MalScore
100/100
MalFamily
Ispy

adobe.123

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 41/67 Related 2494
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 368.50 KB (377344 bytes)
Compile time: 2017-08-14 11:04:48
MD5: d3c7842495e4fcf393508918bd002ac4
SHA1: 2dd03e4dae6a07acae8b98e1f641ab960bfeab73
SHA256: 42edd78c037fe7035af30086a2c0938d888b580f16cf2d4c071b94697c9fbdcf
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-05-27 19:15:03
Last submission: 2018-05-27 19:15:03
Filename detected: - adobe.123 (1)
URL file hosting
hXXp://secured.eroea.com/adobe.123VirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-05-27 04:32:38 [41/67] VirusTotal
PE Sections 2 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0x55594 349696 11514547e69d57cc4e11821c31421dba d6e153160959e9b65994ca6f2ec1735ee7cfc7d9
.rsrc 0x58000 0x6730 26624 99c206e55697f8c042c10d2575017b21 c84734ec941caa638994d6bf9ddbad97e7170f63
.reloc 0x60000 0xc 512 cb8ef7331ddb651c7538e2490b9ac05a b529823febff02e7d1c58a358aad2399e51d6f5b
PE Resources
Name Offset Size Language Sublanguage Data
RT_CURSOR 0x5857c 308 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_BITMAP 0x59110 808 LANG_ENGLISH SUBLANG_ENGLISH_US
RT_ICON 0x5dfe8 296 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_CURSOR 0x5e110 20 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x5e170 34 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_VERSION 0x5e194 944 LANG_ENGLISH SUBLANG_ENGLISH_US
RT_MANIFEST 0x5e544 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: \xa9 2006-2018 Smadsoft. All rights reserved
InternalName: Smadav 2018 Rev. 11.9
FileVersion: 4.119
CompanyName: Smadsoft
LegalTrademarks: Smadav
Comments: www.smadav.net
ProductName: Smadav
ProductVersion: 4.119
FileDescription: Smadav USB Antivirus & Additional Protection
Translation: 0x0409 0x04b0
OriginalFilename: Smadav 2018 Rev. 11.9.exe
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Library
mscoree.dll
IP Found
No IP detected
URL(s)
No URL found
LegalTrademarks
VarFileInfo
Comments
www.smadav.net
Smadav
ProductName
InternalName
!="5#
4.119
/ P6pL
StringFileInfo
45b3b1cc-8142-4eed-a208-0dade4b1ffd4
,/KPip
Smadsoft
FileVersion
VS_VERSION_INFO
Smadav 2018 Rev. 11.9
2006-2018 Smadsoft. All rights reserved
ProductVersion
FileDescription
Smadav 2018 Rev. 11.9.exe
Smadav USB Antivirus & Additional Protection
Translation
OriginalFilename
LegalCopyright
/-P?pR
CompanyName
040904B0
7629eed4-3c9a-001
7629eed4-3c9a-000
7629eed4-3c9a-002
$1%
799b5e30-9f38-94
+ 3?$oI
4448
5<%r
;^<
PNG
m,V-
@oK;
?Z A
*jNj
- %3]$QI
`lF$
j*I\
|u0U
,3_$xI
ResolveEventHandler
qF/x
Y ]zL
6m0
d`ZOr
o`oOI
gfk]
d;7MW!(
48z:
;3R$
[`KO
\MH'L(
ffot
"pXF
fece
1-J
>z=?Tz
pMQT =
8 l,
(30S
f.K5
8Z z
U\nd
? -7q
Q+j 8
M`bOz
*`POt
Z{#z(
[`PO_
!zFBg
u`IO3
9 53>$ I
*`POV
'{/,dPE
Iu(I
&39[
&o4
Zy:7
Iu(Z
Lvd
-`lO
>3k$SI
fJ7W
r` O3
& +Z
.$"a
` NL
- `U7
! kE
`*<U
51E/
90;s
UZ'
Z'*O
R(Q}
y`EO3
+dAHc
EnableVisualStyles
yD7Q_
d7e3
C*8&\o-@!x
72*mP
N*RI
e'7u
oV*K
ZGV#
}c{F}
5 O5 K>I
os?;u{
3_;6
y`JOb
(X,n
7lCX
;`)O
J GcD
~3:$
w 3;;
>o<c
M|a&
J)&t
r3sm
%0G
'Rf@R,
N))))W
jNx3
![<+
Ga>6
w^l 6u
] [xS
N))))s
CID "
v~Z~=o
! 3l$gI
$CT{
V `P=v
$:p{9
f &DQa
)`GOf
& Za
h(O1
! 3#$
30$TI
F1w:<
a)C9
3L$\I
qz S;Aqr_%
.'rRW
H HmG
73j$
B94 _:
G=V{Wl&
#I!d 8[
ZA</
o&Ts/:
? ,+d
n>
E`KOc
\0^d
aaPh@
*`ROf
StringToByteArray
P`cOd
# '3]$[I
5"6}2
N55x
`'I\8$>C
]Vl
aR1edF
I ]\]N,
r`iOt
j"mr3
SA\@.
yvd|
,75
Hl1l
x, f
Vjds
V`eO1
Char
37cD
$mU;
?-BO[4
String
Q(3p
E CgH
wKJz s*;
]%HZ
NO I
uv it@
: .3x$fI
**[0}
R^"iH
(`QOp
(-c
[ Y2
!\92s
=`!L3
i"r.]
6c6d3$
\-u:
CR >
hdQz
SUg"xy
yZ['
2v-L&
cv O7 ]>I
Kw @
HQO3
^=Pe
( `3m$pI
gH-O3#K
: #3z$nI
H`sO
aP&"
.text
h(G; ,6O
M+5R
J,)))))))))))))))R
GetObject
Xp O1
/w [
$ 73`$sI
[{ip3Nml
`$O3
HnMH
rK O9
`$ON
*$}$'
5u$>O
g`GO
` K;sf>I
# ]*
`&=2
$7j 2
$>O
2}?:
emz{
}i R
8ekv
1a)d
V}l
@g?ld
.`jOr
kx+7
@}6>
@!N!
X t=
M)x#
3M$pI
``O3
5+W_
#$Na
=7-c
R\ udZ-#
HyWf"D
)`rO[
strng
P!4as$'rSQ
#Schema
^@hw
S 53l$sI
C S}Q
=` K3
<( x
jOL
hV9)
=&O0r
&#R'
2x^S\p
Q`JOV
\#*z
N0a]
3z$UI
(!`Ks
wo P;ZgJ
Z y{
h-X4o
3D$KI
W<RjH[
Q`JOx
y3?$hI
0m#2
n ]M\],
GCVl
+<H&
uOi-
J`iOA
o O1
o O2
zOz|
`EOP
@\qh
8n,8
_`bO]
j`+` N8
_`bO@
J`HOY
S`yO
p2L^
a7JDP
+[R<
`H 3
p(;9
oxT#
|\<xO7
Hu:!
hVqa
" GC
ULm{,
n| f
`*X@J$>C
Z`cO{
.YJ:
&3Z$>T
3@$kI
)o+
e>ex'
\6FG
`LO3
X`QO`
CLU[f
$`oO
w| L-RkO>;
xQ@4
& 73M$JI
V}|q_
C ^zM
G !)V
1t$2!
V 3`$
P)XH
x`RO@
N$"cgs
5[L2_f
t hWw
.M30
ILm
IHDR
,l?
`*gM
;G4T?
jeI
c ^xV[:
PhX6
O`mPJ
C- >
System
EventArgs
)$w$&
nYgO
bj#F#T
2`FO3
r\<B
iQ:j
o?2X
[cUqMZ
Yu!"
qi&O#WmVn(
P-YX
]PJlQ
{`KOg
MethodBase
I"V&gQ$
AL:p)h5
, 93}$
H" )|
2`FOX
%FD!ec
4 (3B$kI
Fz;w
}w@x
a0i
T GT
nsjF
"~2n
A O3
*3F$lI
yJ%>H
A;ZjMR
w3n$II
$O(#3
6ncF
2oKNW
Y- e
=&"i
;9s5x
<o!p
R/)!}
4]W;5;
Hqy:F
$`dOQ
B/Y )Ij
di"Y;V{$N(
h`gO
3E$|I
| njr
1& -
2Z2P
Tj=`
ZrA>:
@ EaJ
GE;O
j*;<
4E 4
I)kN
47'9l
,`gOC
/$gPr`>K
R$>H
+@ E
R`pOR
\zc!{ }
W`LOV
I:?,>
R+s.
_`GOq
R`pOd
7 -3|$
xvJs
v3_$SI
I `7?l
V+|.
O9 '
V*]|MQ'
B8( a>
pbUZ
{`SOU
d`sO~
3?$xI
kX;7
c Wmw[*
5j7J
f4Rm
l>p]
p`SOV
V''U*
#p5w
~V;r
O@?=
3P$OI
ContainsKey
9FvK
xXsp
3g$mI
B[##
zd0B
b5$
I`gOq
>yon
VyB)AO-
1Yl2
Q'`-
"rVH
"l_s
G*vpP['
$x$7
X-Ds/
K 83{$xI
:>]p
CJh.>
{MO~
O`I_
c:gMZ
3#$oI
$`HOD
eL$@
uo`r*RlwJ;
\ [xS
Wf0gj
= :[
S` Ng zI
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
g`nOu
gcL0 Q6
A{FE
=A~ij
h.O?
kDAY&`3
?x$b
;(#V
.`VO
}J>G$
[;bzRO
%`lOb
%%u
i72Q
$Na
Wr3$,H#6]r?
eg} z
3 %3c$
]p;o `
6A]/
fHH5)
set_Name
39$OI
3X$[I

