MalScore
100/100
MalFamily
Malicious

jaga.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 15/67 Related 2805
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 511.50 KB (523776 bytes)
Compile time: 2017-05-08 05:00:15
MD5: d89ec8211056a2b12293534c4c44929c
SHA1: 61d84c8921e670bc930c23ab5b0fcd85503141c8
SHA256: ff08613c63c526a7d6c245e1bf86b58e4f1e5a5adf3bf77611c574f053a297f4
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 5 7^rV6HyE .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-02-15 11:36:03
Last submission: 2018-02-15 11:36:03
Filename detected: - jaga.exe (1)
URL file hosting
hXXp://prosciuttiamo.it/ice/jaga.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-02-15 05:41:05 [15/67] VirusTotal
PE Sections 4 suspicious
Name VAddress VSize Size MD5 SHA1
7^rV6HyE 0x2000 0xdbac 56320 aa64045b5c36277bd2720698a1f3fa5c b81164898b03df43847d65283d0fcc7dc28b93da
.text 0x10000 0x3ddc0 253440 6987daef259796b90053afaa42175f63 0d2dce8542f9848628b524152bf754423e44939c
.rsrc 0x4e000 0x33a38 211968 9666cf85e88ee8cb13ce6cfee800a51f 30bdaa7a67aaec2a84fb7e62599ea229066c983a
.reloc 0x82000 0xc 512 4e4a67c1ffad72c688ad19cfcdc4fd13 d14eeb3fb7574ba336983085b070684b350f4b1d
0x84000 0x10 512 da8c3884b98792b6bef8967fcff539d0 68e0303f596b209249acb6097527889af6738d8b
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x4e130 209740 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x8147c 20 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_VERSION 0x81490 952 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_MANIFEST 0x81848 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: Copyright \xa9 2017 Duke Energy Corp
Assembly Version: 0.0.0.0
InternalName: jaga.exe
FileVersion: 6.8.19.2
CompanyName: Duke Energy Corp
Comments: ibadaqayubowigar
ProductName: cobas TaqScreen West Nile Virus Test
ProductVersion: 6.8.19.2
FileDescription: cobas TaqScreen West Nile Virus Test
Translation: 0x0000 0x04b0
OriginalFilename: jaga.exe
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
No packers found for this file
File found
FIle type: Library
KERNEL32.dll
mscoree.dll
IP Found
6.8.19.2
URL(s)
No URL found
7c11746f-18ba-4423
7c11746f-18ba-4422
7c11746f-18ba-4421
7c11746f-18ba-4420
7c11746f-18ba-4427
7c11746f-18ba-4426
7c11746f-18ba-4425
7c11746f-18ba-4424
7c11746f-18ba-4429
7c11746f-18ba-4428
7c11746f-18ba-4445
ProductVersion
jaga.exe
7c11746f-18ba-4441
ProductName
7c11746f-18ba-4440
cobas TaqScreen West Nile Virus Test
InternalName
7c11746f-18ba-4443
FileDescription
2017 Duke Energy Corp
7c11746f-18ba-4442
7c11746f-18ba-4444
Copyright
7c11746f-18ba-445
OriginalFilename
StringFileInfo
ibadaqayubowigar
Translation
7c11746f-18ba-4433
6.8.19.2
VarFileInfo
7c11746f-18ba-4439
Assembly Version
FileVersion
%q^
VS_VERSION_INFO
7c11746f-18ba-448
7c11746f-18ba-4434
000004b0
CompanyName
Comments
7c11746f-18ba-4435
7c11746f-18ba-440
7c11746f-18ba-441
7c11746f-18ba-442
7c11746f-18ba-443
7c11746f-18ba-444
7c11746f-18ba-4436
7c11746f-18ba-446
7c11746f-18ba-447
LegalCopyright
7c11746f-18ba-4437
7c11746f-18ba-449
7c11746f-18ba-4430
0376a89a-e9e8-fa
"!$#+*.-103254647484
7c11746f-18ba-4431
0.0.0.0
Duke Energy Corp
7c11746f-18ba-4418
7c11746f-18ba-4419
7c11746f-18ba-4438
7c11746f-18ba-4432
7c11746f-18ba-4412
7c11746f-18ba-4413
7c11746f-18ba-4410
7c11746f-18ba-4411
7c11746f-18ba-4416
7c11746f-18ba-4417
7c11746f-18ba-4414
7c11746f-18ba-4415
b,CS
ad1'S=
LPj
v) {
c5XNs
GNYPl9vGnxlbYPbd\B#T_#T-+
iE)v
'?[N=0
U:ZR(@XHO3R-Y9,Ol9pWI5W0
gh(T
|j9}
R<zy
ICq<
U28M
n;UC
pP:2
7 ?L
fae1
LvC e
thBE
u<LN
K 0V}
Pr[{
+7i<v
>ov3
)(gs
Z_`4;g1
]V@A14Z
4,Oi+k
#z]v
Sx<O
2GaL
>| VR
*|iK
sm|D
o{O `
d) t( FGTN:!^/<%~U^DAju^+
[? E
l?@
ResolveEventHandler
UUAw
AutoScaleMode
get_Height
f QEXr
Lg6j
0h{)
4m-`/5Be%_^8cnzm7u9v?|"N!
6pvS
7%?a
W#uH
gf(`
&x_ q
qnp Sf
QQS1
|URq
r_]q
[j,;
$!OQ
f b5
wt|X
4$,q
oX]Y
Msx0Iq't@9+qph?_PLO!Rh[>
X]}W
K@T
i+ ,
EDk-$K&|Lb*U'U=|qL9*SPXF#
|bOZ
W:*V1IN$[Y,&yAWbb9=g?pO,$
V!vFN=0uSRDBo!f]dbpQ#dJ}$
- ``{2(L
yDM`g*T
sN',
mqV
Version
?2B
[lLb
4DBh?
z$5z.
*,9F
y{[Z
Az D
X (+
c7fF9
: KZU
4)cG2
I}H[
EWA*
RWRJ
K|bl
Cydpy
f>$X
oFL GN
P+s^
b JN!1&
UBpN!
L6q Z
Yxgu
3%{
PNG
GXw y6BoaK,{~31UWRnQJE7p#
j0jA
S}@l
iG?4
nz%
< 6v
& Ku
PP@>
Marshal
y*4W
hD4+d
BQ<?
