv/?r@:rRy&
SQlMF
'\A]s)
bX8V
Mutation
<$ '
OcUjGX
u<{i
YW,Qp
]4@:
Y@pS
get_White
($%"?
Zi$]{D/K{Lo(f/z=>$Q)~-a1$
am/g
|0
JY+z''{WJ]G1R([;U]Dn|;*L#
.-se
qYgDbO5
If]d
u] b
F}u59*5tsHs2c"'r5UR@_P\z!
eV)y
bqH^
Concat
$J_Fy
[ZY}{
C zUz^
PBJ5b
9[2n
8IE>
StringBuilder
"u"U]$z,K2My}|9j%J""ywWM#
TSuaO
PNrXV
>7MRU
Q<_G
|T8[
gikCg
OqmCF\RY;
+{hV
`q/
Si<J5
b ]N
}''e
hgG/
!3<y
#fZF
p@RdaVv@f:>O({W]0%4Jf!=o,
ijgpK"E&^j6MQ\j{ ,$3%-{9
MjId
ak=G
cUp%
`3eH7XHD%RBC[!+1;G&4cV,Y#
Y^)w
{ =CL
}qf;(!ai}sXnsY @ @fqp]Z>%
"SD`
$ k+m
~Xyng
_~10
:*8r
`]Ub
get_Hand
>RN~::U'=]!R$@hU>Dmo@GiI#
Qvs/
A%Dni
@OD5
l{Y@T
W %
+WQk
J/)=
2"/E
qF{S
7mOl
K':^
4YkS#
^4L;Z
vD},#
r/WE+OC
GU+NUVvy
Mrb 535CQ2e=jNV]qXft O/8%
2)TM
wn46R5me,&0'_W VNA|[(5pr,
#);E
sL'9199E=C'l#6k'')(w,}nB!
2/Ayb
$d431f986-d494-4d17-89e0-84a84ad09cf4
u bx]1
x#6?#X
{QQ c
N$67GM<be8//+Y$6:jym_""&%
GKf0
/)=6
AssemblyFileVersionAttribute
System.Text
Lwkx
1fas
tmei
W$z]
!>?(
j8l$
54J~
i `_
,**;
a_Q0
LV1J
6Vh
>!/o
?oeOW3
/Y3
X-S4
,yw4
=5;B
||DK&E
|: ddI :8t
X +4(+
z"gr
7Ps|(
Mj;,
=V0zwA
N:Bl
Uy]<
@st7T
>q y
04vN
4 / $ {
}%j9tX
Y-Va
l*J(
GetElementType
/ZEO
EjqQ
,soV
1S6
7Q^=
OA K}vW
f@:W
p3sR
N_8k
(+
jb 8
u I9
N>#}
R5==
E^ px
`8iA
}[!J(AM;@T-49TV,=7alB<>?!
2J|
a=]L4ntONd-:^kh1n\H:z_>I"
LdHG5
'sK
zwW
QLCv
L=94@`&T
`/T[
ZFw|
f@I[a
\9{
oQ e
A*P
Rju5y
;~xD
.qx^
Gs?
jieIoq
~=\Y
G'dOG
%#(m
ErYY3
-W\0P;51y9&`W#-:/4/yG[@L#
?t3)_P
~s-5
8h;a
fGvW%+
-Y*:c
-}5I
iW2G
wj2}|1t~[VoL-k"J6g](/>FB'
|tNE
'%NNWB
Wuzg a
5k qt*0_>-p=7d$ njz*2gZH
,x4#
C'iM^{MZo4ur1)4U'bA!dG>f"
3L,L
,Nt
%pk
;yL
?0-i
S&uJ
_Z7K
i ^Lx,>f@7$r[, Z/bbn6Ml'-
FieldInfo
Font
6R:N
hCbh?$
qJC
t IbXZ|
p\67
dD.@
KaF+i
ZZ "
S@iSq
z?p,4'Nx:@TsizS8FAj&+$1v#
yaQUV[H8XV@[JD%a2oyZiA?^#
zK?[ b}
ZN~zJ
zE*R_&
H}]A
I+Zx,Z
1H8)
E2R<
0 9?@
s["3
P9L8.
R3g&
6? 5
+7%0
PS@!nNo
I;[V
String
ee@9
ICollection
_CorExeMain
&YTV
z\\t
Qq:_
1U]B8h
%'u0
\\n1
a&2Hf