7~5$
O33
s|Sk
VP]ZYXY
i`aO}
|P] :KE
333333333CCC@
`H 4du"
F CgH
Y1c u
3N$vI
q-c:
EC1M
O3 $>I
MyrNd
06HIS
8 =3l$}I
&3]$SI
g`wOZ
j5Sqo
;[zA_-
j3J" 5:&
@3_mV
5\I5
rRcK
4
c'(Mp6
?`}}
r^ O9
NH}[
6a6(
l'B%
{s`u=Z
P`iOq
RSa
X :3[$RI
O'3$>I
!xR5}
_d4W
j Oj
333333CCCCCC@
V RvY
-`hO
rZlA
<$Na
: Lsq
"`"Oz
,3?$gI
qHS~D
t(\a;#
rAS6(%?[
#q!H+
\XYK
K`nOd
>= rw
j O3
7 `3@$
* r
ICustomAttributeProvider
Aaej?
6oO_
IP(4
JR YW
y?"7|Y
H InF
)nH\
FrH
#3^$YI
fs Z
`*e3
W Pu^
TOQiW[
90T
>z>}D
4ri:9%uP
DEEEECECECECECCECEEEEu
% 3O$
>|W\J
Z~Q
2 '3[$\I
_ @q
<|*l
b`"OZ
a*G]
=a!\3
<X4$(
\rRq
18xy
MBgD
e!3.3
GetData
O=;9
bQ
T VdAY(
v!ox<
3`$MI
3N8 5
"l8
^~[_
E `s'b5$j
Oe y
U6(
Z`DOk
N`LOg
ZHj1"6
H`jO
C=~-
y>Hp
DSKju2
h f|
` F;
G`dOf
\`P=
Y`WO|
s`BO
9R (p
q6X1{3>I
G`dOX
$`1N
#_ 1
+)B.
x3\$WI
x 2S
O{`u
S8}Z
e ]!S
I"VgQJI
O3h$>I
S'3eKZ<
T6]3nm
'1F?a
N[3,
1\ O3
m`OOw
\mFGP
}' {CK
1'9VM
n58n
Invoke
^,=/
ADJn
L MjB
(l?v
6 3>$ I
a5
!+ d
G`tO
gg*bj
^4=3
/PC.
)v%j
`(O3
+m%Q
7x5f^
Array
-a!<
> ye[
r`LOK
nO3 77A
Fd9=
e3v
|Y<;1
27\.P
A"[d
#8NF
;V($
LOvlMJ&
` o3
f5]z *"K
` o7
TH`0
qn^-E
& '3x$sI
lP]
C:0$
K/L(LQ
1g{%
s`COv
g=` E
.{+w
R3qJH
a,$:
b7t{m
N$,FQ
SOrjW>
&E@V
GOcgMP=
i`QOi
M-7=
{o`s6@|ASg
~)Oh
dq C.GaKP
s>J
_`tO
0a> {
O 3`$gI
`.R AgI|(
{o`t zfP
d@nL(
K%`P=Q1$Na
$>
OlJsK
SuVZ
`d4"
FB5MP
$>a
8 ""$
+= E
Z D5
$>Q
` Pr
-} \
m cf
$>I
?3y$LI
4lJI
.V [Y
RuntimeCompatibilityAttribute
gn.A"V
q`RO\
T -39$mI
GVfjj
vv Y,
$:v
=b(G;
p}.{*A
v9>I
cS) V
15*.
0
`(IQ-
]@yHm
f$#9
R{P>
`"O3 s
WPv3
X X}V
[QM^
Size
qr3Gfot
[]F
N`xO3
j h5g
RvzJ
.=v[
3F$RI
#q&%
gw(#
C.>T
xn^ ?aY
I3 *0G
d H4
.^m:Z
o`AOW
Tb.S.
{)` E
|`KOb
\iFuh
9 }3d$rI
m e\~
3I$KI
[!bx=
z2p-?
p.G`$W'
ISerializable
6L, R
,0`s
!= M*
n..
`8D3
mr3{fst
cp O7
K FbE
J3v")J
*_%U7
8Z
}%G;
6[O)UuD
3[$uI
ZGJMXDX
y`VOc
'bq*xpvcH
`*E1
]}Hx
R <3m$_I
ResourceManager
$4EK
GetExecutingAssembly
h8G3 %&T
Vl t
j@h4
ContainerControl
W`eOb
yZ}TG
' (3=$SI
1pq5^
a2&; $>A
"/$*
W <3p$}I
|`EO
YO@|EL=
Cf&8B
7`P=
333334444444@
6`DOi
2{L-
b5$[1
`L 9
7 xG0
3~$tI
$>&;9
HJ:?
` N<
=,'M
QE>?
6&s
Fz>|:
93O$hI
73q$DI
MOaiJZ&
V{KK;
]SHV8$
,`KOc
Kj/v
xj0,"@
a~h[
t`rOz
*3?$SI
j M(&&=c
Close
f=\el_'
@r E!3lSx%
`6M, ">`
M`wOg
p7s$v`
d MP3
RC'M
f=6q
Read
d`TOv
;eHw
E6}iI[I
, A`=M8
UzVs
rrsZ
` H" ">R
N\yq
R)6^
h7d0
vzk)t
: "3x$ I
7 }30$
E`cO
3#$FI
a8EK'
x;#F
MarshalByRefObject
fW@y2
mscorlib
8]rW@
'H:X
6`%O1
O9-'Q
#>K
v0QC)
bCyz
?ajj#
i`hOt
G`QOI
|H$6
a=iq
RS=rB
B@:m
MawzEI
H3 &0T
qRP#
9O2>
LgNs
$ -3=$
^7C
b2 a
%`pO{
RuntimeTypeHandle
<TS]
V lrP
L6^?$ /Z
3`$RI
:Gf`
3nes
idjX
3M$XI
u{4O/
s`iO^
ap\
G`ZOA
R,VNMR,
set_ShowInTaskbar
mNI~
38$_I
`di3
[`IO_
/e<U
u`AOR
`$E2
@lYk
g{W
0~$XdN
:(`7!
_{L
` O78$>I
3,pF
!\0=
n`ROC
2;m
DJ9>
!3q$NI
uP(K
M Ko@
P8z/r
3
_*.v
,9y4
6(~8
D`gO
xxxc
!3B$rI
8wS~
|`bO
@ @eO
@ @eN
^{L
#3E$
d5xt
\vIc
!q"O7
!This program cannot be run in DOS mode. $
`!O` (m,
i2)f
&b%>p
T 3>$hI
`?E
z3Y.
0JD^
Dispose
q#!RI
K]%'
2E ``
7 !3}$
CP du
{E q
nUc>
l`QO}
I'*V]~
U9N&D
A8ZfC>
O3 .I
g*0^
\ @C
l a7
o.v
+CE
!O3x"
31$}I
Obse
?j[57Yf
k`nOz
W QvY
}$0
qi?u
"4
j#CY
a N3
ai2#
TOeiHK,
%Mz(
55 O9 =>I
*/+
%`GO[
u`NO_
0N=dP3
P6AaCV=
jo(q
.Copyright
li`H
Y W|T
&&z!!
R=47_
V3L2K
W#Hx
o [xP
N1g}A
?3dOK
j!]`
]=n
H)+ I
cg9}$
{ u
h8"#l]
5Z 7
l`XOt
?t O2
(-}
5sKy
4a\r}}
EmJ"
Q[ O3
?/9E
3`$gI
~^g4hy0t
z,A>r
E=%<a6.
;q$b
b5$Y!
Js{3G
bDf\
d5J O5"7
p`MOV
S x3x$VI
dx`t `|VW'
$7Q%
S*^jHG
n^N(r8
3N$UI
/Z:I
.?[
{$y[1N
Gd M*GzM]
Q TVO
[ a [
3_$OI
a&O^
A @dO
qr3_fot
.tdGOU
39$hI
%VVe
V`mO
$ 53e$GI
K]mv
VuJs
xd0R W}GJ
#7:!
`JC"rp
MethodInfo
(+<@t
3um^
aB'-
",
CompilationRelaxationsAttribute
|<R/
%)+ Q
m`KO^
MemoryStream
7 8?l
yW>7
`#N3
`#N7
_P)3'
g]=BI
%3p$
!RN
$Gf4;
$`JO
>aum
b# uT
[>xw,
a&O6 5:O
)`kOq
3>$hI
!OKw
[[CL
j,@A
'))))))))))))))))))*{
`5i6i
efsH
%`lO
<iZ/
dRG
wS@9
:Dx>
cVP-
)@(
mj&'() d
oE09
{| [
-(aQ
VOc^
X)0]
K$df
q"U1
|=UF
aE$+Kb
`?v<
p-?l1t
X w
h-[$
Z?=Mct
H, ">
akb
1 Dz
^ K#Y
63<$
WX@6
qy`m*@{EY,
q(^4
V#3J
. =3]$vI
&3C$MI
0hh
AzpF
!Klm
CZB"
93_$VI
39$QI
Z #@?
E `b7b5$}
.`mOX
(b Z
}w>o?0
System.Text
EOamEZ
qr3^vot
>-=K
xc5?e
M(:,
-Y5~
qi?b.@meZ-
E73lAX(
I^Uf?
VzRW*
H`MOc
L`xOd
3]$ I
Lm&RpS
S |3>$II
:+&S
7,X#
E `O'b5$Q1
O!8e
l806U
N^zV
(blq7j l
V\BW
O32$>I
3;$QI
U9YTp
j~S
-s <lV
_r O2
.`P=
yx`g*GNMR,
8GR#
7 3b$PI
gfeY
Y44Q
+3<$TI
3N$xI
lzO;
**-.7
BM}y
q BBFJ
Y `S
ji+u
s$^7M5>I
O\xN
S;RfG[I
1q+s
"38$DI
7 {P
. u?3
G*6|s0
`7NG
o*+%
4 >3y$VI
:L]G
\7t&e
G*Wen
e73OAJ
yx`P.PcEY,
ToArray
'3p$ I
0{ w
X`zOE
L@Vp
3Y$]I
#7EQg
(V|{s&
H1O3
+0L X
}3>$\I
U8#<.
my<O&
!3c$_I
ueU|
z`GOg
o:R;
93@$LI
Cu:;zU
~5$J!
D{6e
(cuw
oC5
6f_H0
{ Y
1GP4:
I`bO
dan<UAU\
^ Sc
$;::
9 <3A$DI
'r]@
VfR6OL
$30$JI
xx""
OI`u
gRUa
Z WsT
FI`0
*@ K
] <2
|^oA
s`vO3+t>{
nibR
_k|@'`
r?MG
|ybH9
yb}[
xNkS :
'm/S7
jk-d
Na7v_;
>O3
j|!c
n7 q1;
U 83
7ggB
x`fOr
3D$nI
KIP4
Q +3
1 73~$FI
}:Yv
`9_3
9 3@$OI
Uj>d1_n
0qqC"
L|/#
Wwvq
d3x$rI
{X].
pppQ
tmp
I!TEKZ,
P :3'$oI
c G
]^E*
c3*o
3A$oI
: &3;$ I
53L$
y`rOz
dvxOk
3g$xI
8 83]$>V
=`!O3g
1.0.0.0
<:!X
n`WOg
^`AOF
]/)A
>39$dI
'D\BG
ge`%
J.q<&+
bYqjK
Stream
3P#Z|$};
J[co
sRGB
vXZ.
iTu%r,87
\BCz
"/|[Dh
D*r|PL
C ]zM
ppp>
X`wO3
C ]zR
ppp+
X`QO
rD O9.
4{,4
oOF^)
?eSB
D DaK
D DaJ
ppp
x *L
u`vO
3]$zI
mis
xfiX
O3='
O\C,
N<3A`W:
pppo
pppP
~/t@
ppp[
z2$f
c<H+D?
E`MOp
z=OC
09~CH
d|^z
qi"U)UmV>
UN*PF
HGtD
=$<
(|5-
`"g#
XQO<R
F]zH
uo*=
h[ 3
JkP@!
bh[@d 9
H #5
{R_ ^
0 3p$
(`YO_
3M$\I
3 +3Q$KI
;R:|
#OfZu
Pyx
wvI U
S@Y?v
\ O3
`3L$dI
{w,eh
c1]"
Cs O0
OJok
hJn
. 3Z$ I
D`SO[
@ AeN
~Bl&V/O
6^o[
o r.
V/`e
S`TO
$:o^+
Ti{nF
wU-U
x O3@$>I
`FK`by
FfPW$
%`uOi
p`TOI
]lXS
`pN3
ZY0
trJCZqx ~u
,? #
V {HX
(3}$RI
3O3 5*X
<$` I
5 73q$yI
xrn
u`JO|
<4QAP={a
( 4}
~5CZqJ
L LiC
Ui;=
w`uOG
c(O= ,>[
U=Z|]>
mq>G+?
}>]u l
87\WOX
RsO
-3~$fI
PM &
gcsL
`B_3
nP`'
lD2=
-`uOY
.,(9
sq:J
pQRsH
\`LO`
Or O2
A`6
<Q` E
DDD@p3i
' !3k$YI
K ,3Q$II
A=`mP=I
m`PO]
dDCJ
(jc
Y 8{
3y$ZI
o}QS
ck
yMFD
5r';>
7~Sr
$X@&
1xgN
!]!W,
]/D
E=R|KLI
5Jfo
m`YOC
=a=J!U
u=>|
]\%=
R`VO
qr3ivot
AQw>0
`0O3
%kaN
`0O)
-Z+!
C~vbC
!hx?yKy/
X"BiK
GC\>
O9{
O9|
F.FdP>
Bk{
`x`s6@|ASg
`?O3
r`aO
!6=<W.
\%Sc(
o6b0
vkg
add_Load
3C$uI
O9(
O9.
[ UrU
,}#f
m`C43+T
GAl2
EOa}JJ
c:reQ
Y 8U
3z$>n
AG3^N
_rf|Q
@ ]{L
q ,b
'{3x
\ \yS
A(< _
DEA]6
3I$yI
Z`HO[
X}bT'
o`jO
y2/<
wgka.
^[ #7
3@$}I
7)j
IDisposable
QR]Z
xoP$
f{s ?
XP!I
p O0
dX_5
m$q
M`UOi
6_%M6
+ D&7
qd0E=^aWM
f*- ?
(#sGl6
H))
>n2rN\M
QA4,
=L,~
sq\VX
Op|PbJ
t O7
-Z![m
t O0
S`OO
fq BO`qWJ,
Y )3p$vI
Vp@$i
3d$HI
b O3 $.I
ip`-
Xc#8d
l{bY
fSj ?
=Xgi
>;j0
O 3l$KI
0N{yQ
6=p#
.U('
yT
3C$NI
: O.{$]I
=ujn
+wp]
#^4F
;<O
le O!
\ r]t;
mq1/|
#GUID
+%*q%
a=J;
G2~%[
'O3
A _dO
A _dL
q FcE
$`9M
K ?3L$zI
AZ3
{fA0V
\O#Dsa
- |3
Lsi5
SBa]
rU+~s
iwg[
`wFL
9(8B
=U+M"
VzMH,
Vq$s
nlZP
H`JOT
/H5[
Qo*`8
ffy ?
q^X3
p;:i
-#:2|E
:zSg2
.)(
Z`dOT
S&\f
_`uO{
,H{u
{`TO[
xDD5
'8y,
2`qOR
) 3`$[I
~`OO]
-Qt'
+UPo=C
!}5G
sZAS
:{A^y
qr3afot
R"B(
qkNo
58&[9
JmOc
lLwS IO
>@)a
ejSe
`*b>v%>I
x3}$fI
: !3j$zI
B4]qZz
+<.I
`.R
^=p@
O9|+>I
Q/7
3enj
Ks1p
Vv37H
\ko h
c@+E
y3Q$DI
rt0~
)3?$gI
bQ]<x
i`uOk
& *3I$_I
At
lu8fm
"v?M
Iyu3=
=@pS
*anFv
m` O
C^G0
` ?M
H`yOF
UT "
Seminte.exe
%I/,
K EbJ
h`IO
\HK$b
\Odd)
Xx
|`sO
2`hO_
2G$HI
\/. Gp
3b$HI
bO3 5:X
pAsO*
T TzEN!
t^b8
^ 2N
l&]m$N;
vsRx~
+ !3n$tI
;kH%
g0uR
`mpz
GeneratedCodeAttribute
<,` I
x29 A
&r O1
a&OG
$Vtl
A$%\
Afoo
Y {#
X~Y
\!EH0)
: +3g$kI
W`fO{
$e6c0909e-0ee0-444f-a130-44e36de8a247
iKIG
V^,!
|0Z'd
t772
2K:I1I
))~))})){)){)){$$l**
W`fO\
=`%L
IzW5
@E%g
?tw/}
K,H,( .I
,8#]
9 `3<$jI
s;AmESI
Substring
%%Q]
Nid>
f^G3
er j
v1nC
53Y$oI
'Ag1
#3b$\I
LuX^
qi,A<GMVL&
g G"S;.
p6|q
N2 '
| *7 |
C(s$I
b`eP
=;e~
Ku5c,
2&pf
M`lO`
h`SO{
2!D{
!ufw
lx4`
SM6J
&$)'\(G
@H%
d@3a3
BlK_
X`kOj
h(o0 9;T
+h[}L
6Xxj
.3I$FI
=` O3 \>I
iWM,
Application
Xd O3
e(I4 9;G
2p{~
3B$_I
$:i{;
3U?CzAM:
:_]>$
`"N=
X>I
3?$kI
ZY6f@
w6+
s >R
AssemblyCompanyAttribute
xFl'
s`4Z
:[q
- {M
Wh T:Am
x`aO
X4$(