IEQG
v69 $
9qE
9RJZ
#FyrS_
AsyncCallback
5;&Y1?N_
-9vT
y[lH
i>`p
.Nv0D'
gJEP
l|'
Wy *
op_Explicit
RuntimeFieldHandle
|BR_
f9Ir
bM8`
}IDAThC
y7Sa
(Vb*
'B%]
AN`_B
ObjectHandle
c'T
y>"L
I+v0
6{|~=
mq{$
J98y`L?iV`Q,?OgG,tn`iEa`
ZXJX*V
5d1L
ZXJX*J
VaI9
Sqa[
zN"]u#Ek;(:k+*O{:TTr v),"
s ]<
oC[l
J ,q
[=^k86
gBq;0
jHv*ftF
Kk>c
s@
St~F)
p=Qe
l~cr
Vm5~
9xeg
GUG
WOgv
YA>Pxm
2sDd
Fhs>
v}A,r
k)\bG 9_/T
Aqos?
h*G,
(3GS
ad j
}~k
OqoA=
dz~+2
cF9Ct
x)7
TDCt
tS * x
NK*6
l)"S
In_cw ~pj._x
#w[}
Ts44
OhE&
}b__
set_Alignment
U>\iY
AssemblyCompanyAttribute
uH*6#1 X$|o\pB(v`1y+e:pu)
Oj\'I:
cU@T
r`|S\
Ly}4
bX>nC
2sJ;
M1w[<"7RDn~Z9vl#`!5F,h*h
.|QK
/P!$FEfY$
:A 3Xnt
q6*R
$l_B
BvD32
>y\%
RG
1@JF
|,W|
=)4(
]wR:
wy mB
]#hny
x:0=Zl
u9w8
Y9`?
3ia
2.Z6
Wc0x
JLZ{
Enumerable
xhS+;43K
H/T+m
|]@v
j\-#
?xSq
?uc~
AppDomain
wmRSm
''s^HZj3P3{ptC2<te-m5=~~
4Jj
yBhfr3o
N2Ih D
qJ$W^
sQZT
/Cq&Eq
HYjM?
Nj}i
m SdPBC
KcA
?Z9g`<&U+X&l]O#Mz<^yH24S*
1W0cCE=7)`7!s'%t>I-eq3a3&
nj59Q40#~I$vK:gQ6e/nI1GF"
K}~^|p
&d\{>t
\t=sO
P `
)y3N_*
6 @E
$K`Jp
/VX8
ku\h
I(z@
OlUw
8 5~0g
ebYJ
MH
(G93
gLEr
vbZ hDk
S$aMK
}N S
&wf9
,K/@
r!rL
I,5d
cgT&
8SH=
L!9H(
bux^
}H'0f
&HIeEP6
?Pq|
}#)~
AssemblyTrademarkAttribute
;A/Xv9
0F nn
L+ D
G3}A
];B<
9R^p
a64d8f29-f338-6e.Resources.resources
Fi,}
Wi9.
vg =
C/"?6RZ3:n&KyYo~wE-ow|mb
w=}h
>qfO{2]udTPB,KcL+U&=o^-,$
_irE
iH(v/
!QFRp:c
K,@~
}>#$}T
W<Ys 't
;D8#
1!+g
:-/m
#Blob
Control
6t/"
Nb+
!, U
C<n3
GetFunctionPointerForDelegate
G-N_
] z/
7;R}F
. ;,Gw
2Kx&
2V\M`t
WJGI`C$5=v,i'4c!b(--YBYf(
h/&U
I:z0
wZMT
}kv
BK3}
7dW>
)q</T
CteW1
$phs^iI(c>+[Yab0jfHH]9~~!
pUM
Nt~g
l~F,HB
BindingFlags
}VgYU"c}372^3#++{&a}VvM\!
s]
Type
kt[U
w9$J
,dD7
d?gY z
\ 46
1 )
y]T~:
IEnumerable
9VzW
nSMH
vpCN0>s
<LH M
p:-@W
NQSX
a7N:<
OtrL/
!8A1
H+ jvWQB?(J0s<6_564JY6M8*
uzjs
oSY>(
E+;";
w| ed
$<Fh
=X_}
,^x6
{>\
4;Jm
w *
'xs
eL2Ta17_8&i7Bm)$Fue"f#|,'
.6#P<}ge
B1!k/
/pc;Rt,*2'TJe96!BN}f)`'Z#
'7C-
i:Cb
=9`r
S"<F-
1"v9
"iqi.#
)Pq)
<mTi
OAwus
:d T
dvxUQo
"OGwnE
Q@dW
+&?}OM
Ne!;Ankz
z$t1V
ZF_[a;t";C%o|9%wi*<k<,f^&
@@1R
_?i`a
GetValue
d!Gw
(f'+
~Q_kR
Ri*:NRZ
B < D
get_X
get_Y
5:Db
Yw~r
y7'7
acJv;;57H8KG7[iE9APsA!m/(
%NCK
7YI:
N].O
pVFD
VirtualProtectEx
UnzG5@wzCUjf8(:p^^#,ArP1$
(6a z
get_FullyQualifiedName
= < < < < < < < < < < < < < < <
vKHY
zXp1&
r-G.
"m='
h.p-
*%kd
I\;A
sE@(
OndQ
jxY1
}f7]
@ztwIw
m]@X6[9md0<^l;OpK<uRA0B7$
DQFi
8R\*T
a9>5I
,bc O
s1BG 5
btoi
"*GB
e/s-
Z+?J;Q
{VWAR,>
Pf8Q5F7X-96*/W+8+h=[(En/+
@l=8cjR'm<]QIU/!-'\_nO7e'
Ri",a6G8MCpauGOl-8;gBf0A!
Uvi*
6G:Y
vo1}
f+3F
!wYU
Bh`hx
[o#a\
lm^j
Ke] BS
Q"![*j
1p.nq
# 8~
9j`x
}aQj0
+lkOU
+xNY
e K7
/BH-aj
{g}_>
VQG/9?c2*2KG%mHR50DMJ<>H
GetString
Zyp
LG{/|
h#DxEhL,cW`naXj#TwWC/V"Y"
IUBE
'|?U
Bc't~
\wG
\Mjf
;.+j^
]!8O
#gPl
X%eOrMS"49]''er2BAXcW>to$
N&,)^
kL1
object
N==!
De|}o
I5o4
<4 Mk
r7T9
[}-1
>iBi
Vy0 d
6$ G
E! !s)
M^c<
LnO`R#UZdFnw)Za`/Y|*7O_q%
C94
K F=SY
9w'BJ
g,6
E@6
9h?BPy
p{mq
u0Gh
vz--7
s^`
nYWZ
K( "
4#;*
Ljz^
^1 ]H}Z
Gfu@k
+TFo
,V[8
ry'8
h?0:
+QBU
'^ ,
N/ I
7|c3
3Ci!
set_EnabledCalc
B>1W
Console
q{N9H
qA{C
2S y=
Ft$$
5 @
?MIk
en H
%l,
H0_X
@@1
b<p9
Wq_#
lpXx
|.BQ
D|\l
xK>2
W>)y
-Q'}[^>
` cI
7L4i
^ 6(?e_R5M& O2c }w;XC0-}
!/i)
P1tsgg
]+I?