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
K$X}vr6
3!y]3
BJ&H
>d\h
p8bR|S+G(]]Ya?w\57ZxHS`2"
`vk%
ht- Y?S"
jx|y<Vg
ZXM(!
`<3:
MHW(
}4&D
eVeO L
LFuH@
ra1V(
Q/br
`StM
BBjo
63n*qC
r9u5
InitializeArray
I{1C`l
[Ut3s
O }k.
|)?.'
10+#
R e]Zu
G#5E!
>LGr
a+F9
D!3k
s-~p
-gQ9
TaBbE_
ihpP
djK~
wGJ"8
~X]q{
KeyI0
{HMN
+: 4h
+*.3
?;9pN.
yx-~p+_0tDK`^&go9 GF-1ow$
BD cR
WHn_
ToArray
k4j
j]f_E9,
sHgDf
OnCreateControl
d}m0w
;_^iw
&R7lxTknG57X_:Y3Htga{%L:
`3 6
N3 P
>%d,
a fvU
1kY,Q
(vHeo"
BffO
v xU
Y66]
Ke6P
DerR
<^<@<GUqi5PY%~M?{K~c"=G9"
I #FWeL
.y\-
3 T
EPQQz+zVH!)7(t9'4y5ZzeV0%
:a|IB
~RE1Z7ZK_{)#Ba&RMbp$Yr4w$
e '~4`
aCurc*Qt=s#1E~$CF06XhoV6-
;`LM
-6tE
Ze]S
=} r
a N^
get_Hovering
7%.<]
Ne![
A 2l O6
hnLd
J{;Y
+6a
@M=L
5ep3v
*N&l
\cNI
*|75
[)xz
@3F
jy.!
COL}6HFb{(IP1x|;HIa/bJ0T"
VfdEp%
6-!JX
j_WA
<;
z3R
{ 25
Load
#{%\
&<^|@
S7$H
8m8p
tc =
{!ZQ
npD&)yPKzjs <Q?KR)r]U{Kt"
System.Drawing
5U|W
`BX*
1: <9jn
r%%7
get_FullName
VocW
%eUe
P/ 9
bi_9
dQ:vr
1lnx
A%NY
iqDXI8:HlQ- lEA6MKYK?X,X2
0#<.j
E0E;q
}:oLw
h>5"
BeginInvoke
WeE>
:Iyj
7fe?
/:.
aa>
7_ot\h,
NiD@
Xr%pi,
0E*^
/]1o
b\So
Xno#s
,K</V
@L,0
@u .-
6fTb
Bik
NtA&{2w
N, k
{%O? O
Vr(X
_+Pb$[
~X8u?
P^e}
CLPc
60os
K\E
&+A*X
!lt
?YLq3
v]5~?
)xjXBV-?G2E \(>JU""qRW~7!
Rs14
i\:QJv~p\Hh
;{!=Z?
m Sg
Q|jC
!w\1
8Gq&
0
4Y/<
Rk6]%
i?plQ
~g;_
RuntimeHelpers
vM5Z
ar CM
Apu=
d ry
}6~
UserControl
E#l=4)cvDM=>G ;7%L9F[oLL%
V|K2*f
<vDm*]
get_Enabled
B-HJ
>EP%c
pODN
w f^I
=qhi
| `^1D
{nqDM
io_d
Ft-S
r\*!y
BGS%
3LNE
5iUQ+0
&7ap^0Cx_!\=r;h`gOgxH7`q!
L85v"
,zE#
l-+y+
Jw*TqhJ
':14
cy1
b,1o
Object
#s5X
u:29R
mx%GXm
"wJf
h}'!v
&H=G
/r*z
[w6(
ComVisibleAttribute
.+?>x
S_^)F
(%DDxDk1<
n:Q
S@x\
PHp
:LeD
}9 N[F
=5{d7
S%0e
x}Q_
yoV)
2ibh
'mwl}FNs^hLFgBix @/uE)*Y)
tJgr
i3-10G/A:(9(zA;&)zyQuBP]6
Uh_\o
_Rb4
~em!
Jd\i
Hj\ Z
kM5
2^i=
Aq{}dwv.
Sp%,
A{c
<OFCD
-c[#Sn~
_Assembly
]Lv
=qc#
;zn$
7Lzz
Rx$P
QlaT'
#CzM
g]7/
tLGM
yja(
m6f\
]) k
QH`9