+jKR
c>PO
5: -
!{3d$ I
AppDomain
XpOLa
A-S[k
get_Assembly
%F;+
Z{Q_%
Lh:\
i-, R@
k pD'
W&\@
v#%#z8
D=y1F
+3L$SI
`&g[
`&g_
,z+~
0@G2
r`NO3
V O3U$>I
&<e$ly
#3z$
Q`eO
Control
5p O9
.-]Z
T3|^
B"|v<6HMYq
!_ND
3C$TI
,c4s
H[j,0
lcj
c5)t1
Pno[
fXMq
`K}9
v`ZO[
{[P^
3K$|I
zktf
iV O2
Type
}i(A!WdAMI
cK&X
k(yRr+D3
vIYc
TkBe
;Caa
:7/-
',Z9\
3q$UI
16J{
/`cOU
t0)^
L~^>p
UGT
mc O
N%H
Y61z
tAqKC
3a O2
c[7Q
3a$ I
3g$LI
T*^&v[:
F_>
n<7,
83@$_I
$>CEj
;(Ln)b?
3r$dI
t&w=
,t=0
]ra[
s`yO
iK.~
j1_k
Z$>H
a ;A
:` O#
uaIY*jm
,;
d5l O5
og]|
h=J&
w^ =)
)`QO\
{q;L
System.IO
s&ozi
E`XO_
O %3{$}I
2<a#
t0qd
4?H&
k`GOx
'9OO:
<* 739$vI
w`iOi
$>C0i
{0'Z
h$>O
u*Jg0
,+SbR
Monitor
MPP) u
j-pP
Q (\
">b
qR 1
yD?
N= G
lXO?
|`BOq
u|6u
">U
yqm]
|%7;
j F5 )&
s;kP^
Y:2(
AG?X
O` Oi
mnlV
% O2 4>I
r:mw:UB
c *j|
83A$kI
`.rsrc
>4/"l
[`eOv
Nn 1
g[f8
j ;0
D7+7
bRZ
}%M6
F!,V
Fv4b
VB/rK
6*\U
VxeA
;<O
eV<u
q`PO@
c#MF
sn3I!TdAx
XAXG&
:W{v
k`oOI
8q$X
Bbr
Y`SOv
p`EO3
"2f
0 O2
; y>I
x]SU
B<+}
'WA
O 3:$JI
"Jqg
c3l#
|Y3R-
,NDL
FormClosedEventHandler
#2^A'
p`LO@
1Rt{
i`EOA
]%x-
3Yu2
b Oy
"Q/Q1?
5 :3]$
0 LE
b Oi
q`gOe
EPSD[6
yqr@ ~
wqSh
v?Tz
2426
\>I
Lk,S
2qr3jLot
WIEqW
T`qOz
s2qr
b O4
b O9
#SXH
$2`\|
\N ~
k+R@7
o*Z
HHO3
O`uOy
D&\N3
ruM;
set_AutoScaleDimensions
3333333C3CCC@
,2mr39Lst
& #3d$ZI
'U*s&
! .3c$]I
-[M"
`NOd
ru O9{
qr3qfot
9DAU,
p$>Ck7
8Y +
HGO3
V-bz[x
a*w
1i~`r
YdL
u%(Y
$3p$}I
<uko
[xS
KSv8[
7tcl
hIOK
N`uO1
<lDoN+
3\ oI
h<"?%
(3x$
2E(Z{PL0
{`vOW
IPa(+j
{_a_
gN/1
V`P=!D$Na
VS4~
% (>
8i)O
:" G+
Z`xOr
fG;SF
pXYF
4dzwM
4X4$a
5O3 {I
?_ uXwl
w#Y+@
i@b0|
S&TfALg
aiO[
B` 4u
SoKeHP:
?`)O
$wR
M@ O
.`gO
'1,c
|buk
`&e3
^@,v
O`xO
}36v*
qR1}
Gg2
G))))T
G))))S
L5L5Y3
L*O4
`vOh
"3F$fI
3k$_I
kFt$RM+
o`fOZ
ug{"
3c$QI
3[$\I
Image
+zZ>
S.XB
vq te
'#dXf
}2kM
@CUv
yx`c ]~AL=
lpylysE
Rbj
T&\ftQ
zZ3|
j`OOb
1!5Q
$?G
2`OO_
>Hc;g
l26)
&i]?
[ecgl
55 p:O
set_StartPosition
jc![
]k'
7 .3R$
X%#z6] X
;,gYWu
d3=$qI
5me?T}NL}
)6B
]sS"w[
(bfY
+B 3r
oOZEF
l/G g
` EG>$>H
1~Y 0
F1I\
Q 3Z$SI
/`ROQ
k#)a
-d_/
<ygef
5 730$II
x; f
sRkMm 5
7FAT
1$GI
d`JOd
.L30N
o}o
n zIZ
^- q
r0iz8
oerL3
||&o2
W#L|
fC-1
, ,3z$|I
T2(~<
3<$|I
J-&;p
P'f
>I2}
Mk;hf
`[ L*}iI[
;dt%
fe^W
~`nO
gn-O+FdA}&
F!lSSK\
5aww
r Nk}
efVzq
or/E
bVA V
I x#
OKJi
rP5
~*f+q
$n J=
H0O3
^ Bj{
O3#$>I
'!s;Y
5ec:2
]hlS
Form
3H3qBX
`rF;
X))))R
#+MiI[e,
!qE\
kMn'
gS..
?$72
GP_1
xhYIJ
5 <3Q$qI
O InF
n%O
g8A^
rO~q
E$>I
`A`>
@#]n
N ^qIQ-
E?9G
sx#O:]|$Z
T+ea
QUUUT/////N))))*{
fyYc
#4b_V
38$ I
X`NO[
hpKc
pmps
c@mi'
"nW
/`RO
gPpo
((}(#l#&
t`lOX
G`vOV
`3`_
s*A~M],
a O3Q%>
T*3LA\<
{3o$DI
3D9h
hD[&
w$>C
<GzA_$
RF1KE
. ugp
n.pmA8
b2~f17
:-TW8:|
ResumeLayout
G|VW+
ValueType
38TO
?S=Q
SetCompatibleTextRenderingDefault
FIE%x
t1]" 5;a
t`aO
"8s]M
mmco
tgb%q)
\MJZI
6^*(vm
"S&`
cHb9{
"$&F
um`i"RoAr&
Y`j7
dr(6/'c
3m$yI
[nsjF
.f;3
K`lOQ
%*SG
P Pu_
P Pu^
>5~f
333333334444@
Lh~)
pl>?
Q-Z"
zH ;8E:|b
zU[V
s`vOr
W`VO{
RqZ:
ToString
2&F<Y
H :#\
3_$UI
%"Q
s*": *
#zat
K c
g7u#
t(H
fEQS
b uR=
& {3N$MI
#er
%##N
3P$XI
Seminte
o#<
CcH:y;
jyDY
s O1
f&-L
v3@$SI
F!M2
P`HO}
tRoY
o)zb
q` O3
-`%O
)`MO{
)`MO`
w`BOJ
3Z$VI
F-);
[ Y2
SOg9$>I
F,
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD%
gO3 K
|`YO}
73D$_I
vXzzdc_
81\
v`iO]
^;*~
3>$VI
(`WOU
.JST
+b` m
IDATx^
xT"~
Cm r
T`AOP
^% +h
MVFr
lkwa
3a$OI
9I2$[
`==3N$
nx`B6GmWi;
Rf@Q$
$Dpx
8 +3g$
_cB~
.ctor
2 ~3:$}I
c)PgP
TOG`V[(
!jRg
%4Df%X
r}W;
y'7|dD
+n]1N
xa~&W
@w_
c .I
A6qqP[:
A!]gP
@ s$?
.`zOV
E #j
{Nw)
3[$JI
~PGV
7+()ij
Lq[+
[N);u
sla7
u'#)
Y O3
,8MjX
3T=ZfC}&
j`hO^
4^D$EG
a%&1
/ ?@
T TqZ
<kNm\\
aE':
@.reloc
VrNN
4\\D
9tE|C
8@Fc
SZsO
3G$uI
3o$wI
W $3?$ I
gPkp
M"C [x
_DKz
" +3i$UI
Blw~i
|`qOw
M{`^L
*hBW
`!F;
\ \yR
s`AOr
3 $3;$YI
"9 \
,o_m^s/
OPZu
Y `P7~5$O
!1"PC
aJO3
=u</
-(Sd6W)_
` K,h
15~
))NRsI
6$>I
[C!'
u7E}/~
2B<qd R
. x3R$XI
yWyRf
ng`MMi
#*o<#
*'O:h
t*o3
t>6`
|QBz
H 'd
g&]J
W%S
G27n
q`uO
`>Z(
1)Fgl
_`rO|
7}'s
Q`DO
?q5
JDsp
|d5O
fOb3
9MlT
(}]0
X}W
ggREq
kk\;%
jtC;<"m3S
` E,
Z`SO`
` E
J* C&
` E8
f" O7
mr31fst
[ VrU
B=Ak
( O3h$>I
PNm.F
"{=bl /
O-m S
Xogu
` E@
@r*-"i
J"P=
` E\
a_R7lK
3I$ I
5NB$&fq
I!S/!
S32zO6
/n0 p
|K [
X tGY
M6fy
CIU~
M*3AaP<
l/1
3y$RI
J j+
vU+M
zu6Ykn
@~xj
3G$ I
p(]H-I<n;J
lP] |aE
e1J%(&>H
oZ'k
K*3fES,
Q1 u:
CBD7
!O3x kI
IContainer
xm$A;R
Ag%8
NOnYY
2 3K$iI
r[gw
)0aAC_N
L`oO
O?IF
!.g
pwtDDDDDDwtDDDDDDw(
90/l
58M?
X4g9
{`hO
r_ErP^
neoE
{uS4
H ImF
KQ5P
1 3f$fI
M`BOP
O:;s
/`PO
$`,O
_83gB
_x2s
8K? I
W`;I
:Fqu
.`MO~
J`ZOz
$`*O?-$>I
<\E'
V #3'$iI
1 ,3q$
U;Kn
R&Q}P[I
L`GOI
_`nO@
q'vHl
kWpmx
|=&c
#!9 cczZz
ns ;
EQ _
I(nO
H8$=
P2SL
{gX3
]Ch?1
Eib4
h6b>t
jh03m
Z?y0
4 J3
N`mO
r7;_
IComparable
n6Nu
R&Q}P[:
#Ba|b
< ` E,
rb`p
F
`o B:Gm$m0
"bj*^
Y 8!
(!0)
/B{9H
{"pw
E!G]W[;
ywZ3`
s __v'
]*uq
RGz'MR
EJt
IAOF
fES,
6@)"
(c'h
Y 8b
+G\2
i`GO|
n(gf
mKHe
9BwuIG
`!J ">S
2/nc}
#3a$KI
jJH;
uAn@
\AF=
get_Evidence
"L* {>I
$E-FoC[;
u`oOq
Pa12
Z5:gW
24ck
) z3E$jI
3g$vI
Xh`w*
L#ugHZ,
ohNj
qO8Y
Y/<j
E `c'b5$z
ZCBExu
,sde
c>57
8,G4
3]$tI
`3B$SI
3]$
3{$gI
Y 53e$rI
pGhw
gAMA
58Fwu
'3a$TI
w3a$]I
BbFs
q%3`
X`eOi
B hWk
sKc t
;c?s
*`eO
/ }3c$
.+>S
usIh
k*J\KU,
'3^$LI
e(K4 ,6U
j ?z
qa<k
/FI$|k
3q$SI
W2(>
:q "
3B$|I
Xba1
C&@w
/qho
Tr O7
Tr O4
0 XZ
Imp/43Z|]
<nyq`
W*6l?d
~wvve
vhj 4QB
%Va^>
:=}5
=tO{yE
|qyv2
95)*R
F$>H
_ "3h#
|"Ce
+`POc
'0qY
1-]\
ggc|ovJZ9FU
DAv:K
R'nP
M6^g@[g
J}gM
O?O
2MRk
8{e9
'Dk@
EPoRZv
vG1
x`sOR
s`oO
5Xw)
i`dO
~`bOx
T O3
3^$jI
n`PO`
0 .3^$
;?@
?MO\
wFt~v
c O\
g>` E9v
;F ;
6 '3N$ I
|L] )qY
g`ROX
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
$*U
&l Q
X5B)nz
2 -3
D%Av
w`tO
]LW i Z]
3x$vI
h.]~
mscoree.dll
+9W
r`uOc
I6 dBX
,R]hY
hy9+;^
duoHO*
`!O-
W<=H
`!O3
H dcG!
`!O5
jH+(D
+2<at
]FsE
iK!N1
Ds0]A
$c%q
*'(C
!3{$}I
W`ROV
<E` I\
3g$KI
`!Oa
HTO3
w{$y
`!Or
U"gf
0L@2
fF~ ?
V -3Q$|I
y GA
`!OW
+2sF
i|V
c7S,b
D}](
c=>J
T&\fj_$
`x*s
}3p$>T
fT=q
(w#p
m>t6d
9 3[$_I
$ >3B$KI
.Zo/
v@J:
fKlR
$O3
.UPy$4
O 5_
30$_I
f0:~
!Wa<
`*j$gC>I
8,))))
((}((|((z((y(#j#%
k:fe
IJc]
U*L%
7Ueb0
Q`hOa
zO< /
d160
J FcE
uy"O _mEPI
ZXH~
{#` E
U`PO
.-**S
f+qpa
<SRx
I}?l v
xx"A<V
0 RH
qytD}j5
6&6E
DK%&
Gy327PW1
YOCW
33348
&h-g
R>3
;,))).
`!j%
79x\
W &3\$xI
C ba
P@Kv
0Y~Dc
Em2;}
r`IO]
U6`F
3m$\I
$cZW*
`y]3
s""p""_
(Pd^_[I
3~$dI
op8%
{s-O+V
`.O3
`\\3
E`JOW
QtZI
hR_k~
p`OOW
W9+Jk
RL,v$
X(w
,FzV['
B ^zM
Wp-V
W&Tu
@IEU
w3z$DI
p2p-Q<
C$gzE],
z38$\I
L<q
zlK
R6amEZ,
2l[k
LBm!
{(=st
j@` E 2
edYo[
P`COW
}<G#
|L] ~KY
`fVU
e: z
|<5h
3I; I>I
|`LOj
e`pO
x3]$ I
`1eH
^b&r
`d`r*CdE],
$IWM
J j]
g`nOv
,11b
'(5L
>7/h
`&z`8
m 6!Fd7
B%VkP>$
u .~
}|,cA
H,|.
) ("
U`YOB
jv
z3,z
Gl+Z
C ^{M
]lX)]
p`WOx
!76o
"Y 8K
Mt{&%
P~2J
b6GmW>.
15.0.0.0
Da\
o}R
.ST&]
_ e[i
\`gO
TG>k
q`iO_
^Gd_<E
X O3
:8[\
UX!e[
u1<{o0
X O=
(fwB+
2E.WIHR
i`WOx
3 3m$SI
e@T|
`yO|
RazO
`yOu
~f@Ie
:>BQ
u?@
C'JN
I GcD
hFR:-
w\ }
<3~$SI
_`QOP
uy$E,ZeERI
T'\l$y,
z`0r
F'~X
3J$ I
*` ?
^)-7B
www
{`` E
Z;~j
tR . I
3S*{
T*P|$Z>
_H %
`L@
{pqT
fX3b
Gc=S
{N_.
0L-B5=
|Wh#
fcIO
) 73=$WI
` I5
73K$lI
S*3FAF=
Nv?2
6)Tc
` I
9 #3Q$iI
i@ES
` IM
M# c9
4eL\^
i:Yo
2O
r`IOP
5t1(
<< S
!H<q
# 3j$ I
QI?-S
mR?&
osT5>TF
mV!(
>-
Zv o
3g$II
A06666960BA7BE750F48264F0EB0C8AE106C90F2
VG @#\
H`FOr
.3I$SI
1 w3'$ZI
cv~7
R`ROZ
\Bha.@/
.3q$iI
+W~(<
~j<P
MTIw'
p=\kAM:
4SHo
`MOZ
O(jhO
3C$iI
,uu]A|E
j`fOd
zL/,u#
SOwmH[=
IU1H
h`JO}
R{v]
{f` E
3qZR
O<oh
t?iLZ
\["W
y`iOE
1oA.S8g
s$>O
bK&%B
")`u
RC2e
F_iBp9
M}E\2:
(91paC
qJKz
0ryY
f*o3
d#xs
.Hze<
T*^&pV;
3l$ I
Z0/l
S`bO@
P+r
:|j[u
}dt*EP`
F.FdP>"
s.^:$ /M
`V(l
Y^D5
HWf$
d y1
>G@s
9()0
`L23
g4` EI -!
@CN3
$&SF!Q
Ilt_
$FL~
M#P}
N`iO
%(
Jb J
6Z\k
qy%X*P}PW&
zv(^
Bfv:
b5$I!
"_i a:Y
c]S!
x%O1
s31n
get_BorderStyle
,`HOy
X !3I$\I
333C3
]Y/f-+^
()qg
2[$pI
,`HOD
VfCJ!
KKS9
: "3b$MI
ComVisibleAttribute
d1!$@
2wX!
~^J
-? 0
d`ROZ
qq O2
H`OM
^`LOQ
j&e3
\.Acp
hmMR
~`gOX
*`mO~
q`YO
y`tOE
$`Zl
JZ1i
G`DOA
e`Y;
m\89
@I
x1>6\B
N) y
P :[
/`tO{
aLXD
<e` E
t`LOu
Q`hO
System.Security.Policy