Y|L?i
]w2Jr
IUA~
1`zL
YO!O
O+0'L
V6b.xA
iyJ3
/kDh
cZFH
e#^y
5_?,
OBM:<(YW
s//Z
`Jz,|
%G !$
CIH&
Q$b.
gvPo
}`73
rY4-
rY~y>
$LK#
CO9,~
nCYh
GBOq
3*O8G
d{Jh'
HF%W
l\J?
zqm]
46 U
w%`.Y
g}oH
I\L6
`L,g:
vRZ83VNqB8uJRg%VzwEKim@R"
%wjz
las@1Ndh
dIzilO
wyV:1
get_Default
6U74
Ycmp&
!sZ2i
<'^;os
CGV<
nl{%p
6u!}'
kernel32.dll
7X]i
result
#%C
DTD:
N} r
<53I
1d>t
TIL_
'&#"
{6Y^b M
\z:r
l$pBZ6-3-nc_{:r[#E1ma1ok#
%4( !Q
-/i*
.?'C
&a0a<@
r NL
`*j3
@5@j
"3L+j
{!?
R0? sn
2 i
JALhj
MVGm
RL!(
Gpg9d
iD4T
hlQ7/!y<R=bA~LkS0;Gi)D##"
)EK\!
|?)V
l[hJ
df=
0x.a7lp
LM40
Y`LT\O
;!\,#
9O6"
>B8V`Qq|U];_|hv;J&/IvUd "
8CXm{&V
& K1?
[n|;
3)XELx
U.!/Uh]X
Dr[W[\7NTM5JAf6dEUiYJEY(!
c/F<MjXiIV0:o2:Y$+km%fVf
~)[~Y
9-?>
Hzdy
k_/'
YBaW
o SX%F
w D;
d6XD
R/!_
Um n#
3G"mg_ud]U$=3K^S]8~gm",{%
e}3#<B
@P*"M
C^Nx
P-fX
ControlStyles
fzDI
5rxd1>
/:{
Ql\_
r5n>g>>w
K2gn
x$j
O[IWc
YNgA/j`(3SlO`49Z?pt>Wz;a
in+
iYYQ
y%d2
23Z0
D]W :B9$
Yzd2H
rFxi
/r#`b
mQRL
>Z<{
K\7
-.8Mu
k!5X 3[
_cBS
6Y(z_,-3#YpUm_cdEJ/XOiZK"
w9n e
Lo,`
*3 D
~2g<
[ j
i_+V
dj D
hbTC
5% .
(5*(
b}:I
k$N*
@SHoS7t<0(Ki||?R8#0B+$Py!
(
{||S
%_@`
wWqg
MjV.
OTX
C;^>]Q
N0/AjHT_qf?iF|k#!>DCNWmV"
?+ZZ-
QzY+
;Lhx
k63=
dgv)
dX\8
6U|%
#"h[AaZgkH0Zj'1d[4l0F%ET#
[wWB w
XoNcB
Rbe>9
#vJ\`
<rN$
%-]#
Pucx
/@*PvF
P ws
6 FM
IQB}A
t:3F
}9(Q
XJX*V
x2T6 n
( G,
f/X c
5kdd
P<,U
Z`+pw
xHsp
Kz9
Write
~bAN
$l}!
OnMouseMove
r:l)Z
YAI y
u$vX{
O)TWn i}lKplN#L2IDpPNWyh
^FRM
IVC4
<eL'
!np^
O v-
*{- "
PVp$
get_Assembly
%jyqY]^
`Sl*
|@,b uo
zh`^.
`i6w
!AQy$
O8>N
LsCC
dL*#
0MYf[
K7#%l
Oa<';!
<gjhv
I)<VN;f@)l01Nw{12r|N]`7#"
z{Vt
Z=) PX
\#@n
tU'l+&
O:)M
k^[n
<'ecS&O}\M2X!ts}rnJ5\dD)
#c[V7f
^"\>L}(sh<mM*kbz*?T~H$\E#
v8Mh<
?ew]O&A_Y9#v*GhGdi>O'YMG+
5++yuS
o~%*=
$;uO<
5 ZW
q\oU
SFo}
Adx;y}
System.IO
O>,P
WrapNonExceptionThrows
-B` t
Eg~"
"[4{
@j09R83w$?S\eN_sFhOXy,~K#
lS W
[caKq
IntPtr
$jO/
jJfW
&.&m
+w+r<
)C@ =
]ON?aKdWGQJ9_&cs92f$QAI|
^c1$3d
@}5E
/=}I
^(E6
fE*e
Z'ig
f/}G
Iv6z
TA $
wP_qD
ipd_
)-Nf&!j
UJ)0
)%pm
#+&~
?Cs,7J(
0Eh~
B_}`;i,u
z=&Wx
&VnBYx:C
NiJK
4>]S
_nb"
;jR3c
E
{aQ/s>oxtXz(FwtP&sJoW%hB'
v"Eg
oH7p=
+Q.o
W8D:b3($((GeEuVo91zKZgDE!
&B
Boh=W
S Pg
.o;!
Gj9W
~_nF
E0[K
E~,Sg
(2+.
S]Qn;/L[
#Bb,
=KN.
;jz-D
%s*x
!+#-V
@@yf
o8pYs
$m:V
vjua
;(,?
n:5|3
8j__
IHDR
LBIci?rBTX!P6?v43,LG_Pf}!
d91`
&(a S
`'3a
s}\ye
n1vM
noI 7,x
S2DN
5Dn z{
`=W&
`. ~
jb9&
"K1H?LB%2c%@Yur/_?^ ]P0v#
M 8>
`&0
L\<_
ist<
/Xx?
g"W9U
).)#;>
>tcG*$l
2?J86
1SM
x >5
/)A{
w6 [
IVq}
Ze[v
S[dB
`mka
+@lJ
w#B[jWEAqT)(s0U/zi$mOczy$
System
EventArgs
S*UK'
XsO;3/
eSf
Q6^c
:`[@
mZ
YXd
pT+
RI ;
o\#q
;j;T[
|\.%
F|Qs
7)~yRRDD,we1n6Y'JX1"B>xq"
9{&n
8mjB
8V2q
},]J
:66L
bO:,yELi
|buW
QsfA
EiF_p
o^_|
??71
N~m/
vALx\
\vC6S<nJQ@&-(PIBM;v6X`_F$
g31(Bs1Ps:z:g6\e1(VRf2G!
5>^M*C
QzQV;e
CreateInstance
#guT
McJX
7C-
NwwN7
Ec!8
YVEtHA
S=Q J
5"ive
JDts
</."
MethodBase
#Strings
k7{/
J]U2
uo@9 zb
v>cF
System.Collections
22z/
ZXM(!
0nh^
Eb``
zYgn
] R!
\pK+
Z eT
z/: -s
4e_D
MkC1
=}YhgjI
, K?