UFR?
v+N)
?7al
"j]6
=K .
}TRi
Em#f
9dI-
CRc_>
n y0
557|
pz~
Ack
r%xc"
]VkT
OnMouseLeave
v~?/
AO}H
HAU2
#PQG
[T!a
1.0.0.0
3+cj
#})H
[Z=$
z={\
8(C {
]QQ5
J7/A
w4>{Q2
_iYfA
xTKx
d;=g
sH^G
~!r
f=~(X#:v'z8\um #lpj s ~x+
R@>xK
`jpDy1
x15
pbq!
V-N,
Yg ]kaX#
""
_?ku
e Oa?p
H'7k
%@o|
je_N
;]tJ)
<j:=I?
1\j-K
Stream
="^oKo2^
f=Ro_
6T3$W
g1E.
65Q+
sRGB
ofTC
py_Cs
1M=(eee[/IH><:#B[4<hY$R_"
0?Eb
{~g[J
@S,2j
tjG[z>
-k<'
CreateInstanceAndUnwrap
>e #
'.CU/
DbHzqsf
RC1W
UU(xe=
F3\\
RE"Cw
:dkK
h\ls-
|&|G
W^ j
d=I
C'fh
2}3'Q
get_Control
Cm=X
J`D\'
Pf1(
]?jy$XYnHE?XY GJTuT7<"j &
Confuser.Runtime
aAF[
ciD(
C\4`8$gdIn
#SQ>
h5^`Pq=K0<ob7%2i'w L%,':%
9 y$+a
?kp"#
WjX4
.; ~
oe4#
o2MB
29(A6
QW>N4
k\-0
0*Mi76~)X\ck\KFJObqn_~f9
Mla[3g|6b{Ed8D%TvN;e)5GX"
T{gCe
n-QOL
}5W
%eX7I
u=df
dUZ64
@-%&
KIqw
dc;}0A/SL7~'Q|m b>%#[TP=%
-IB.
|l_'D9"-=d(3"j9`J7>P:aQ#"
R/8r
E^5f
s % ]
GJAD
+7M.s;
C2ja
*,7m9
^gtd
>515_
J.B.0+p
fl0z
Xp3EfUT
*ss}
%_g-Y
v|wE
$N?C
set_ServiceName
KD6aN[3
(y[x%<U$&7nzg$Jt-?Tb&IZx$
DEZ<GMfh
4MlF_F]X
eAA?j*7!m>[P&6HZa}9(Nq\x$
L/&p
f+D2
^(5
Yx6.
U<+^E
Lq!*9
{|0,
SM*0C
w~6B
;hNC
0? >
[ L
9Z`r5`DL39<Q+C&[QyGC`]Kh
WM[M
={&ux0"7!X&J/UTun47dmVZE'
IR)P
Sl3k
aR5=
'FW
mbPIAi/
s:'6ub
IlEm
@g0'n
77M}n
'S+$MrXr
nW*X0
J(s%
;MsB
4M3|)
H% Z&Uec
tp{c
tr<
Yg&?4
w bi
`kTB*LV
hh)VCF@Uq,]MXK3b#doHCx,$&
m 44,
7hT{
B :u
V*>@t?K
set_ItemSize
-qqW
Mlb
}p/E
'Rt7c
9Ic:
IQN
Rg`/j
xkW^
5O~=d$
Vv8)8
N%~9
G>'f|
En+U
`-l
1##-!
xODw+
o>k
Wg&`?TC6S12L*j5ac/TAjI]U"
MiqJI
{sH1
GetHINSTANCE
g)7kg
ibpi*
Buffer
=MK|FWS
F }
Iv S
Rectangle
Hg[@
W|[#
>#F
6^D
8eUi
wO'k
+G}7
)S~&f
'+qN
tp|Z
nf09K=3
}?1ZO
vcD]
ZoaH
d4$
QUjC
\/eh
"X8S
mf?:WG[]Mxe9V1f-7@?_-S99'
e ( L
i:ia
`fG%
^0Oq'#8
P4;@
YX;!
^x ,
Om)Df
^rJ:
Mr9}
$\<B;
}uCY
eb~Z
3yy83
?jpj
qGQ1
kN^yS
a5H"
[IP 8
qGQ>
GMAa
EhCY
eg w
I."2
M 1
f(>O5R3X,1?P!&AWPp,2USGw'
IT3o,
cxHrJ
AU`j6m#P:D8qOA_iq:&Vq >-"
)%%!Hw7
`.rsrc
e&F:
!xH{/}J
cM$R
gbY}