JteP
w8Mm
uZE
?rU_
re]r
mAfg
$`ROG
: =3;$ I
&*6(&
vF%
g`UOd
E+3lEJ(
G|&l
B!>06
e(G1
Q ~3'$}I
3>$XI
]ym?
O5l'
, ~3=$MI
~8gz
m)p
#P
h`GOQ
N{&O
WEN
a;GzM\<
y3e$uI
lhN]7
n.M1 &<T
DI9[j
zz&L.T{$|
C2%h
b0XR
3J$PI
u`fO
.=:D
VliEZ|
K 63N$NI
G ED=
P`SOE
3r$zI
jU2h
set_AllowDrop
F BfI
,o0 6
t`TOI
T'3{PLI
D1eK:
irAS?('6Y
O Np
YGe$
c{:u
K Z|W>
3F$[I
>:8s
5fj$
V,V`
5c O
CvWG
K`YOy
9{ w
K59JB
qr3Ofot
M}f)
g.gF
Z[kl9>L
\`vO|
(x7U
uvk
5J1!kYQ=
\KL_;
cS'NM9v
Z-;p
3E$ZI
t,`e!Fe$x%
f{9u##%q
I\j]
Amq
}&A}h
tc&O2
lH-
hZP\H
Xku]"V
zov$
w4&9
n` O3
/c]0
N{n
Vh L+Vz# g
3WIN
wX0&8
U Tp[
O$B#
((~((}(({(#k#&
Z))))m
3D$sI
T`SO}
^K\a}
W->)
[`nOj
$hRP
5wrU
2008 - 2018. All rights reserved.
0ZS6
P {3\$}I
]Y)
` KA
` KM
K`tOQ
4J75
'E;waV[*
k)+>"
I3GKR
lfwvhI
7n`G
857e
`!S3
I-F|A>
$4ij
4bUF
w`kO}
^A]2
KB`Q b5$O!
l`VOI
z/a
Exception
(`wOV
7 +4
)`bO
XB?4
f^K3
` O3
[}T
(XIY
55 O9 H>I
~3C$uI
L9b5
% 25
w3{$rI
"4NP
^svc
|P] {qE
`%O/
0" }" !
]p90
e`TO{
6- ;
Y d3M$PI
#]J3
C YY}
add_FormClosed
{`RO
P$7(o
MbnP
+J E
I,V{$l<
r`JOi
3{$LI
<3X$ZI
p;f
GVu!`
8;CI/
KQF
O,V{W>
n`WO
r O1
7 PI
r O4
L))))^
O[z7
@:u
}+AH6
3M$hI
0J*b
qZ O3
'E"B
3?$wI
IPsQ 0I
$b&Oc
lL]
A=JZA_-
k @ @
pf2%K
R t*
s=?]G0
2W?dJ
g7}0
D];
5um%
SuppressIldasmAttribute
L:>3
yH[
bu E
(E5WM
d}rk
E `Q
m[`P=OO$Na
j$*WF
F1!@:
Y`VO[
PGEj
C=d|
U`UOU
Qoc;
*Nsp
j&gW
0Ba
R`MOA
>/~\
Y`VO|
MOE`i
XiZD
9VzWW&
3 3l$HI
|Em3g
;,$'
`x`a<@mI\%
tjA8 F
H A0
qA@k#VSg
BY>.
VrY<
N&%c
CE }>
>Hq-5
\`bO`
N`lOp
r|0;1
26Z&
fvxF&
{Y\^G
#Yw5
u~nA
sKr5M
`3;$ I
R`TOP
&W|
<Module>
q;!.Q
fr c
gn`L*]oPVI
kT9\
qt5 <}
T`OOK
HVO3
O -zr
` E %%>I
V +3}$NI
9`@U
3]$jI
`6O3
nJC+c
YO|^
t24
)$z$&
>q0e
d`BOf
-lo(u
YOTmPa
DeflateStream
KFjW_e
DX(9i
3N$sI
i`HOG
u_5IQ
0 u
r}2F
J$MM
) y3g$[I
^S N`8
0_3 ]4
$"")
1K&9
N JnA
]K`c ^xQJ,
5mTF
: 93@${I
|5 #
dR-T
[iVMI
m9j4R
set_Image
O3t(#,
GxIF'
W [yR
+"0d
=''m
:Vl&
v(S=>
SO`|V[(
MNhC
EventHandler
@:T#\5
a 7{
LR #
Rt E
T=zE
j:C[
e~p)Q
2`wOb
k"8yd
3]$WI
>X]0E
|p`c&C`AL
pz}j3@
Y X}W
D^bX
i`gOi
,%sE Yo
SatmJ[;
2E2"4
al{
Mveb:
s NjB
TTcW
YmkD
GH0=
.Xe]0
H4#z7
Y)ap
E
;bPR
set_Icon
PBc?L5|
System.ComponentModel
M?ZdALI
6aoO3L$>I
,}R~gy
Ok|i~gper#
s Nj}
O^pu
V`dO
` M3
qr3~fot
6&/9
eP"N
Ko/+
e4'qX
~`nOr
1&gqKZv
~_7PL
V$5
X3J3
|*V,
]C2|
a O3
: BXMc
System.Windows.Forms
lqU10
Q"uo
D/-A
,&A
%`gOb
1g1H\6$>CI(
vJV)
r?%Q
B _{L
m/ #
:A ~12
A%>^
disposing
#pf!@b_
}PGU
8v?a
yE]S
(qv:
e^$X\
tRoAXa
:a-~
?O7czU
9 3j$ I
'#bn
d4`p
TLJA:
v`LO`
,Ez4
9:;>
/m-^
n.A3
- )3{$iI
v4(h}
'#aAx
]"n_'
,}]
D*O9u
E&^5
QQ3z"
Ls-y4Pu
.Q$k
38$nI
+`XO|
$3x$ I
X`LOt
k<b<CU
H`WO]
x# V
m`Z,|
o2g
]zM
H`WOc
Iv+2
["?A
i3XWM!
=``M"
u`TO\
mS$PJ
`| b6GmWj;
v5x#
IV*9
moy>.
FRX)Jf;o
SOtmP{'
u`TO|
3z$sI
d6~9v:>I
L O3
HQH|
System.Security
%lIU
<V(.
3I$>
y3EO
&bpj
G`qOz
W: M
T(2
Y 8v
+6J1yd
e` jk
;X?B
E;lXEZ-
KZ8DV
+a/q
VcK"P
`!B:$"7&
X;)5
aQ/{\
tk~z
N TF
_`3Hq
b}yIC
y`NOA
<3#$rI
1 "3Y$wI
d FotO
@.T|
T&\feJ=
1 !3<$dI
hZ.4
8s49Z8
\`DOi
[A]<
f O3
2SQi
)$Ry
QcrQ
t=RfW>-
get_CurrentDomain
r%%m!!j!!h Y
PT>
Mf=H'~
[`wO@
5Mk<
?GO!0
M X*_NKL$
[`GOc
;[`!
a2N3
pPM"
`w[V
3`$mI
T5xb
E)R}HJ
o{M" $>I
O3($>I
Wq:j
R }3[$PI
ToByte
9 m
% X
;*5
Uaq7
K3 %"A
r0N1
2`oOK
G>H@D
|Cr*
Q`bO
t`GO[
#Blob
N Ax
Tlx8
<Y*Wsi
n}$i8
y'(((BR))))^
iL$m;
@w!=
7,*<s
?NB`k
0fS,3
p`rO
Sv%
?( '
$`UO
[, #
z38$UI
r% .
q'Y@J$>C
3y$GI
h`wOc
93b$|I
o`mOb
#l~Le
a.N:
$ '3}$PI
r`"OR
;P'-
d Xc
`8O3
Qi9{u#
v`kOz
sAC/v~
+O3 !I
$,X O
Oo1$>I
'dV;z
J'V<
MadaJZ&
zz EOfAJJz
3k$dI
j#Z?
6I6e5$w)b
3xqUI8
k{";
Ia. WE
m3Xy
\65!T5Z
N`LO[
3:$ I
SDJ~
+A E
S)VzV[-
q# u
E]O
(-blgT3
\ @1
A3?6
3 :3R$>
` O1
` O0
` O3
` O2
` O5
` O7
1X4$(
1v09
O:]l$m=
8LTD
~3N$}I
F S$+
;3i9s{
&|Dug
u {^g
H=t+
i3yh
l8 }
5g O
lrb'"6{
tk9(V
G AfI
G AfN
/M(
b`-O
oiH<L
,_%X
6tfim%
ZwlV
1w!-
$|G2
t``a
3R$II
.`nO]
T&EiPQ;
'Y*}L
T`cOU
PJaq&
k`NOY
vaT}Z
.3i$
`,@r
P2`@Hw]
r)}%
.BU,A
{FSyr
5FTH
>N ]
e`PO]
mbz
j&^4
fI u
d N=
S` N
=}W8
TO~gR[
WL%K
iut'
^$>H
) 30$ I
HVf,
Y`UOR
a}I0
9}'oU
T*3EKH,
d N2
W<XE
!%iB|
%9]|
3{$HI
<N|[
/`-
`/x
Y9r
H HlG
YVeR
jdS[
)0Ko
` O3
t56;
X /*
(3_$tI
&
X O.{$
m]J|
D\-co
mvGO
kr$<
Y`ZOE
,},^8
1Px5
-`GOj
9_OU
PPCJR
Ypl,
1 v3p$
14q
[~*|
v:>X
{` Oc
aNT$D
p'WI
)A=l
"fl^
A"V|AL:
!V}PL(
3A${I
$ J
J9 6
(a;[m
Q-.i'
=:umQ>=-#c#v
R*y0 %
q%qg
zqLj
Bmaz)
{GCC
}3=$HI
FTmn_^
WrapNonExceptionThrows
2`aOb
}|6v
h Yb
pj#O?JNH_.
}!k<
hL,R
3' U_
]ek$
SaggKR:
3m$RI
! 3R$MI
&*89
E `k'b5$r
mu8x
. 73~$pI
&*8-
p!>I
&*8W
&*8Q
&*8\
&*8]
"z:
!{ +
)` O^
$QI
3m$ I
cx
v 5v,"#
&*8|
&*8d
=`HK3
&*8h
. .3x$qI
&*8j
ACYF*
N_ ~
C|P
,3b$|I
a( o
S`xOg
B:N6d'
He ?3
3N$wI
_kA$ y
L LhC
`xOK
U"VzE\%
8>r7^
Evidence
7=lX
K^b+
`*C%
3{$qI
_ T \fR[;
$>OK3
T&]obW%
Dl\8
x"}=
fX22
FRrK@0
o`LOZ
XW3X
`o+M !t
E T
n B
3`$oI
5URC
AWR9YwVA@
v*WAzP=
?skO
b*/ v
xx E!GiPW&
:=Lm
A P8
Z5Tq
( ;3O$FI
k#;8
x"}\
D6U
.?[
k!q9 Ri
%3C$
Vx=:
>;@@
Gu^j
'LA
I`zOT
,\xH
3c$dI
ax*R
<OB)
P {3~$
Z6 an
1b
/`AO
}H9a]
, d3l$_I
38$wI
i5ut
0J5D*
3g$ I
rl3G
>wq{
+i,al
4HRfA
xd`s*G
[V,.B
`*;"
SM7JWD!?
&da>
I-F|AMI
-_81s
n88,
x##t""c
O5k O5 s>I
~Qu.
]|tJ;
`3M$fI
wS7}
3<$JI
s O9
s O;
V RwX
Ioue
s O7
"KNCHo
*Ph )
Xz88
A;V[Q\
j`aOr
E=3oAJ
2iN]\
nDS
EF(G
U }I[
V!%gwX
~`UO1
`pZEi
LtH]
3J$}I
(YP_yt
y=J+
x(W:
c4 k
L0 Q6J
Nl@0
!/cX
ed&]
o`pOt
MG^JD
g`jOv
W 63
3l$SI
q|ZRn
W1}W
6_De
:O3 9I
?Wd(3
C 3L
EOdc
1,dFLS
GSq
]fhZ
] \xS
Z VsT
oD.`
I ]5
*I\N
oq^0
3tT1
7n=B
\<u0
3a$xI
!QPO
~'{f
fDQ ?
6KoU
I`FOI
NT|.
K`yO\
%%Wf+H^
) ?3o$SI
uH2"
0d O5
<U@5
qU(p
fx O,3
oIb?V~
E3rYJ
GuidAttribute
+:Z.t
a\;G:
|P] 7KE
G BfI
333334344444@
/kBc
3348
R&]ofK
edn7
b.A/
E!GZAM,
`*\%
`*\6
{T ]
BDKY
L MiB
L MiC
_ ^o
E `G
E `E
E `K
qi?m W}H[
h5Ps
E `W
r,hV$'
D$7u
)DsH
d@kf
.`5O1
P`uOz
N Ko@
N KoA
a/hr{o
v`GO
c9Ld
m2~fQ
4=\A<@mI\%
B>1!}g
E C`K
E C`H
B% N
{TIFsQ d
?=b H
d+`%
z`AOz
j3]"
#JovI`
&"$F
R` L
&e*V
]7jb
Nj5JC
g`VOg
add_ResourceResolve
c Qc
8 3o$
B;> s
)){**
AssemblyTitleAttribute
^ [xP
EMWZ[
Fyry
.(:bkQE
w}a"
XkB&
*> &
@nL3
SOvpG[9
lJNF
3r$VI
*`lOu
,?na
h`0U
8 y
39$HI
sz}iT)x
N_ r
j/a?
s`WOg
3xZcI
9Z C
>"6B1
$>1
uA0X
'<y
`<O3
" ;z
!1K
!S<VeFR0
F"D.4C
F 3[]M=
`B+E6`a^[I
\wX
/?MJ
pN N(_m$l,
C9 i
r^Y!
}3fw7/+
'E;r{W[$
\`uOY
I-F|A>
yS[tH
_Cpd@
+M E
e
qr3|fot
mbBpV
Bi.-
Lghf
zy EOzfR_%
AunTZ^
H#$4
@AK?
3l$vI
-3k$xI
`PN3
%e^+W*
D)8[0
\|O
"HDv(
rt E
RD P
A7[$T
),6X
GOtmPp&
LQwy]
Y))))t
Zk -25
p`UOg
d3p$xI
@L'h
f`_ ?
)' |
(`IO
x}HV
05+J
[`oOw
"|7u[
o^{GQ;
peM{
$I6
\R6Up4
Eh*O]
Q:V{P[-
lha, v
Y 8A
Z|H[
oMKi
]Hy>
eLr1a!(z
Tx[=8o
0gUH
` I" LI
Z`aO
Y 8e
t@%=
E.7*+Q
`hO3
3j$II
cq+ d
`*b!
9[5XP1^
fqX`e
T?f L
} mhp
Z`aOq
:,)))-
x)C.
g +k
Z`aOW
#]s3
_kgDE\+
Y 93Z$[I
hMa}
PCQ r
O JnF
> 2&
{X` E
O JnA
w&mq
HXO3
'~5$
(`xO
Assembly
`b]3
!-O+FdA
cZLP
(`!O
'Xc$/
DL9l_+
DDDDDD
JSiqm
$?&K9
:wyN
d`uOy
]F%J
Zbf4
4 ~3x$xI
E `r7b5$m
{%` E
O5.2
q^m3
D|EP
Dictionary`2
G.Gm$n(
^iC[I
v5>I
k>N7
m{ }
rC]2|
:#V_
OHMm
%jyu
E.^EKZ,
U#RMI
set_AutoScaleMode
(H.G*0(
E `j7b5$u
%s17
RS}R
'E;pgIS(
*s{x
set_ShowIcon
mFOL
_ Z~Q
= 6l
uKm?
W=F|7
d&Oi
F7J^.
>j;u
Vpc7
K DBy
b'Xk
O2
~&>wN
dw#J
, [\N
N`oO3
aZ@s
LI Y
}%L5
yjBL
N`oOA
] =
g$N
Qsa%-'
Qi0^
H` E*,
R`oOy
!3>$sI
kO[QPc
aLOi
O ;39${I
i`pOr
5t$>O
N&Im@>
:'"!.&&
P4Cm
]A0X
g|&"
j9: K(N
a PK
33CH
% `3a$yI
J2u*,P`
0(
'3F$VI
d H" K
FKn\
3'$uI
1f(
o)3NMP(
d`YOc
*NkQ9\
HXl"
`|O3
d &"
4+6#
R .3>$PI
S FzG[
_ HMO
"4I^\
D,^I
)IBJ
AssemblyCopyrightAttribute
q" v
)Dm
j0l}
T3=3
" >3I$dI
S\@\
reW9
KQkh
ALHt
!_:N
`.[3
S~K;
'3Y$ZI
-?a*
H9O3
2$>I
U Sp[
-v 9n
X X|W
{"nA
J>;~M
RuntimeHelpers
e'\A
w 8T
b}f1
:Y A(]gWJ
u"i4
T }3l$SI
WG2c
F ]aF
zOby
dw-im
3]$[I
3r$wI
9w2eVaJ
\ z:AH
DP<6
X`FOc
qr3Nvot
Z`.Ox
n~Pw
m $3
gi).
_f <]@[
#x27
!3]$FI
3j$TI
u~
- 3O$mI
fME[s
R`xOU
d$>C
s` O3
`x}zU
4+0{
(Eyt?
j@` E
:${'
s `+
j T*
^d#MF
f; `
VeKL0
0MeL
aI s
2`vOw
D`fO
/ O3
z)l_
m6<w
jX 9
a O\
(cps
`B"L PcwW3
a OO
v`JO
#N8{
!2 5(%?[
SuspendLayout
.cctor
9 {d
%@On
set_FormBorderStyle
s&.9v!7
\GBOE
xCnw
(3p$KI