CFWrR
v(6+y
WXxZF
`|id
n\/@~XNc>sQ~<vgzWo\p5phh
X_!@
Environment
xk|;
get_EnabledCalc
plN~
3xowR
VirtualProtect
tL5P
S:iFKNa3+3GK9o*_PmtA_JYo!
2wt#
Z~ZeaE\ZT
R%m%k
tQg.
:~%Oz&vN;
=z o
}K}l
[9]aq
CI5"
get_EntryPoint
Lwww
saO
S wk^
dV|v
EndInvoke
!T|
pn7rD)G
*J?a
<HyhCA
^>R3
!OM
ORNK
(B.Z
Y [k
-;W\O2fe
b}Chy
`l0D
GetType
}_#,**]
G9uM k
J+_TK
T}Lu8
add_AssemblyResolve
2 qgC
IDAThC
\PeA
* d~(
ik5.m
sHD#
-C%<
=-
tPj/
Y_]o
,Xp!
8'gGdL:`+tTP2!t*1FP8'&M4+
L^OPQ
set_OverIndex
u?O
9q6x
Module
un;j
zPpM
wOF<
8VdD
F+vO
;+w5
#+;l
@GW!
qH]}j
KR~W
)#/Y
RzR Z
$Ea'
\Bpw':
;$&A8aRk]|ZQq(I',E9ob#E#"
7 ]9&=k
1gyX
#q.s}*
.+qG
kAL^]
{Kxq
V:2s
TabControl
jL@Y
ss b
IV:yr
T b
T]\3
JiaC
=>|.;|
_M{`
4\)
gFSV
6(f"
CS= k
F(<xHLx,*wDU:qQleY)DdC7H%
suj:
+W<(
.+S9H
8sD+
3mj:
~IDAThC
@^HS
7E5X
lP<^{
l3Gk"4P{$
:FTJ:Q
Color
#%=fJ]
M+LZ)
RIQl
:_%O B
$/rE
clRb
Intern
B_Wc
Y&-m
d3Tvt
T)6'
OIq_-&
|ri|'Eqb{' NNGUbrW&H"NID$
p-&M!i
2g/0
QdYP
usIa
hJta
_o&5.
3GqB
=cf'7
r5DLn
##rK
)A$U;!/~D,|\VGG!G_pVCAJh!
pxul
get_UTF8
?t\4j}}0xf14-A?G[2^86`4a!
B>y.
get_Width
7.:9!Q
Xy9g
C4ExP
j!0c
;:b^b
uv 3
nhP>x
ZX {`
z4(p
M0UB#
V#v
?1({W s_
"*Rdb
&AI
Yv9{T:
)$BO;Y
RKz<m
s>4~H
8\`
On4fK
Mx V
1;-1W%?_&
IY.
v\Gq
W6^??
/HS
hNx+
N29Az
G?NY
vdi{
\W%O
qex:
edWH$+a&mCb@YRGx's!u8U^o&
cCBc
uk'Qmu
7YP}
l|rn
F,1!.W
n s{
`;Df
7eS<Z
Rz?q
IrdCv
WC;X
`^g~
" Fi
u fAH
*5(.
RuS9
]\8ck'[
*+jee}
\dc!
Af}L
*'05
n[@\
;dENp
JL\G*
unrb
dNS{E
ZShr
s3A1l
~)%=
KxQZ
zBv@
{bzwB
kBF>
LpPY
Q!vi'Gd
!JZ;
3, ly;W3
qJ'x.
N e
5y/v
`kN.
p8NO
^D>3r
7^rV6HyE
)692
ftHacjf?
9]cbGw
R2Mw
jIZq
sv':{
"/5:
$K/PA
$0Oc
9EnTPg
i]-`
5O3p
Sp g
uDcQ
stvlq
gle{@nbJ6lZ/]v4e W 5pDxe$
bJE
WJJa
k||w
Delegate
c}a
6kZ/Y
b<'kFJg
xpR fX
dd(
VN4A
E$ /E
Ja5tU^b
6jfZ
O+$C
>U$Y
U/oQYV
v? ts
.#+X
6Y!K
dPvWY
!? n
n:"z
oD3gj
>Cy
fK!`
)?#6
sv ;
X +4(+
K"pNU
Pju^H
]ry|
Gn%Y
&qmo
C;b_
tJww
I#?
172:F#Y
0zcC
Ok ^
^A|S
f5VntH/6$XJ(#ZC|w?22&P %%
^^>]p
ModuleHandle
ap*d
f,DYT
69
JU-z
o(=XS
D3j\
&mR7
o #$g
Z Q~
;YsD
&ebS
rsJ~7*/y??0
Rh e
"!L~
)M ,
A/{B$)}k00_)3e(Y+sKK{PIi$
1K8l?,
pTDU
eFyl
Y;x!
:M!l
ju%m
Y,;Z>^{g}O4P7;c=HJi3aA(H&
tC*|@9"K?*UHjwq1j[+}G7`(#
}g/a
;:8]>
qqsTv2cjoOm ==8\'<K3ss?,'
R;UO2
1s=/11I},MxZ-<F!eYVb$)7z"
N2aA
dP(%
_` s
DW0f
8rr5
Gd2a
:WZ
] -#
]Fb0C
P`<cA~+%LqB%J#]a]#)%EZ;l"
"X{K0
l8ll=
OD 4u
A}zS
set_DoubleBuffered
jKO$
I=W1e
SD4~d!Tm?;?sNuS_J_8p/aNQ#
get_Length
[dsb
UE1eI
t8vg%z
'Y:s
olqc,^{uUs2i95&pRVCu/-4J%
iZR",ER
570m
/i\f
0\A[J
MY0.
#|@@J
5kSS
^h V
@PHQz
%?|v
{ qvz
1K-N;"
L3LwOs:f
Contains
Q R|~
| '%
r+)J
d65z
uwR5Qk0R
AFln
wJ.yun?
sIxyK
SfI'
p^Ey
PZ3Y
%f<j~
2Z_R
!1e1
ValueType
X;~v
1:M@
GuidAttribute
sNFx
)tl0k
S0%a
07)5[
E(Z6
<!sd
O;:)
?CfY
n^{r:
ToI
pybMSj>8,5[VmF7kWk)X;M2@!
9q|B
0Bj
8?f3X
$nH C-
*+iF
`u&W
get_Count
mD?|
;a_d%
0ZIIY.
{t9F
!HxA
ahMrp_0+re}|Kx|f"tdZ=rj\
O+}m
FUXD
) R/
7 0^
|=J'UDeYA}K-bv;ebuy`U\YG
System.Runtime.Remoting
Y/
dc`L
%?@yb<
;2HG0
,&W"
:6cBF!>Cj6D"rQtK8z-ny]Ly
2u05
Bb9YK
/l:%
9N0g
;,AF
5]`2
0C,|
GetField
d .MI
*[g
/V2z.
fXxE
k0Fn
_$&Z<&
l y~
l1y.