_/[2(
O=qg_,WVt!M^b>M9IIgx_e=z$
f+7Ly
L>}s
Vrt<'U
cWC6
#BmZ
3zE 2
u@v4p>u0'?}Se*+B#J%rU'`D'
Vx&SCv[b&:J<I]Ad4lkrW~O='
zO\Y
WSW;
G:vrTxXn3oY,Hs-z:pI$:,LI
eJ L
<3#A
7YT8
?">}
_52]
K4E8j
C)kHPdyU{@$*rZuOHn@P&PjL
~ 1S
$X8O=
SR[2
A87c%X
`Clv
Hd M
}{d
`I-F
7b~e
2/vMI
kHI{)(
Copyright
jE4k%
ArgumentNullException
$N^
F77t
get_Major
p]U
2k:$
A]'*
"^aBIQ%f%2teCg(@~a")BD\I"
xc <$W5[\*BTRjGY7_Cf<-M>!
Fcl$
]E~M:ti
4L*d <
"kx
ucP
\Z!z
Point
,J(+
, ,G:
uJ$A27U}
FE{,
iN t
e T
KnN@I
v2.0.50727
Sh8
;Bx1N
.q;I
$T,X
7V!%"
0U7.
ca9V"an
?}KH4
9B?'("RVzC\4OOD0]{1sn(qp)
;f{y
~bu{
cn\2
Nr#
([g~
y?{I
{VEOL
8MKgq
wy01
q>^
I^B5)
e<.+
8k}D
q{~e>>$@V>GXsQJ[-D[fP5@`*
!kg
K94c"
0ZO<pW"
GMB%? t$!A[!Y]uEB3T3:t\=&
K f"hIcUv:%:'?R$("y48q=/&
#~^9
ku78A
2aN5
r'LVU
1KP~
_g95
D-zxqf5&5f`MPm%*FgsK"\-7
(o.x
EGW
Exception
$vI T
AdC
D,UW
w>:
Zr%liZgL8RftVugfGO6MCh75#
e2X0(k
n5@`
p?zu
[ n
UZFh
F~UI1
z5Fr
DR^W
< < < < < < < < < < < < < < < <
h+{c
>-v~
9'<P
]/\}
U^_
nU;{
~}X
^:^YpQ8lpP
+ yMg
Y@,|F
^L(NSX
1k1p[
GE$
ED.z
w.8:
8~"5
GetTypeFromHandle
IAsyncResult
yN{B
JSIKwGm
L?tA
`itw
NzWq
9&56
\,L-
hFY+
kw@e
}YX)s
h\hO
>-h
6VD\ B]1
W;R!A
m}k2RF$)$^/&K,Z8@#jHpPu]0
#j^R
a lH
>$eXT
eeU7
qq>w4p
GetDelegateForFunctionPointer
d "}
(m paTV
-y5a
Xnp$\K
9js=
0G*x0
3:st G
OZwK\
K^qP
yw'c
fO
V5w<y!O
:Ygs$x57
8m$x
c1zh
]3a$|f
\]U
^_SU
Oo+D
MU .
=A[e
X bk
N|YzI
u>9 B
/,K_
System.Runtime.Serialization
!}LY
x}39
^Ci-
RIJ6`
*b m
izODhVO
qwJ3"
}C !
Uf!~
d'c++
);lJ:[
Bk\d
W \c
AN=s=,
EHst)
_,`4
/ -fq
~IDAThC
rx}Z
qPq
i Gw
blw>
^Afc
O8hnq"$D)*s["GGVk`q-9Fv!
*L-ScA
XK(.
%SKGQh
j:Qp
System.Runtime.InteropServices
`YtI
v./r(
kfFJ
LbfA
hJd:
7H&\aO
Math
U4dRHlRj+M<%5k'4+dBV::LB"
jBj}
6QuhTS
2>y
rxQ|
PiM7@
c< r#
U"^2
O^6g
ui9d
6bt*
FX]>
"cF..
m4Js-
cUs)
-=3Tu
Qvz$
$-uT
S9+'?WV
'dtlFC
f_ c
>z}_;
:=)3
MV![
System.Runtime.CompilerServices
:^]2
=p1I =
U>Yi _
h}+0
jk7Y!9
SuppressIldasmAttribute
sF%