]&si
i>y6
~Y]a
`[A
3f$VI
yVxH6
3 <3?$SI
=w 9
NP.o
HtlQ
RN; $<I
kzudE
LyQ'
"%.I
P 3l$SI
asNH w
L Lm
`37I!
+>MK
7c ,
System.Reflection
`RZ
#B.e
Me}B
eY2t
. <3`$JI
*`oOq
Aw+)
H`YOW
h&O2
h&O1
8E9C46FA138B09F01CACF0AF2B97C3F8A90ADAF9
H`YO]
_ O3
2gOp
K FcE
I~j.
(aY)IEE
T+/V
MCj9
s`MO
q` O
\ @%
aHE-$
%`dOz
c2OY
7q&X
'nj`
Vh 2
* 3A$PI
P 3{$UI
6|0H
U=R|MQ'
d*_i]j
}3Z$yI
$ ;3Z$ I
d(g]
-]7v
lV0L
-%4n
rk>"
u De
:7^2
K6MP
as O5
5 3y$KI
wZ$>H
o>C5p
w 0Ao
E BgH
+)AF/
Of4U
CmGW(
fb/i
A `H^
dd-L<v
HfM]%
HOgghQ>
dY 8e
@oTxOH
.i <
O,V{W>.
_`MO
System.IO.Compression
VpiP6
M $>M
eh;El
||A<54tm
$$|#$y##v""s""p""m!!j!!h e c b U
M` Pr
K`vOU
K vv
`#O3
r`cOI
`#O=
b!Og
C ]yR
S0*M.
7$>O
&FVa:
F ?h
2!R$
f?@U&rkG[:
`#OY
, >3n$II
8Tiw
8a
\_bd
O37$>I
3{$RI
+O(hpY
`#Od
JWZ2
Y x3\$vI
vga
Z nh/l
yIS
?V`h1
P`NOF
s6JJ
G`rOz
Dw4!
wh'*
PkAM:
<_n6
93~$hI
OIJu
o`7Z
*3z$fI
J74y
8<L6
M6>3\
q"V$
Uv)j
?kPM
_AppDomain
v-p_
X;z?
hhZ`
i k.R
O;VkP>%
6284
D`QO~
$lP D
a9Lq
q T'
0~a|
0G^_
o&GF
' &r
e`EO3
ac<e
u .m
0n+::
3448
O. !
'`8&
``O3J$>I
kuT
V '3O$>
&3G$QI
6 53p$tI
@ @dO
{*:o
2p$hI
_a1p
e,8k
V`pOd
YTXF
M|CYZ
[?8p"
.&<
/$IFbQ
EO|xAPI
`UF;
^0:c*`y
<<f}
$3!6;8
Us2 90
3I$]I
M_F p
7Q{A
,Vs3v%
p`YO^
%+ lW
T (3a$]I
a,))).
18`$
|`NOJ
JGfF
@`\y
|`NO@
ResolveEventArgs
yR sSS?
xk+~
u \xS
2{65
fO}3
_4+_
KxoR
Y` O{
)8W1\
;JK9
}(FH
S`rO
z`dO
Q`FOq
N$>I
FC[~$
v| I5R|MQ'
3X59h
L-g2
Y `QP
kr[3
&z0%
roBQ
`lO3
vg\|
3wnU)
- {3c$WI
VDo~
3-:$
3C$vI
1"ip
/g0J
F3&9
TF%T
t"}j
[ UqZ
p)zV
_ \)
.`YOg
3(;3
6R]O/
"uil
e' 0
`2%#
kAI:
DJ[t
z A
.`YO^
4"%.I
X$>A
3z$fI
@KTG
S`UOZ
TX0UP +
_$>H
K'
ea!'
Y`sO
`Ja'-
6`UO`
UiQw
u5Y (
?:?(
K 53E$ I
System.Resources
JZjT
},ZF
h`pOx
-`WO
6c6d31
#40}=f.
` W4
mD}
GAS$\L
}7+M
sUpvW
- K\]<
` t 6
3Y<GmI
rz "
1dST6S
C*@{l_'
`Z}O
Icon
Lz/RB M&
T`bOJ
R z3f$FI
<lyX
|OBJn z
F^A3
_e:h
?&vj
ygr&
T 3x$wI
`!_3
fd0x
O5"7
3D$oI
K!:\
j<` K
C :g
A _{L
MV_d
',x[~&
4dWw
3 #UtTc
":V[
cd O7(
m,l#
zax|h
UzS7
2%3Lc5
#'_QB
.a!*(
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
90jM
OGZi
0/8l]]
ha 4c5
$zR#_2>
TO|xAP
f&4|
L ^' J>I
$L=b*
e72\
s*wp
wua
2`UO~
2`UO|
1.5
i`MOD
B`"Oj
OUx
}VPs
k`jO{
~ G>
}[ r l
`@O3
_yd]
<& .3Q$DI
y Lv&
ak>=
<V` E" UI
h9k+
P\:\
QHr7U
System.Drawing
{`eO[
/2}?
V*_5
&W-n
$`hOJ
3O3
h[ 3
dP.+
v >I
.';X
O #3a$
X Y~V
l`POA
lo`c
|,*/
g^` E5g9>I
`"Og
)`YO
4LE@|
,ZM-
'5 1
Ur+P
3;$nI
3~$TI
&'1.
F`EO1
v3a$ I
|N$EQ6=
S.TmfQ1
A<gn
/r*m
tb_[
#O3RK
5?q
H&W
#`Xv3
vi(O
3r$iI
?] x
{LhmYz
AmFR
&&9b
^VG2m
~`uOE
:!S>
GetDomain
XNw&
EditorBrowsableState
39$FI
x>O;
9 63<$sI
~ P'Vzp[1
K`oOz
CultureInfo
! ?3^$QI
B.NT
N,C}KW
~Q^
E FoC
x-nhx
M Kh@
Se;.<
lzL5
y!prx
ZTW/[Oo
u6m.|2
eO~
8!@uH
|x L|
63i$KI
"}Me
PcB:R
VWu&
3]';
pjaV
y<}5[
QPe-
$X'M#
%`AOp
DtS)
ed MpX
i!G>
C<oBT
` nxUJ
s'Y
)^H
` \3
- ONi$\I
. O3
!b@_a
Lij
n`JOR
p`dOB
"O3g
InF
(wsf4
}umo5=M
:VBb\
SdDr
r |J
`*e;"%.I
T }J[
H __#
OQ.(
Am4L
M-Vz$L,
56l
Qv=H
E=zfBQI
\ s7
7,z"
1(a?
i\rOE
PictureBox
( {x
>= D
$ 3>$
w`VOj
E`OOx
x`iOw
+f9L
h?\-
sNOa
T1bw
^`VOt
U` Pv
s,l^
}R=j
En+B
53R$kI
0$\F>
I?j<
p O2
2c$zI
6I[Qw
[(_k
$*+!/
%?
|L]
e`bO_
s )|^#
';V"
C5r\bF-y
G*ugVS(
2DF/
v`KOT
3jY,h
`'O2
g`kOb
f)// f
.E.3i
v#*ou
n#5a
" 1?
vCZ6
3=$hI
?9"c
qF B
E<Gm@n;
! 3;$QI
G`uOG
pI6Vr
~qR4T
}UO$
SnR\
7sHD
;3|$jI
t^8`Xf
m^A~
X`OOJ
v2.0.50727
GVO&#n
k7vy
] 7U1
$ <3I$HI
-3q$
-` nz
'3f$zI
#,X$<
m`TOZ
uplz
rIR6
2r O2
I;\zW
VoIs ?
)`dOw
I$>I
0ltcGG
0_BX
]TNG\
L S~S
|-<C
D._gJ[t
"<lhy
M)jM
])m_d%
BOMI
z'U~
nuV NU
MAa/
5'cp
h:W
b;'
!738$LI
i`IOU
8S7 G&C%V
OGpu
i-$f(2
3I$]I
<Y +
:NU)
e[FK9
V<%!
lk;r
,Pz,
rX)q
A?"{
\`GOX
HHV5
UVsIA
`$^% P>I
g1re z
{AXUJ
dR=N:
wp~w
AA2Ti
D D`K
%J3)
gmd>P
33333CCCCCCC@
UJO =
@ AfN
N`jOa
iDDJ
X p
.3r$yI
h,OuI
YHsi
wqD0b<
T`aOc
3K$qI
xAt),O*
Jg D
]vPi
CoOG
@WN0
"7J
V \xS
9e'
">bC&
s MjB
X)))))))))))))))))z
rA*j
VzK>&
GetManifestResourceNames
o=N1
U[_(
dB2Q
i*Gf
reMx
3@$UI
{vv/
>B83
[qpjF
a v~
A>Gp
9q\r,
=Qrm
^wu!
[zA_-
3c$ I
?N5Kz|
3P$FI
3x$OI
D`l8
/jyo
g\Q.
PS 5k
']3B
1 h`F]
\huhI0
HwO3
wEyk7v
venK
IP+d =:
#
T`IOF
3 831$HI
<,s
: }3F$GI
yc%
haN"
g N!I5
Bitmap
zc^io@+v
`r]3
\fP_
T# _
Q 3k$WI
O5 S>I
pX9>
/~U<
!hC2v+<
gbPK
'Iee_s [V
hP ^r
7iTd
AQjd
;UB;
`B#O+VJEM,
=b!]
5@Djb
O0 >
%3e$vI
3<$_I
O+1K
rGZ}?o
P9@7X
2-Ae
JDDI
MQz y
ZOVM
/Z"F
,'Fu
59^=
%/k< {
# Rr;
r`fO
&n}3
UJ]J,
kQB
/[^E9E
f]G F
gzEbb
Yaj++
`$g5
`$g4
3C%:
Thread
Y`wOE
b=8v
/&+)
RN]A
nkLj
)$>I
`i]3
Y ,3}$fI
xlYF
5k O
R|E3!
(W+bc|
K#Y
:aj-
~B 2
o`NOY
,`qO~
s%%n!!l!!\
4 *3N$OI
D EaJ
E:Ix
W`SO
<e` I
I\1$>C
6`kOP
Ek$L
3<$TI
E'tn
r h&
NHB}+
d!y:
D} l
OO0$>I
g9 U~
X`rOq
@HHd
set_Opacity
6@J^\
3=$jI
#Fo<
sGzQM=
IEvidenceFactory
~ I'
2`dOd
8_~<>Q
DV s
(x+a]
n`ZOz
m$-n
\ \xS
;nk
,Ca "8M
AssemblyFileVersionAttribute
SzsU%e >
2(Z\
e1I\
%vQO
$`tOv
1(+_
WriteLine
3a$VI
[$G,
"$>O
PDN`k
}LV_
M1hK
5m O5
vagD
iv3'k
=`$_3
R`nOl
6 3
?AgGp(
V oqT
9q*
M J
$c1O
",>J
CZeg9
'zGkH
W% DNT
$5G E
)#s#&
8rvf
y`dOP
3$>I
pA)z?v
/ ,d
:&@,I
$% R
Z))))n
8Q[z
bm?
Rk &
e=J. 6
m<`P=O*$Na
X* j
r{7GS
mr30vst
W O3
-*7p
RYcf
xv"IM
4 d@y
o`aO_
f1\
i0)f
$>T
8 {3m$rI
3=$lI
l0^wGj
yn.2
rdG(
zpW
?38$LI
3Z$nI
ewH<
fXn4
/`COK
f=G2
+FXBs|r
I`WOb
O#oZ
\n@Z
< ` E*
g`tOR
K`jOz
T >3p$
Dvz#2
{6 2
:3J$ I
Z'8?
O3h L:
!0V<
Az9
3}$]I
qi4E"CXEJ!
2)?E
RuntimeFieldHandle
svp9
Y +3}$QI
d3?$fI
zkB;
-eEN&"(w
Bm* re
_Type
|`YO
2vS&Q
H1G `[U
Lx^Z
5wD l
K-?F
4 3r$_I
Is O0
`&^9
K`sOl
J%42
ZY0
)#q#&
yB7t6
7 !3L$pI
3_$uI
V y30$XI
3x$II
tq-~
yxN:
3Q$NI
i,@-3Z
M`oO
r~c2
-%t^
7CSU
T% 4
/ d3Z$tI
_:mu
cglm
^BGcpt
9pvm G
ck O7
64ey
L0/q
JW[I
&*8w
g!X
A#uaH[
N|6Gx
+C9M&J
-38$oI
j y??K
3>$NI
!-6'a
/R{0
h1/?(",
:7KI
?>K>b
Dx~Pd
$|X(
yPwC
E!@aKPI
=3D$ I
>5%F
Nb f1"
C-mt
/O3 !I
~]&D
@y]y
\ ]yR
3M$|I
5L:fQ
3]$FI
u,OvD
Q?]p
MO`qWJ,
mwQ/
1m6J
zq8@
set_Item
:k{*
a!{9,-
3`{O
BS5$
C x#6lb
J<]4
ox'
VLAA
`B,O,Rdt_=
lOB$
U SpX
v$ND
S24g_-
,2>H
LCB8
y-nP
ic0G
q}Q
RaPx&
\`kOA
]Q`m
Z%Ml
yn`d&RdKY
}5Sa
FG/(
0= {
r*_i\_=
FL] 9[Y
b-P>
%|Z&%M
$`WO|
TOamEZ
G Mz))
[e]O)aW
FH+O3
$8&u9
get_Name
Rk@N
A/tz
y\K``
G/u2r
*` OQ
f?Z.y
"3L$GI
~?sNfa
,X4$(
Oh N
q` Ob
sHaB
ii+uv
FcYF
D:_m$Y,
_CorExeMain
mBu{
A29}}
,gJ4;w
5@rw
`"O
6"*.t
`"O6
`"O3
`"O2
LK1D
2X /
>Jze
`"O#
`"O
~3N$kI
Convert
xx`b&GeEN
9uSN>@
`"OS
PE!-
;3#$FI
qw#4
a $5VUa
`"Oz
`"Ow
`"Os
`"Oq
*^i0
`"On
`"Om
-&|N1m
O& 5
<(` I
0B*m
&=mj{
O))))s
l':&
QrU\
jf:Q2
jAbw
f0T]
R*Rl$n(
qJ">
.L3#
dvlg
N;diMJ
cHY+V
mgn0
53L$nI
}3I$YI
BI{!
z Tk4
Jxq*
"uJ2
`x`r*RlmP=
+3R$ I
z/! #
T y3\$DI
-GPp
Ef4L
<$a8
|lBLe
OSd /
(` OK
c:18{
R9N
ggCK0 Q6
. O2 s>I
U"QmVq/
3g$XI
66I$
'b5$ 1
`xNY.
LOVX
LzjJ
bZ)3
`'gB
81f9655e-3154-97.Resources.resources
vT6_
=HEZ
j'c5
S*3[]M=
^BA@zva>
N2&j2
+Evp
^/^xi
V:TR
}VD0a
jq]b
z`OO]
*W{b#
}7N-
`$^7
q"1n
cS hG
$>b
)*Qr
%D({y
D4(.
!/?d
*3C$gI
333345UU446f
pf_2
I9eI
|P] ?qE
Write
M<};)
?o<
Qrjj
Npm;
STAThreadAttribute
, 53J$sI
B`S
3L$hI
5EN*
4kcH~uX
!CYPG
S_Rd
< ` E
HNH]
`'O$
K{RC
0, Ii
7\;#
@}'/
{}m\
3Y$wI
5# O5
~'W : $
"rKU
"3F$WI
hH<5j
Otpu
p $~$$|$$z$$x$$u$$s$#r##p##n##m##l##k##j##j#
Console
CF__
cmxV
~UrX;
XX$S
p`mOC
^8!Ne
T)$Q
`?D
GoNXo
e**o
9 3]$rI
Q\9^
$C@)
j(H;g
RiwD;
r|w
r7h5zL
System.Globalization
*_!#L
#*-X
N`MO
N$IG
0] o
s5.{H
X23Q:4
E `D7b5$P!
H^1$%8l
GG2&(50
@dpC
O0?*k
$:ia8
_`HO3
v\nQ`
X6 ay
T/~$
y%;K
hN:7G
% 3O$vI
I HlG
os KX
}X43
8| p
D \lA
:V~7
q O2
q O3
q O1
7ScA>
MC|v
B| U*3[AJ
Enter
of;r
AmeQ
Uy!
!3r$|I
d6z>&o
]i[E
{4B+f_r^r[r
V|LQ-
= N,
L;3IWG'
73P$sI
get_EntryPoint
Z`LL^
x3b$xI
}3x$dI
dSUel;
{3i$hI
t X\
}3`$JI
7c1O
{s&L.T{$['
RKX`%
DY0F
Odpu
7+uuT
\` O
jUFj
[m
3Q$pI
LE^5
qpNl&]y$
AssemblyDescriptionAttribute
f" O7
\7iDg
|K~T
L){
(3B$uI
FPN,O3G
U<T2
V&G:&!
N(V\]N,
VGS-<d
2 d3z$
Y=hh
`*e$#'(b
3x$nI
UaYN
`WO~
O3)c>3
7 O3#$>I
3aBs
yFcb
ZHLPW4nV
C*@{gQ'
jax{
O3>$>I
-"aU
m Xk
4 3b$yI
ComponentResourceManager
'6is
y3m$SI
|3~$rI
}3=$rI
. ?3p$
2h:G
4 63z$yI
7z*s
$$~$${$$
@']n
EBGlv
`"M=
O ?3;$pI
333C
WXT,
L*Rf$}!
93F$
(3S&