=*U
.6c[
|UG
[&5*
mr#/
n,s'
Ux^+>Yp;n-x=&ex)?Y4]MZ@u!
zu+-j
dSwP13;n6~hN%)!X'\CF\Yy"!
<J;-
9coZH#w4$<N27qZ#")s0i-Gv!
?B6Y]
!wxX~Yh8M
":sD
V tC
E!Q@O
|,KkeeGY*M/^dx&jaf40l6{{*
UInt32
$W?P
@5i%/
NOZZ
l@E[
uAN?
#6a
get_Version
(4BIA!
Ha&o
q9e!X
qEq<d
yi}7fjpp6(zsgDy>g)tW?P//!
$TUo]
P^1]
<tT(F
ToString
RtN
8Uq'ny
/]nD
UV/!]
(8'V,$Dj;
uT %
3tZ#V9
k\8nXH(O@Q3P\'2v?ZY/8nOg&
YVB_
~4Zs
-B?2
S'Y#
a f
j y]
>,kW
F3 ;{
X
ya*"lK{TI~vEG^|B!Ufs{u*x'
g4x!
%W)}
ZW__eY
<Bs1<
,eZ+3Z+Wg2]+&G|O~ZRzK CB!
Xe0e
W<dG
S|8
>fiU=3
$"-i~
ServiceBase
<=O*
5Hj:(bhYW)+Z\vYK|@{],NIu!
Gg1m2|
bXih
'|gf
s<5S
qYt=!iyV#jzb$O]?A?~bH5D%"
Cu@9
,?n;
GetTabRect
nD2n
YP.^
<O N2%;D}
kX5c
[ ^
UTl19
]cf'&
en7b
(<ga^
n5y2C
dxCD
*N2=s^
@YYR
[fJ^T
e)T^&
!#z,
b|Z?
?dG)
6?7q<
b(%"
AssemblyTitleAttribute
MAI*OS<]u4s;;6d=h2j5Ar\]"
:j7e
;|om(za~c>!J{jN*eG}U!K"M
-QS#
q@!C*}TC{k"VW3HIE#W=\wN:
uL=^
jtmrqo
6.&[
/$Mz
r{k]
Bk^*
T:Iu
:MfCo!/l33G0l{-P6}1JNq3I&
w@,v
mMc8G]
>buU
v9C$~7
jr'g
DJ Qe
F"ok
|%4
:)-^U
q^p2
LPlQ
4"4UF
>';YT:f
<*>kk
uX3>B
xA>O{
9chZd
@?8K
.' c
^+Y\ 1
M$zC~{
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD
5+f
X,c.%
']^;
V~"S9
:8sF
!-wN
=pNO
Ef/n
2L MrCyHhSR9#pE,RxA}U6-h!
Q8`_
ctt&
:l#w
X?[#
Kvd9
=K?Nl
Md<$gf
m`Vvp
NX$;
j{^yO
xiNE]2 ;
BFp`
N>0V
j>Uz"<Zfo00(1+$pK*CZ5XKs'
}Z>
get_CurrentDomain
Data
LT(@
Mj#<+
, 2v~
\h=]
RB(sK
?u{)
*Zx>F
;yIC_
[!) V%
Enabled
^%/E
^fG[`,z%JB\%YS0a>+2QBgqa$
eS<
E7 )
A]L|F
<1:C
4m73
Ov)y6g!iSS7cpmAo(i#7HOJ:!
RE~o
8ilN=f6
h @|
~B%&g
! RwSR
p,pVYr
pHYs
.ctor
$02b46398-668f-457f-ae9f-6642075a8d5a
Q1+b\
C%+
T{jqY
^HdN
get_SelectedIndex
FTn>[
Ys[e1
DVE
$K[M
Container
U@G&[
6^cm.C
as9W
cGl8
ru o
D5txZ'TJLKO<oi=Z0)wbg%$k
8R&Q
,G.Q:J
E(E[
2lM=
s#c;
HQ{R_Bs'0/!vgrN(Z[$ikh`*"
cAoB
)jx=
Z9VD
Main
QS Y
Ut'4f0M\2#5!mvag]q@^Sr[H"
tD 6;u
(N"
VSqa
6BbC0
Invoke
@+}
$Hj=
mrv2K
4` s
ZXJX*
|P:6
<;
mA'(
kEKQ?
?tNh
m-&4
$d8i)xmNuC)2VgB5l{C7*/O_!
Q/i -
&nv@+B[eVWDT%a@}JO2=f!2L)
&q3W
ddX;
O$]_3Y(
APT#
T]% $?
MeF@
!;JWTJI=o>07!V}?8f8#6~*{4
FXiM
tAFp
oC Ed
u/A}
.R6ip
vzHI
.d[)F
bOS-
9N\1 ly
Mai!
tIIh
\bO"F{07g9eMrT!h(4J%(`4s&
]{Q"2`p
P?NR/
1Y%)
HI?/^
1&<s
UE]\\
*SY>
N|$:4`
)-+'r
Elc~A
ziolc`#G
o,hB
0 = H o z
f4G{#
UuN_
A'%r
{P4qmW _NOX_JWF^mf`"u{/
aI|m
ToyFH@Gx-$vqQ[Xw1H\5[ly+
|g\o0
2#Pka
Array
D/D8
c$
n-ND1C
j!:
>y(*
@.reloc
:)sf
pp1%
Q2ke(K<
( Zg
9 5H
m5=O
bh}<r
30mN
j&pzm
st4|
Y:e[L
y"dZ
2iTZ
d8q:#
OJWK
>ZTr
Bx|7!G
Q`xsx
g4l'
djmV
Hb[+
$W,b
$*3]
~}b#d
TabSizeMode
8!.d+w
Y.ur
Byte
get_Chars
mxz{s
Og$WS
>:$(
I:l~
^-ud;
p R
|3E?
nA9Jc
RX0G0
FJj9=|8
>_&I
OYKX
h>_0:
j:KO
v#>,
;[}AZ'ds"?OV$Z:!3uBISYYa"
<Jm!t&
]c]k
3J J
`{_f
HoZwk
CreateInstanceAndUnwrap
]5n3:
@_0;
- P43|J
#"<(
`U.n
3J\
1Nb6>
$tF/
8~1ttz,
x>OiK/n=
W`gNA
B-tG
f}rA;;gCL!"#*Z5 FVN+DRF~4
muJ[
dWKn
UF"Mg|3
~6 6
3ik16
_uZq
$w02
RcRU
Jp3x
d 3wA
4\#v
{4~'
^p4_
0{.~|
`fO7
WXTYS
W<Fr
C q?