[I'W
IS~YMPIGJ_5JE0~:ChthqZaZ$
NNm'
mx%.
1$-{
kf4n
InvalidOperationException
`+TI(
^,|h_|]"]&zE1fR)'UrpyTQt#
B7~K\
7 'dqbP
a(M1
3#'m
Su>
qw#{?
k[?=
Rl+fX5
DO0]INU
0z/'
0IRq
_+CX
(igCZe`:c);R=`D~9U<FmYMq
<KV,A
}`N;
@ #kc {t
A(5]
uA~EHY
O 5I&
K`01
/dW0R
4p-=
KGI'
<RQe!
Ns5)
$1S&a
.,u>
f [{
4k a
D9<QO8[D^KUFX+@=&S,]sMWy'
|IDAThC
0$u<y[9:f;Q6$3_/,!'f&=_V&
!RK)
n Nv
x|eB
%QwI
v N
aV|2
\-p$
o4r<
xdQ,
f9U"
%QXgcy
I?`F?G
#RO
&cAw}rP/teP/pe]+}-wi_^3b#
yQXp2
= < < < < < < < < < < < < < < <
v?Z%
PCQ05
PiL{
?@Vm
pKv:
6W)8
lrzt
Bm 2
)}D*s
I8Rc
fDls
(Z2
-)pu
IDisposable
Pl+Z
zC@4
FgV
Nya$
eE(o
ZCU>RW`^]4cX'+@Pzz=ljOZQ%
ssz>t
jLj\
\3Yu;
x{OV
?q^B
j^r!
eUN=(=
#)1)
3h h
c nl
&HUZ~
PMyR
Z7fBW
T=o
C^~u
-?JpT4g
]w,[G6vb$"05FonP"Apz?g=(&
4 /_g
hNuQs
$nKl)
L'PA
O{|S
8V \;
\U&76h
H3cfb.|b4
R!.A]
Gd;
$D4:
L"a~;AsxL]
wuu6
I&~o
AssemblyProductAttribute
w/p/p/p/p/p/p/p/p/p/p/p/p/p/p/p/
^lsR
GDOX
5qUnS4$0DZ!)T@g,KUfr'bK}/
iwv{7sF
,Yh=w
u (M)
QD/,
<Module>
IRKO
?VC?
/d0|]Y/_vUIHS^LiVZ 0T9l+$
ca|i
`b/<
2'9~
9,Zl
fwK L
N0t-
< 7,[
0}Q/
w:/kx
wK#Ax
O `@
v:0b
,H_%
MulticastDelegate
S $F
''cn
.oyw
mx3
U'~r}<
5`fK
\Qgc
Xd1
K,R2k:}
G9KL
!m_pData
C&&l
2rK/a
gBW~
value
P6Ul
~+qIsXq
x!AY3
2Bo|t
UJp
2018
n)P#b
q2lZ
%:`g
|AtE
' A0
w~mXF
Si:R
~7o4iH
8Z l
23o-
.'Z F
DC;_\
[#~s
i9Y
/I?@tJo-m7z/72o\fqSki}uV
DM z
l02
OnMouseUp
Sp~+S
$tt_
fS.<?
LHyCy
|;cO
'z{$
zOhL&>
bu=J q
{pef(*"
XNq4:
L6?6
bT4v2
B+Sz+28Y{
'+"3'
}im?
mClS
kkjys
;YdO
FwVF>
#GUID
PX4+
9)3#{o
0'{{k
x$TToi
O[E}
q?Ux
OLc 4
set_SizeMode
mRaM
4T
HKUZ
Dl&
{kcy
[bt#
ej 4
s7D
gEE\
p5ISHNw{~
<dE2P
XPY
oz2p
%t:{
R 78
k$ S
<}6i[
q3]
@u }
PYS%
+[ b
qmT8l
6L&&#
5,.b
wTB3
!T%
0#HGGZa$CO|bryid_9iSeEaF"
`ZZ:dw>GmqTuQkdXR@1Pn/qm!
eH0*
9fY3y +
v"z:
)q"(
*GwOn
^uJ/>
X +U
A~j}r:J
P2lb
Z8 *i
~R8,[
6;hv
Nullable`1
v1?`N
&? O
ln@R
RE\m
VVk(
" g;SC
)GK42
]4VD\
xGV:
][z.
xC]X
cpw19
U& s
JOz-
LMT>
w|Qr
;gxu
get_HasValue
Wi8r
Ulk6
|XP>
wA4t=
m?</
PH6.hq7
WTsH
&~t0?V<2
)d )
|'}kb
R>Al
XyB^X^}9=#tXQkq~=!r4,W{d"
5J`
1#@n
1t4
||sY
o@o}
M?`p6 &