333H
LQmv
dP1$
%3C$iI
f1a ?
62zn
I#Vzc['
b>{`w[
t6Cm@l,
/$Na
RgD
a|k$
zFGEj
`!g#
0 }3O$xI
d O3 $:I
bUGP
O,V{Ww'
W`NO]
1w12
`B3C.]8$Y,
3F$gI
Ok`u
ovO3p
`&1*
f5|1
4$>I
hkEd$
!|3o$PI
]q{)M
0h\ .
ohGE
/`OOz
wS FO
\`EO
4_op
\sGL
3i$xI
ra]v #?A
L "&
g`aO
_'%`HU
(`OOK
50,'
g0 I,AgWQ/
9E}x~
I\5$>C
!y ]b
_)g^
&I#V[]M=
qoOL
#Strings
9$&'k
.`dO
eAEb
z'O+
`=?3^$LI
I'Tq
8PAF8<
$ D>
.~=!#
get_Length
E3D!Tp
%DX;
%P<=
{3_$KI
_r-Y
G`JOT
G`JOW
lt8u
"](X
We#X.
)3b$vI
(Bfz
OOwaGJ
}[OK
\ kJJ
d\j
#vi'
[:Q6
aUl'
System.Runtime.CompilerServices
{q>.
jZ] xt
jFVk
-?J8
->bC
dq C.GaKPg
-^E0
D|9^
NGOx
;3RhM0
C))))))))))))))))))W
.2-Ke
r>0q
7Q1H'/i
w3rc
j-=4
uUOu
IEquatable`1
V y3}$lI
u~ A(VGT[;
MOgqT[I
:`b
# 3M$HI
`3x$\I
|3'$yI
FormBorderStyle
P aK[
v~?F!
NoNt
[`bOg
U1xL
I3.D
xWXp\
|p];V
3y$LI
4WJS
` OlKKL
w`nO`
=PmQ,
B:6Y
<h` E8
xd_N
K Hh}
K4^%
.`I,
7fm\4e
~`hOj
{7t"
u<}:L
*<FJF
Po_]M2
0 .3Y$
TxU87
I b($
`>O3
U RwX
P#ZkMJI
,G4_,
[ z+
E`ZOB
O5v->I
E D`K
@;]7
@wx'i
;1aI9
aDOA
UX 5
UP1%
!BY
Oi"k
e$.
" 83b$}I
_` H
plw5
Data
')9+;-J
5u(N:]
{pnI
"z*"
F[U>
v`mO
~`MO
pHYs
tfs!
:3q$rI
800.B
(+6Kw
}<R6
3L$RI
P lhp
}DY)
adwA
e<D*
6 )3F$DI
`&Oz
GFk_
j1I(g
P]B ?
j X,*)
!3r$zI
Uec8
7"h
.'*.gP
C!rl
!Kw-_J Z8
GFk)
`&O3
`&O2
zw&!
2a$\I
.WT%
A. m>
`&O
r?D
~uQTX
3UX',
bnpi
3i$[I
}s:}
r`nO|
*Km$}&
3z$lI
;7U~
k2u5
['(
Byte
^;,%`
53rc
grx
BnAX
aY@~
!-`c
3MI@
%</f
];q9
(!$C
s`MO_
" []f
HBO3
5z]0
Oe&KW
X ?3R$MI
M`eOt
}3O$fI
mN Z*3{AJ
^i(O
alD-
E/-;
}s@d
jjS7w
k V
miWWu
*`n!iR+
<4hx
aH_DZA
9C^:
G @K
+ 638$OI
$ 3J$wI
3n$gI
Z`DO
Ce5 ?
53y${I
^D/1
Oc`u
|ZV
_`vOX
0\;O3
VD]n
W TxM
S`FOf
Vd!G&_m`Q=
*L^v
9pxK
^ Ajx
WkSw
F^K3
P.9o
OZpu
.$m}wh
|&Hk
38$pI
X(`~`pX
O`WOv
O0 $>;
/57'
y0?
3O$hI
3 V_)
5#Ij
BorderStyle
b
Q 3E$jI
=.A+
=MfB
^n/*
& 73]$II
Yh8k0,
:L2p
3\$}I
v=d#
LwM:Fp
7.<I
:Xs*
SetData
3#${I
cI "
Y{X;
D FfGJ
O`EO
set_ClientSize
4H=Vi@m=
)"A/
>v&^5
X r
R5RS
?2Y:5\
=3G$]I
y iF
Tsue
X ]
L#3cAL'
Se/G
mft2
Z`pO_
i 9(G
n*EBN
km :M
X 8
X 9
q=".
]b'
x"F+
,Xas
5Ink
O_>$>I
K%5o
T&\fbW%
hvrZ
.jbsw_?
@1M]
l)Ov $>I
8nI
MFGt
%^g|
YD:k
jI?8
NoLx
HvO3
#v*0nVh^i
'jar
uUM7
x`TO
AssemblyProductAttribute
'5hk
f\'ftX
O2 {@d
D$'G
}*;%
`~OX
og& /
j5?y
-F3 %,
"a"RI
h'0:
{j9:
ystx
] O3
-IsL<l
J{P[$
=[)/)
VpSq)
D`tO
@pRp
))~++
lvq_D
uV32
[Q;
*?I
hf[a
l`MO
h)lc
RkW9
p_Ru
T`HO
A `P=k6$Na
TX+Ae
A=FC
_Jwn
3'$_I
Hhmb}
L -4
x vw
"JxrSW
*|p5
_--F
l O3
3j$FI
o,x5
'Id]
ElyW
oGo<xh
J|X;o
SOzf@[1
&r O2
MZk,
xm.E8uaH[
sfM*
aY@N
GOuzKS
AutoScaleMode
< OeQ
j`qO}
A#GJ]J,
3E$rI
O" iWSg
lsu T';
i! O3
=hyk
3i$WI
g`zO]
& O3
`&M=
7\w5
[vl#
B _dL
+G }
D>
su|X
` _3
{s`r:]|MS,
3-..
x39$ I
+\$Z@
*Qq]
n4rr*
+|> !
<pmiO
+ x3_$rI
IC Z
+18U2ip]h
gn`S;R|A>,
R*@{MQ'
SizeF
IV 3y2
e)J
O9"7
2K>t$
:CNR
b[Z\
:A@5
Z{^aM
)3#$
}{2
h1p0]39
@j|5*
kq_iW,
Append
UmOt9k
3;$QI
E os
C$amEM&
b5$L
3{E
qr3GFX<
*`EOB
B ^{M
5& O5
` E
C9[E^U
mHPbr
$=q"b
|3q$LI
L`yO
E VkVG9
7 3{$
` H5g
*`JOQ
] [xP
&@R%
IDJo
3z$XI
Z`kOU
77y##g
& :*
W+fb1
HGN|
oHl.dmw
Tv6Rk
$<G
57E,
aoff
(3=$ I
7[|__
* &(
)zPv
Y W|W
R`"Ob
Concat
F&@Q
/+ =06
!0r_b
ws O7
|^Gb
OV=}^
3q$\I
;y7 oR
=2k
P &G
@!S=
=:<
(#n#&
"O $]yH(
x`JO
(HeRh
IQ"xgvX
@+]n
>Fa'
Px E(R|A>
$o*E=
aeT%
; bC
cs O7
u`dOb
`)J7M
w`ZO^
O5{A>I
{|Ng
BSJB
d+}[V
{;;4
#`0s3
e ]9
u0$y,
H5Y.
rH O9|
j(D#
QWjrR
R#&6
3`;O
;ve^
$ Ib
A% a>
P[9"
vgrIG
JI1x{
S(Oe
u`LOF
bBiqEwA
R$pI
fTH ?
k]Ud
`
>8s
][#iE
6cA
RPx^R1
P=PaM+ o8
Xj)xa<*K
C AdM\e
7+O1
[ps[
=3B$GI
?6 o
eoP7
j%KA
%bfy_Ok8
C AmA
]Vk3s
V 31$iI
w`SO
Q`lO3
M8Cw
CiOd
O |o
e2o]
E"R{ S
#:C_
PZ/N
v3i$[I
j" [
~RCb-~
R&Gq
Q,y9
4gJ'
~3;$sI
;?AQ
e=J6($,
( O3
c_[ <2\&u*r*
X` N
Y `Z'~5$D1
juGw
Y]a
CuiY>
1>7D
Int32
@LiJ
(2]/Fgwp
T`pO@
N8kb
-`fO
GNE}q
SLjlGf
~DXR;
}3M$OI
2'HW
\t%W
umop
K~ Z
m2]%
=a *Whk3uGI;
Y`IOj
3Z$>R
-`jOz
39$ZI
bLQF
\;jg
]i,|Q]
klk>t&
9khM
N`UOI
M!e
Wjt)H
f^H3
kTV6
`nO3
LOwgQ\%
L^o-R%
Q5"&
N`UOz
E=y3
U{jM
IEND
\e"R6 9=L
zp\Z
W 63A$XI
!'gtU
Z ^{L
`nOx
u_I
\`jOY
uFS:
!mlt
# uj
GWY8WK9TN
{-.Jk
\lGL
SfVm
wjk3q
BFZiR
Vcc[}
Px2f}
66q""n!!k!!i!!g d W
~l@\
+,h6
StringBuilder
NXP%s
'r[8
R ){
y(8g
N`DOw
O2L
N$>A"C
5%Uq
! 3d$RI
qr3Fvot
AH Q
`4^6
D))))S
?[%,.&
?9Z
q`EOw
v :s0
R]JI
q`EOz
` O3
q`EOe
_$SZ
N. ,=i
y3!T;AaFK=
EqTAj
+`RO
p`xOz
7P<6
:r@'
D))))+
JDFz
ciN50
yvHK
2bC!L
`!<8
gpdaa
q;F2
<GiVJ<
F)Vz$\<
`:h`
9j E
I T Jwiq
D>ye
U`qO
$>R
esN~
l9IH
ZC^3s
g#]f
E+g`V[(
Vz+V
o`POF
I!T5
; k
L,s0
0Y/?W
\yR
3_$fI
@S1]
J$Na
gRlJ g
cDlJ
$>&;9
XVW?
K 3'$YI
Xz7tF
Xm J
`yJ, ">)
wB+/
.vm[{<b
<31$II
<tqQ!
r Ok|
r Ok}
% ,
InitializeArray
#5 !E~
I`fO}
I!zfRQ"
JO&X
#{ {-|T
EditorBrowsableAttribute
\k t
/sq?
xUB@
Y#xX
|Swa>l \
n[|H
_J\m
\Unf U$
O|pu
c| O7$/@M
z`AO_
GU'E;ugHZ,
X`xOV
FL] %[Y
xY&S
L^dt*
M`RO\
Y =3P$tI
Load
3D$UI
)/U4.#
p}%]Z
[<3Y 8
yO3 K
K`kO
Ai|6
iHIj}
$<A-
h~C
0!3)=7
-8.v
zi M*amWQ<
- +3C$UI
@eN
2`"Or
H`ZO
, O3
aMfg
_2L/>[
O9#k9O
u 3W
,`GD
Ue{/
q=&I
ui O!vpG[9
>m=!
iyO
jT53
J`KO
t`cO@
S {3=$
#Y_9
(3B$KI
-E<@iC[
3G$nI
F BgI
F BgH
"O3 <
--zO
uEMZ
.C$j
;M6!6A
Z5b?B
O"CiPW+
` @ F>
-` Psg
Object
3@$mI
'/`r*Rlqw'
73>$HI
W`lOk
x`dOI
JPC?
Y1/1 a
3System.Resources.Tools.StronglyTypedResourceBuilder
4 3Z$YI
Zo5S
>3]$xI
M>^'
^BRz
2@3%
c [Y
x&#c
z3'$mI
3f$dI
b!0
67l+1
vd'nz+TqI
t`lO`
b5$U!
@8K
HBm/<
R.]{B[;
t:pw
i!Yx
!nd3
^:@}"eKX
^`COI
*`PO
2*Dwg
eF(bL
c29f
ry(
X$>H
sPw)
`.shG
M`fOj
5g]>I
"O-6
va>XE
py N(~g@[I
32u"
Qj6s2
3^$WI
^!% '
h`COG
/`XO|
Exit
$fhF
iNy e\
92 l
l&Ov $>I
27`;
S7rS
A)5&m
q O3i$>I
9pC=
~CE\
k L
M LhC
lL] +qY
r~1J r
3i$SI
$ 3'$>l
op O5
[`FOd
GRVu
P 63F$ I
`5sZ
?%)9@
6`kO
p=*9Q-N
4 ?3Y$HI
E&Y5
:e&79
LDiC
2/sR
5$>I
5$>O
S`dOr
b1&{Y
??#3"
II%2=&
gF>I
FormStartPosition
4,~s
e%AY
3wC\
System.Threading
|-Y}
: F{#
k`cOf
HQ}FA
z 2fm
4dZO
\d N;
La4^|ZPC
[bDx
D]9
5 53K$UI
zjh]
;`P=
i `
YE
M"d ]
\rz
"i}3
`)O3
`)O(
`)O,
System.CodeDom.Compiler
MSk
xyHi
3l$II
-+|
PFx8
p"O6
Avha
qf+SJGS
_& 3
%Ub!r
3`$XI
: (3L$ I
9qX#@C
2 z3m$>
hG7cK
*3 |
2O{T
oQ:
3P$QI
# (F
b'^@Z
arh5
3:$DI
& ,31$mI
+`pOy
N`TOA
@ O3
ih#N'H
3L$wI
X`AOi
-3a$JI
o=_f
=? g
%jq*
^!x
ucX_
D.Vdi_'
rp~&a
#`pu3
/#v_
Ah/~"
9) T
r_f AT
B@~ S
KDXp
$X4$(
,`OO
7z@nJ
>jIDATx^
N JoA
oy_w
i~]
q O3L%>I
) -3f$WI
.f>#@
LE"|!
3U"L
qr3efot
Q`AO@
B#Zko[0
julQ
J`sOj
GetTypeFromHandle
*?"[
S;Ve m,
|VrYo}f'\T
?{Fy
H lov
S'&}
=` O3
R6dzMJ,
>*Toz?
NZ3
=3F\
f'M!
7Sz7N
BdFS
S Y3
g0eq
>?,
qer
^ O3
System.Runtime.Serialization
g>8
9 38$tI
m`QOP
K = @
{>>I
+p{q
System.Runtime.InteropServices
(`zOA
&Vm p
3F\e>1
C($G
M- &
`PG"
,*4rMA
!2`P= 8$Na
>8#`
6@rpm
._!R4[P}
{Ns<b
wwwwwwwwwwp
o/fWE
Y `Y'~5$G1
l{] F`
f N. 9;N
G AeN
R~:y
Pp7A
zjE>
A4'g
Ob1{
a}Wyp
t@>
A]VS
!3K$vI
vQqK
`=O2
`=O3
{`vO
5.3"
W4xN
Y X|W
3F<Z~
3c$kI
g =W
I GlD
:-Lx[S
t=RfWX&
Z`JOK
}R#5S
eDMI
poIk
(8)
HOdiMJ
tp,-/N
|dQd
CuTa
2?$JI
3b6Gm$w'
CompressionMode
/kAK
IComparable`1
{ >3
D_an
3d$ZI
\d~"
8YO
%|
uP@4
O.Wg
}m`s'\
R`XOy
ry_p
q"g]
z3vn
`IO
r: O9
s($d_
skL?I
9Tb}L47
z+?d<
a3gi
3a$sI
j& (
3r$\I
R'Ttze;
;LO7
u8S)
System.Drawing.Bitmap
k`QOf
Q \5F
c(r;
. 6/
7`!_3
TpvI
xd#O#_mGJ
VL]
T#;r
>Zy& `
Z_PW(z
t%`[$
gx#O"|jN[*
3y$iI
A5gn
^z,O
m`ZOP
|L] qY
NOr{W[$
l`GH
0 Q
q`vOW
- 3]$YI
3Q$zI
*aM\
Nl,`'
F O3
^$l;
R^pp)v
Z#CM
O pi
_`wOz
)''w
RJo$
O`OOR
tjwO
`{sXJ
S3E<
q`yOq
88~$$l
IEnumerable`1
uy5i!G9
* sC\
i "Y
9Bn)
rMs=Fb
$[))))m
AzEGI
8 O2 4>I
V`sO
]-L(
A?wi1K
>hc[
]X
!$ O3
zaH`
e*.=$ #_
"&~eJ_
xd&I#V^AL:
6WQ
ga))))T
u XI:i8
]yR
VA<q=0
FormClosedEventArgs
2 `3p$hI
x(o0
K EaJ
58Q)lTV.
Xfk.
DJjc
7H8+
gx B#J\V_-
ALuSi8/
_ Y~Q
_ Y~V
Qe~o
MKN
`UO3
VST9
6c1[
aBO
@hE{r
|kLc
System.Collections.Generic
a}^P
c=O3 ?
~`jOq
_fh 96
Q d3r$pI
Bv -
2 (3N$
`FOH
`ci-nZ
lVLr
5 .
e,t#
\<ACl
$`vO}
B|cgS
33333333CCCC@
OUJy
L`aO~
\>oR
n*v2g
3],\
{?` E
%23V
; O3
GjkA
,`kOC
;EUV!]
Q97l
,_Ka
R'tF
m`nO
<j]N
i\A;
R`lOx
Or&@
w"'-C
V P
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven04_64 Seven04_64 VirtualBox 2018-05-28 14:19:19 2018-05-28 14:22:16 177