_Qo
get_Location
CscT<9;k%
cO8u
''^JB_d:DG5 _IrhAG=@|35a"
B">z
)UU+
:uU 0
x.1$
#k-;>
cwzqO
wK/:
&"c@
>~wK
i @
IBlw
p{q\
;Q]qM@4
VOd,f
Vu2L
NQxbO%
O}tY
Y5~ ar+8
FreeHGlobal
%TvD
sisIw:
F*!NI@cL^&TD#L9f8f9<<V4g$
x3?s7
N*W[
`kj$
M$k?
c%-A
/L3
jBHDhDlE~:4ue9}Bx%Fp,Df2
PEL#>t
CW~K
XV\2A
Zf~aye!
1-s5
;Hel
TU[
je+9
(VU-
F??I
|a#
IList
yQ2j
2xYoctTWUikDMDs)Q^W}5-2C$
+A%c!GZ
$6]a'
c=_R
|84t
5dQf
7 6V
E/QQ
OJ.^
Pj86u
.$23
0)!q=`bIKK;\N#f$EJAm&1k1
?#CS7\Nwlt'a&pp=P$"wj^B]"
) 12d
8LMwwwNM{^
j];tYU&s U
* ='
eI2x:
nS^#
f\>B
+R(+
i; snR7u`'ZqOGi*kBeEw&?T!
ak |8
Assembly
u0M"
9RH#m5
~[K$z
SY*Qgt
/!]Jww
ebI
wBCDC1#wJYJsE[plP_EpU0EG"
.XX=
Zw"k
?Ck3'm
' bf
fq {q
,lU9
q]-N
)6Z_b
&Y<}f
6A-w
>+i~++
8OE 1
7H p
/<y1
G[qQ
y |V
cXzy
Yq5H
tlSF
,>\Bu
5Bf;hG+x>TU's,b"Z67~r1`V!
e4NW
F68fQ
7tndJ
Xg)0
T J'
[NXW
~1&(o
rE fq
#u$t
Invalidate
wBp)
E~=i
'nz-
S@[ ?
DM!@[3h9]c7DHD[>+#+'C]?i$
((N,
75%T
f3#L
D4t$F
!{#2
y iq
&h._
WUr>
d"0M|f]_2:|B;q+'J5AR/O76!
Size
$"%(
&2uX
X& i~
ooi/
d<[D
["zVq
NewGuid
69lb^$7r14,?7g<WJ9/5, 5\%
HZS0
set_AutoScaleMode
S|6z
K))h#
?k\I
#J
"iXG
m]UI[_
SLp+
)+GiB
*5IeKS|5WeSD3x<IqdtflKUy$
)+gg
~N5N
~).v
$Sd#
|a K
+# T
gr7T|
g xQX+ixV"q_9;1?tE%O1%W-$
ljFQ
SN#$
"VIqN3]$>[6:B,3h'W<9X; t$
ZD2t
/#5p
-i7\w=7T~^|A`%)W\]eU'a`)
/Q r6
UF(q
j^}l
}L\C
u@<&
F;(KtQ!
IContainer
TY!d
Kv,2
q @_
Ed#0N9
5I;Y!p
6BJAl
1P\=xIA+[fj\4RB|E Dz7}qp#
};mAr
<7Q@\2>;ef]>rW;TNnerT-^=!
'
;7v7
zBbU
xxWW
PRZV
uqLAT
+9G$
gRi ~>
#O
s: L(
'lq:
y6H[K
/TRIG{
Ydb1
jJ)D7`
~ue8nV
v62`d
WtpmO3
ISerializable
2!J
AX R
wKIp5
I 6
^{*3yUA
g""t
I_Z>
]xxS
' $
En<T
QF|k
b9d?
P?+ 5#
234d
|A&;
Hj!i
~%464
-kz#Y
Z(1
s%<N~
M?b*Eq
6R-}a[T
*-J?
9+3_>
q[4q
oDA
huP
b_>I
bXnhEX
8:Bo
?1AcX
idkZ
l]8qU|
P*Te,@&F\)w],6ERbqS|Lsu"$
]BQ'}
get_OverIndex
[F]m
H]@xuutN4(*PP
jEL?
'Q\Yi
^l3{
5}/E{q$S(&,eA/O[TP_LXN<
=Ow
K/T/
qoABzyJU
A2F/
pr*6
(WH/r
*KX4
Jkzr
Q)R
(v/q
cHg
6++4
yMjiJ\
{"J?
:Kqe
L3^L$Q2QD38UfH-tMxSebAD$+
RuntimeCompatibilityAttribute
re`-?
kW\@`
Kr']}<d(vkx=]`TXU guQY9\&
X N7
hsqjDb
^2|Z|
UN8/
n$Ej
<hdQ
2`\+p
ContainerControl
)K-:
/Kz+
Q"(m
c1^/I6u* 'lBh"j'nn5hO9vZ!
;5LNw
U,P-
!Lk%
O9NF
c2u>cUv<?O=$BdYYLHQ}W,-K&
W %?
{XE'
`M^GHY
.K`Nc
PcM3/:
A3 O
W5&UDb0V1$z* >vPR)*0gCZQ
;Hx_
`Bo;
@}t
NV_GV,
S>9sH
-3c{Bj
'RmdV[
X{,u
=o0q
+&_J
sV]T!|?;{|vCXK ^nd6Bq>WW
ReadByte
aQ:s
%Ve[
(R9N[Pz{a0a-"y006Y6zaJ];"
vsoO
m"G}
Q9R$
Dh'7g[
D{']R
@+[,$
3F1764884A245F1B3FA91DEC2E25339F23787561
1_Yx
\Bmn*&({@jN[?+E>9o(iT!7;*
Sv [$
*Z 9
~RYYs
"Fr+\
UbHO
xC&&
hp3 ;
YNH'%A
~$~I
~}\Bo
edz`u
Yt)^
\ Oue/
AllocHGlobal
Nyk(*<
|rN{
xxA{
GNNw
3DD)15
iO5M
AssemblyCopyrightAttribute
P2eU
)ky%
(VOt
V&C5
-h ,
Apar
Cc1.s
OoZ0
ngzxFA
I~Rt
]rVH@
Uc9VJi\Q
S6t|,
HF:W s
f_i-
d+|/
R(Vub
8w2'
PX3kM
)g5~
' y_n%J
Bk'y
LE"f
vs&ybl#{8tr\#M8!$&xXrm!("
SsXl\
%}^Y
~*qa
d"Rn5$f^
?VK0
{A.R
M*+N
B jU
'wv&
l>;0\
`:z lH
q@{%
_c 0Y
>7j"
\[i
& #v
:HH/
5uA66-jSwEBUnGt#%lyK%^*Z
k;;r|v
-{AR
IB,F
/k;P
IjNs8
5j?;'*
8 jv
xUTF
m~Rv
}g*$
X&p"<
tV"a
&>$!
qyi!
kaJKL^
=Okh
Jh6^
V38b
lF33
,O:|
<#u!x
>Y'%G
w*@4}=9
r$:2
}&]}
2'a3]
Ldr*
nk C
f)RNXL"URvsA56MWC!&")KUO#
ControlEventArgs
;{{z:
S7 3
x7c(
Lojc
M</9
:NXU~
=kAJU
fKI3
H oFo
PkDU
;F P+
]|-W
s"^mC88ks$k4y)nj?G%~w1k=!