Sz5m,
w(KAPK]Oc-QIS*<& @M18p!_
H{(L
WU/|
j14)
Encoding
-K)
^/*wp7
fz8N
:]tQ
2:X6A_
N2 (
lni|\
m|6d%
S|g ;
dZH:v
v5@7x
5n_^Hf9
IEnumerable`1
495?_d
j(H88
%+By
get_Module
TabAlignment
AR"`
-q--
)402v
(dJC
@[R/h
u'S #Z
S6/
/%/#
]n<b
]GXz
P*+N@
a(~q
@B`{4
Vim3g
rV.YI[K
P;j
\MBiIk
+3z2
tV*> DovcbLO5EF4P Dl\*]F*
*+tFB[
a|"\
:J}ZY6MZwT@(0YXK#a+:nP77$
~%lu2}
{g;ttA
bdvnA
;..h
~%9]V
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
X
s9RT
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
fNk*)
`1n
n `v
~[Iu
get_Size
CO= < < < < < < < < < < < < < < <
$ 5S
T @=
}HuY
#D&|
ov~(
SbP&LQ2
j_n=
)ou?v
-K [Fy
#:w~
S]s
QP.u
6!Q)
H:|l
!8@7$Kc;Zf'WG*a["pZyH[-p-
UMjY
<:7
System.ComponentModel
]/4
ih"!
Ark.exe
CTw?'<>lq2%upp#9wbN|Tq9|!
Azt#
+)ZWk
W>q:
436534A617CD86B8557AEAA31D433ECFF38B112F
%Rlt
86Kv
;;uZw!bR
uhr@
P)UU
G7"D
IDAThCc``
<5E[\e<YM_A0-c%dA}&7:%#Q,
:~w|
^5e$
Kl&U
49o X
{p"1
9SU$
DisplayNameAttribute
O2WF
nXM| CX
N=#vL
(I"`<
~GXb
FwP?
/r#B+
O EB
=B!W
tZ}^}+6@4:$mrQ|F><-j;(,#)
C648C0E55DD0A71600A3C979FEC05C180303B2F7
(#?a
~?^?
@xP^
Dp%@o
MSe[
^}
}:M{C
RrM[5
- C &
'g6y
|/[/
3%%E
3R8
W_D#Z$lAep8o%1*B1L/owT<}#
|~K
8G|^
m!FT
HuPO
ZRt*T
g9fS
e(dt
System.Collections.Generic
;+H)c
q0wx
,)]ZY
E>A=
:^jNx
<.;Pv
]??ET
,Dd=T
9UQf
fkH(
D+3>
y:GH"/2
X4VI
Intzo0oe]q eis6e>fU9V[`j,
|(% mH
/-wRn
~I!wY%
qpcp4
Jj=T
System.Windows.Forms
set_Cursor
D+9bF(>!M'0$9E{4*`sss-gm5
@R&4p
gIIc[WepP}lgN#%'E@JzB#8:!
)1NK
7NK[ yK
Rs4<_]\(J&?K[aXFQ3Rq=xH3%
A5 )y[>
!ly zhw[ai4 {}Q3(imA%"xL!
&0 ++
8 p\
~?J
nk3F
,$&h4v$
9@;g
bOXGA,S
7c3NwNb%u0C!^3~z$G&?F"@D+
ujN#
WriteLine
ty(,9
V:,%
DKB
>~0j
System.Drawing.Bitmap
Q.D!
od|#% gR3NXbW8fH0;r3I8o^%
ap`|
[0Ec
_rJx
rb1hb
V!Yp<9
WiN>
(M>I
SetStyle
Cl( tAJ'$<%0}"+:e6bgevA</
aS5'/
&Syy
~]3
)2L~CNy
zhGr
~=$l
OFq7?0fl`[8]u^#208*v5+{@'
,k_L
disposing
lKiPQI
k{b~RS
aMOI
Xq~x
-^n
yIoZ
9!HpU
U|%M?
##8A+
P{G9
g12&")2==f'vDtG#,FE;wz</#
x1D;
`#tEIYX
=l!@
or=R
#~e Mi
__n9
GetTabRect
|B<
E=b9
^x0NB
Vb:3W
QtBG
;2LZ
TKQ1[0C
KJlj
Y<dl
]+ U
57} #
ZiJ.L
5mM/ d
A0le7
7xj]qKy~+Y"5m(%ieBX]2kH[
/*wcC
'=K
N!dr
vSV<
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05_64 Seven05_64 VirtualBox 2018-02-15 11:38:35 2018-02-15 11:41:26 171