5 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven04_64 Seven04_64 VirtualBox 2018-05-28 14:19:19 2018-05-28 14:22:16 177

8 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\adobe.123.config
C:\Users\Seven01\AppData\Local\Temp\adobe.123
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\adobe.123.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Users\Seven01\AppData\Local\Temp\adobe.config
C:\Users\Seven01\AppData\Local\Temp\adobe.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol21.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\uxtheme.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\Globalization\it-it.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Local\GDIPFONTCACHEV1.DAT
C:\Windows\Fonts\ahronbd.ttf
C:\Windows\Fonts\tahoma.ttf
C:\Windows\Fonts\msjh.ttf
C:\Windows\Fonts\msyh.ttf
C:\Windows\Fonts\malgun.ttf
C:\Windows\Fonts\micross.ttf
C:\Windows\Fonts\segoeui.ttf
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.INI
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bcrypt.dll
C:\Users\Seven01\AppData\Local\Temp\adobe.123:Zone.Identifier
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Users\Seven01\AppData\Local\Temp\it-IT\Seminte.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Seminte.resources\Seminte.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Seminte.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\Seminte.resources\Seminte.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it.nlp
C:\Users\Seven01\AppData\Local\Temp\it\Seminte.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Seminte.resources\Seminte.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Seminte.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\Seminte.resources\Seminte.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.default
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.default
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.default