\Qm9
AWncB
p""<;
?dV)Y
|_,#
!!5r4
!p(T
/?$w
zS`P6
>w4Z
Read
HWFFy
wqK&
F
vz-F
}wvm
;?|V
\~;8
aYc=
5bhio
IConvertible
g$U!9}
}HiD
lHg.
X.oX
hSt)zMBkRR>[B**2FMj1j=|M$
{#? 85(3AM[6kNBp92py45p'%
=JU
!b d
get_Value
zoWw
Snz'x;ETkKjfR?2qi7TdD"'O#
\XfAA
?Rz3
[Bf-\K$Zb=L]-!e}4Or&&2\9&
aeOx(A80j~#W P%k wa`=%Gy%
{ \0
E =|%
qu2_
?*=-
!b'\t
Kj"Ou
R-YNh//}4T8iqGE`\1k)b'Xd"
=bK2
Xbiqq
>Kd`c
Es_.
|2;-
NQp
7!%
H~,m
EJ)G$
gAMA
Oxt]
EXMzX
V147i
[E x
0/)}
RTe
@t ?
a'k9
@_V,
7~Thz
set_BackColor
<`dB
BI[Th
\Rj2V_
#slBp
{aIuJ
MarshalByRefObject
P1n#
ymA (B
AAdBDMpm5XI(@sxjx0Ixbp37%
dM *
6b6\?!@vft4Cj?_UG{>0qL{q$
.cctor
}GEu=`0L^=wKTb@+5CLKH]]+$
Ls r.
%`Pr!
K'W2_
2$RN
+LS
;;
mscorlib
zt=/
Ye{A@
)?pE
jA-c
*f~m~
a-@M0G
]pK!
fz]w
>Wz~
(IM>
i?G):0wEA@G-qE*SFO4ymt\@$
v'.,
l=Rj
U"{ei|p}a&;"bC#,gm+8E0l
Qe<C
,zc=l1!QfI _J42pXwv4$k?0&
s*ZxQb
s<+?fv
ZXg9
Nwtr
LaL!
ouQ0
J*:\;
iv 8
get_TabPages
e6k@
~HM>
&}5b
D}He
h33/L"
Z#(p
Guid
zO>@*
~qK)
CmN
JAL\
/4cDxl^Ioa~6h/o5seyALnCe!
v2;
c5G7
6ZZ:s74^^~o&Z2mR4$zn<|*!%
9rMZ
=$^$Mq
tKRN
FTqG&M K7
jx0:
F,E*8#
`"*e8
Yh_
1@(Vt
CrJ}
B>\9
\RK+
System.Reflection
^dg,R
~qh.
:Ar%
JowD
NP~U_=lso^64ElguAxXn_xGU'
\it,b
*}N~v
- R.
RuntimeTypeHandle
9$g
+{ S
M|aVV6
NFX|
g~tD
L p3r
ikqA
OoI
,W+~
|knGc>L`RPyR[dc;D=Om0mPD$
5yZ3
HOH=W]
0:NE
B ,6
(=lc ICLV51RNhBcf:0QQl^N&
! Q>]
/(U*F
#s3L1#DES
x Q*5K
5I-
Cursor
0JL
sender
&|,q
t%;a_
5]qR
7;OE
yH5f
b)ULKZ
'rIMy
)Ex\q
vwI]
Append
J5zN
Yyg<
tM@G
de]P
>$0)`QPhUk:Qr_G ^^]5Ah4r'
gz=}
a8!Y
System.ServiceProcess
op_Equality
/#.q@
3DY}
Dh3M
om>F
5cc[
7.RIn@
\K7'
BAD
I ~MK
r? `7|'l|
Cxuq
M,6(
&i%5
0D2@
Thk/
nVy i
6mzr
NK2)?
+UF_
hSr*
u;!*(
2,:ew
V?tRcj
F g4w
DoBJ8UsUb^nL"0zU6[qC[w]k!
s( 9
?k7{
AssemblyDescriptionAttribute
<,NU
sda
e#r'
l&WQJ*; @A2(t}dtObm3V 3:0
B7=/c
<# a
:ltixB
}]{@d
get_Revision
?+wXB
/VH[T
p$m
=?4
9 . C
ft)#i
8ho&
<"#9
5ZyG
r"g~4dT{;BD?}\R SbKqq6q`!
v%a=
i,.c
B3TB
D-E
z&?/b
p2uQ
X:K]Db.
t],g
i nD
q5,n
ZZkp
V0&f
NHdq
n2|R:
g,y/z){~
*}=!
d/hKG
.{?{
j'ZI
[7RAs
U!;%
OnMouseUp
( .T
/+TQ8g$mc3hi)xV?[#ogmN/2
is7D
CeV<
^n+9<
wQb|G
]ZR
K[~
eqMM{^
Sz0}_
+bd:
/zlA
l\V`4
Char
kmz?o
U2ljyi
#h#M
<#s&f
~|EI$5
f rd=bj
xeRf
&K'_
Sp&1
F4C\+
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
l&;x8cqBA'=
I[7)3xz
~z ,V
,0Op
Z=gx
9 <
wJq#
nkHK
>E&(
*A!F
,Tw(
{E93
H|"J
Y$bU
zkX\
wf_X
jxm
kOa*@
\#[ye
mscoree.dll
!This program cannot be run in DOS mode. $
bGK.}y$
04t<
callback
"wL
?%PY3x
6@}sJ
+=G$
`D60
*#^F
[ 'U
i&#s
B[ti
3R_;
X$i'C.
h"O!Q+
r%6oj
pj
Dispose
&_1G$
>V%h
KWl>
T#Q2
uIQ.
+c$MLjOFBR,"Ivt=S?(?s'z@
6`tmr~7zCt`[Ht|+|YML}R0T$
COI
WLV]1
MGI^ 2
D]x{
|,wnCT,
!L"i
FO7T
26&
nty!ktBg$R5T7b`N{<Qk|6z$
55g~
&Ju{
4E2BE99140D24066CADC84F74FA899FEE5976B68
g9xS
|r! W
b&T%
}|7F9
S\/&
Yrh~
#LS%B
14d`K
Y=4S
2LUi
h)8>-
c$^L<
eeMz
kG@u
4^X
2a4:U
IS[%dMwi_td\:\F=fWuQ%y"P%
0x*}
Dh/]
<L"-}:j_%K,[]$m`ygdmZTPP
Xhe_
:j.u
3lJ
Ow3.