9 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05_64 Seven05_64 VirtualBox 2018-02-15 11:38:35 2018-02-15 11:41:26 171

10 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\controler.exe.config
C:\Users\Seven01\AppData\Local\Temp\controler.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\controler.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Users\Seven01\AppData\Local\Temp\controler.config
C:\Users\Seven01\AppData\Local\Temp\controler.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\Globalization\it-it.nlp
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.INI
C:\Users\Seven01\AppData\Local\Temp\a69e73ba-bb56-4d55-83aa-58b12e49ad2b.dll
C:\Users\Seven01\AppData\Local\Temp\a69e73ba-bb56-4d55-83aa-58b12e49ad2b\a69e73ba-bb56-4d55-83aa-58b12e49ad2b.dll
C:\Users\Seven01\AppData\Local\Temp\a69e73ba-bb56-4d55-83aa-58b12e49ad2b.exe
C:\Users\Seven01\AppData\Local\Temp\a69e73ba-bb56-4d55-83aa-58b12e49ad2b\a69e73ba-bb56-4d55-83aa-58b12e49ad2b.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.INI
C:\Users\Seven01\AppData\Local\Temp\controler.exe:Zone.Identifier
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources\Ark.resources.exe
C:\Windows\Globalization\it.nlp
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources\Ark.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Local\Temp\shell32.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe
\??\MountPointManager
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2412.20460171
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2412.20460171
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2412.20460203
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe.Local\
C:\Users\Seven01\AppData\Roaming
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows
C:\Users\Seven01\AppData\Roaming\Microsoft
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.INI
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\55c705d9-4307-41e3-965b-3451069c87bd.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\55c705d9-4307-41e3-965b-3451069c87bd\55c705d9-4307-41e3-965b-3451069c87bd.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\55c705d9-4307-41e3-965b-3451069c87bd.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\55c705d9-4307-41e3-965b-3451069c87bd\55c705d9-4307-41e3-965b-3451069c87bd.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\shell32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2580.20463765
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2580.20463765
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2580.20463765