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\adobe.123.config
C:\Users\Seven01\AppData\Local\Temp\adobe.123
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol21.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Local\GDIPFONTCACHEV1.DAT
C:\Windows\Fonts\tahoma.ttf
C:\Windows\Fonts\msjh.ttf
C:\Windows\Fonts\msyh.ttf
C:\Windows\Fonts\malgun.ttf
C:\Windows\Fonts\micross.ttf
C:\Windows\Fonts\segoeui.ttf
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll

Write Files

C:\Users\Seven01\AppData\Local\GDIPFONTCACHEV1.DAT

Delete Files

C:\Users\Seven01\AppData\Local\Temp\adobe.123:Zone.Identifier

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adobe.123
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\2c5a59f1\49b5e9b0
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index21
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts
HKEY_CURRENT_USER\Software\Microsoft\GDIPlus
HKEY_CURRENT_USER\Software\Microsoft\GDIPlus\FontCachePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink
HKEY_CURRENT_USER\EUDC\1252
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000410
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.5.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c6aba88\3de7fe66
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|adobe.123
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|adobe.123
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|adobe.123
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c6aba88\6ba6c312
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet\MediaPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet\MediaPermission\Xml
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet\WebBrowserPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet\WebBrowserPermission\Xml
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet\MediaPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet\MediaPermission\Xml
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet\WebBrowserPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet\WebBrowserPermission\Xml
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Namespaces

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index21
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_CURRENT_USER\Software\Microsoft\GDIPlus\FontCachePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000410
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet\MediaPermission\Xml
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet\WebBrowserPermission\Xml
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet\MediaPermission\Xml
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet\WebBrowserPermission\Xml

Write Keys

Nothing to display

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
uxtheme.dll.ThemeInitApiHook
user32.dll.IsProcessDPIAware
kernel32.dll.QueryActCtxW
ole32.dll.CoGetContextToken
kernel32.dll.GetFullPathNameW
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
uxtheme.dll.IsAppThemed
kernel32.dll.CreateActCtxA
ole32.dll.CoTaskMemAlloc
ole32.dll.CoTaskMemFree
user32.dll.RegisterWindowMessageW
user32.dll.GetSystemMetrics
user32.dll.AdjustWindowRectEx
kernel32.dll.GetCurrentProcess
kernel32.dll.GetCurrentThread
kernel32.dll.DuplicateHandle
kernel32.dll.GetCurrentThreadId
kernel32.dll.GetCurrentActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
kernel32.dll.GetModuleHandleW
kernel32.dll.GetProcAddress
user32.dll.DefWindowProcW
gdi32.dll.GetStockObject
kernel32.dll.GetUserDefaultUILanguage
user32.dll.RegisterClassW
user32.dll.CreateWindowExW
user32.dll.SetWindowLongW
user32.dll.GetWindowLongW
user32.dll.CallWindowProcW
user32.dll.GetClientRect
user32.dll.GetWindowRect
user32.dll.GetParent
kernel32.dll.DeactivateActCtx
gdi32.dll.CreateCompatibleDC
kernel32.dll.GetSystemDefaultLCID
gdi32.dll.GetObjectW
user32.dll.GetDC
kernel32.dll.GetCurrentProcessId
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
mscoreei.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipCreateFontFromLogfontW
kernel32.dll.RegOpenKeyExW
kernel32.dll.RegQueryInfoKeyA
kernel32.dll.RegCloseKey
kernel32.dll.RegCreateKeyExW
kernel32.dll.RegQueryValueExW
kernel32.dll.RegEnumValueW
kernel32.dll.RegQueryInfoKeyW
mscoree.dll.ND_RI2
mscoreei.dll.ND_RI2
mscoree.dll.ND_RU1
mscoreei.dll.ND_RU1
gdiplus.dll.GdipGetFontUnit
gdiplus.dll.GdipGetFontSize
gdiplus.dll.GdipGetFontStyle
gdiplus.dll.GdipGetFamily
user32.dll.ReleaseDC
gdiplus.dll.GdipCreateFromHDC
gdiplus.dll.GdipGetDpiY
gdiplus.dll.GdipGetFontHeight
gdiplus.dll.GdipGetEmHeight
gdiplus.dll.GdipGetLineSpacing
gdiplus.dll.GdipDeleteGraphics
gdiplus.dll.GdipCreateFont
gdiplus.dll.GdipDeleteFont
gdiplus.dll.GdipGetLogFontW
mscoree.dll.ND_WU1
mscoreei.dll.ND_WU1
gdi32.dll.CreateFontIndirectW
gdi32.dll.SelectObject
gdi32.dll.GetTextMetricsW
gdi32.dll.GetTextExtentPoint32W
gdi32.dll.DeleteDC
user32.dll.GetCursorPos
user32.dll.MonitorFromPoint
user32.dll.GetMonitorInfoW
gdi32.dll.CreateDCW
gdi32.dll.GetDeviceCaps
user32.dll.GetProcessWindowStation
user32.dll.GetUserObjectInformationA
kernel32.dll.SetConsoleCtrlHandler
user32.dll.GetClassInfoW
dwmapi.dll.DwmIsCompositionEnabled
user32.dll.GetWindowTextLengthW
user32.dll.GetWindowTextW
user32.dll.SetLayeredWindowAttributes
kernel32.dll.GetStartupInfoW
user32.dll.SendMessageW
user32.dll.GetSystemMenu
user32.dll.GetWindowPlacement
user32.dll.EnableMenuItem
user32.dll.CreateIconFromResourceEx
user32.dll.SetWindowPos
user32.dll.RedrawWindow
user32.dll.ShowWindow
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptCreateHash
cryptsp.dll.CryptHashData
cryptsp.dll.CryptGetHashParam
cryptsp.dll.CryptDestroyHash
bcrypt.dll.BCryptGetFipsAlgorithmMode
kernel32.dll.DeleteFileW
kernel32.dll.CloseHandle
advapi32.dll.LookupPrivilegeValueW
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
culture.dll.ConvertLangIdToCultureName
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
kernel32.dll.WerRegisterMemoryBlock
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipGetImageEncodersSize
kernel32.dll.LocalAlloc
gdiplus.dll.GdipGetImageEncoders
kernel32.dll.RtlMoveMemory
kernel32.dll.LocalFree
gdiplus.dll.GdipSaveImageToStream
oleaut32.dll.#8
oleaut32.dll.#9
oleaut32.dll.#10
gdiplus.dll.GdipCreateBitmapFromStream
gdiplus.dll.GdipBitmapLockBits
gdiplus.dll.GdipBitmapUnlockBits
kernel32.dll.SwitchToThread
gdiplus.dll.GdipDisposeImage
kernel32.dll.GlobalMemoryStatusEx

Execute Commands

Nothing to display

Started Services

Nothing to display

Created Services

Nothing to display

#infosec #automation

TheSystem Itself @ 2018-05-27 19:17:27

Detected family: #Ispy

TheSystem Itself @ 2018-05-28 15:06:01