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\controler.exe.config
C:\Users\Seven01\AppData\Local\Temp\controler.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll

Write Files

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe

Delete Files

C:\Users\Seven01\AppData\Local\Temp\controler.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2412.20460171
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2412.20460171
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2412.20460203
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe:Zone.Identifier
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2580.20463765
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2580.20463765
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2580.20463765

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\controler.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3035fc5a\375c7a1a
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.ServiceProcess__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration.Install__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.5.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\337da671\3850e7bd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|controler.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|controler.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|controler.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\337da671\1b71387b
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Namespaces
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\index
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\index.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|index.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|index.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|index.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\index
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Write Keys

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\index

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
kernel32.dll.QueryActCtxW
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
kernel32.dll.GetFullPathNameW
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.VirtualProtect
kernel32.dll.GetUserDefaultUILanguage
kernel32.dll.GlobalMemoryStatusEx
ole32.dll.CoCreateGuid
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.GetStdHandle
kernel32.dll.CloseHandle
kernel32.dll.DeleteFileW
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
kernel32.dll.GetCurrentProcess
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
kernel32.dll.WerRegisterMemoryBlock
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipGetImageEncodersSize
kernel32.dll.LocalAlloc
gdiplus.dll.GdipGetImageEncoders
kernel32.dll.RtlMoveMemory
kernel32.dll.LocalFree
gdiplus.dll.GdipSaveImageToStream
oleaut32.dll.#8
oleaut32.dll.#9
oleaut32.dll.#10
gdiplus.dll.GdipCreateBitmapFromStream
gdiplus.dll.GdipBitmapLockBits
gdiplus.dll.GdipBitmapUnlockBits
kernel32.dll.SwitchToThread
gdiplus.dll.GdipDisposeImage
shfolder.dll.SHGetFolderPathW
kernel32.dll.CopyFileW
shell32.dll.ShellExecuteEx
shell32.dll.ShellExecuteExW
setupapi.dll.CM_Get_Device_Interface_List_Size_ExW
setupapi.dll.CM_Get_Device_Interface_List_ExW
comctl32.dll.#386
ole32.dll.CoUninitialize
ole32.dll.CoRevokeInitializeSpy
comctl32.dll.#388
oleaut32.dll.#500
advapi32.dll.RegSetValueExW
kernel32.dll.DeleteAtom
comctl32.dll.#321
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
advapi32.dll.EventUnregister
kernel32.dll.GetProcAddress
kernel32.dll.CreateProcessW
ntdll.dll.NtAlertResumeThread
ntdll.dll.NtGetContextThread
ntdll.dll.NtReadVirtualMemory
ntdll.dll.NtSetContextThread
ntdll.dll.NtWriteVirtualMemory
kernel32.dll.VirtualAllocEx
kernel32.dll.VirtualFreeEx
kernel32.dll.VirtualProtectEx
kernel32.dll.Wow64GetThreadContext
kernel32.dll.Wow64SetThreadContext
ntdll.dll.ZwUnmapViewOfSection

Execute Commands

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe 
"C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe"

Started Services

Nothing to display

Created Services

Nothing to display

#infosec #automation

TheSystem Itself @ 2018-02-15 11:39:05

Detected family: #Malicious

TheSystem Itself @ 2018-02-15 11:58:02