K<Q:`~gIQR{2V P:t7U2 sU^#
/J}#
3}wz
y~ct
*5aS
# +O
%-i 1
zIDAThC
eaDG_
de#yYB
)/3 &A
$l#b{t
s}s&
;?Y=+
|P'&
Htb|k
-V*2(
Zc3Y
i;*2
wC_
uG9Y
C.tj
:+w (U
*V}Eu
PoN+%
0.l/Z
BSJB
k~,m
C@>
d C\
?}vOF[
>w>J
qBrC
;@f1
YJd/
tB\g
:c\YZ;lt-z ,Bq52%8G`|O({4
mCW?
0YK
xC:
Np
kghNn
xdZhfux
jj?6/'|
7Ufkk
WV3l
;Nb!
I{tL+
8F]yQj7
~6]/
<|e7
get_ModuleHandle
\i 3
y<U3
l!Fv
8mSZ
}E6o
qE %';
z9an1
\6]#<
:$T
p Q3,Qz
0d{e
KrP)
(QL
A0S>
r=6-`r
p:#_Cn
~fKy
1gV"Ko9%:k"KANYL/K{>X#+),
btmv
y!SIi
b8,0H[
Z*'8^Q
ccCEO
K6X4t
g\rs
n+%'
B3wN
x)Fu
,~T*
,#]<
Bsg.
6JHP
"p'-E
4i:*
3T4e2x !G$jpi!f4}%'}HcW!
._(-
5;6o0
Fv|a^
z&{"{GqR}62=iHf<8Tb5GvNg
d_Z7
+"b=
WEJH
zL3DN(
y 5S
7cR
i-4<
Cx/-
ZXJ/
6wB,e_
t1v7
3#\ Lk
R {
:'N_
?w&?i;}P];<(6|xv2h_kM}3e
?4*~
System.Linq
3pH2PC{RzSRUOy|aV[l~!+hi$
v&Y 0
3{~oH)p
t4->(
C708234F139063BBE3CBE2208BB6ACFACBC50333
XePt
#^v
TgvH
InvalidOperationException
Y;hT
T%I?
,9\{
HIpr
<( ^
Y=|qkY[Skql6wD2aDI*+@(43*
9Id@
7Q&b
.[Lp
sQ pG>*w T4>my"TDwmW[<=8%
m)9z61,
!(.g
p `
bxu^
D$++
{R s
bq$?
g!5b
W=^z
3L4{
yIDAThC
'B7P
{hDY
O`8W\9^bR]"rLrCRD,Aai<[X"
8nsN
fWM|
i]Y.
B~?Rd
7sF9H7n8`zhi(bt0`7A+N7Wu
pF!
$$6Bl
Ig ]
);56
U[j8N
fLXkt
_D?Dw
LD9
x%8g
\r@-
BlockCopy
$DbH
a zK
ogR
Hb|6<Rp
m\l?Z
Lxn
IlRL
1'vk
[l99
!zV
NQ%X
qn67
S]:&
x~uE
;ruA
-9l:+%
.7WH
LCs{
rF|v
,O.Y
R/i\#P
qo0"s_
Uonk
3M`&
-SCp9k
?oay
LxP2
Ps8,
OY 6
FYV't
zoq,
{$7a%ml<\/* hkuz7Nv'8"c%"
BAjS@^a
J+y
x9R,
%-ZnZ\
fk&*
U,nxLf!(_%xP6'OmE{^A>T8\"
'`:_
DW Xr
Nr>2
F+Il
m8g3
%3[E$
(dMU
*f^SA^;@i
'3?{EK
5U^
j[',
dG|//
$qi}3
Int32
~%>^+=3a2%5]!M16zAc{?3+e)
ddx
zO` 6A_
X'lK
$h {
U)r{
JH*H
F8s]
,'g/|
O=T:Rl
W5_\b#v.
&" S
Gm2
O# R
,G2IB9
Th\+2
LyI#h
1SKLAHnl3Gp>E|N$\havSQJ)'
49i[
VKv26<7$aF=S~(D?@0^uF)36-
lF//
$_ AXZ
&Eysu
>+DV_
]G7E
-[_ M
Mo #
MethodInfo
bBi5
ZP)rXxc
F@Xa5G
2sp9
WRB!
=7I\r
n.?X
{@;Z
OL~"
.7 65
58"l
CompilationRelaxationsAttribute
\Us{
tCv1
_ AF
1Crh9
>xOK<
J)! t-FI
TabPageCollection
1w*l
IBindableComponent
lbON
E7 "
yjX`
X_<R
tLL3
nn8<
MemoryStream
-ZfQ
o)qMXC
&-78_
Rq,<$|%}Ci&eDcj#F!!>[|s!#
d4\b3_i
skj[ Eg
P"_~[
Ar_
ResolveEventArgs
h5'G
System.Core
85\|
%@XBNv
NI ZV1
=j2K
_v>X
$**
/M!A
`|'4
OnControlAdded
%BaB
3nzvTp_
O1%J=):?HdZD`urg7mzG9sA=
<r<6
qq(T
")A+
_ ;4
BBV
jN'$
Pe'
t :]
.v7PF
GB`Nq
ItFdqBT 9jqd=\\!KFvCOl5S
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
6=F@
qjX
!0F7C
G-H>
3EH<#
IK$g
o W
[0a&
_)#m3
<"%jYV
:bv@
gP.h
eL-8
:com
s988
`r}P
@L1M
hrO`S;4`B-OQ?6'8q`gFbsN:#
-,T7c-R)~"hA&c&#G9M0o58T/
LjMK
qJ{?t
WG<2l
\.}[jL'
s ?9
M 749
Gx#+
B$ke
`@}r
LdXD
fN %
= < < < < < < < < < < < < < < <
bg'%
_~9A[
{=>?G
Zo::
6NhV
{be4
{n{*
nzfC
*Y^tggh
%oo !a
0P8nG
lNFj
&7Jl
n~\,
Q$s~&FxfRMi3zHOZ2E<CS!(t"
^zhu.
;!f-y7
?vz1'}
4gjD}o
G,v<'GB^Tc5R_-#k_,AS/?mH&
Kzb.
oNB>
1 gL
B tI
p%',
ohCXrI\aQV(?K<66AfR#LFu4
VWo!
n$jl
Q"mU
<sUF
NA-%,+>'3NiOUU+4^Jn8"0Se#

InlZ
5u2
:)V:'
XX`{@d^ps3LC@Tp#H]kf\n%U
itqG
fd,D
Rectangle
get_Message
?P?L
PurM
{"QX
get_White
(?!3
4}%(*8@$zgMLZ+(aBO&#B'}E"
u _k>
?30r}r
)i*NnH'URm}5(B\;:"_mxAbM#
D6 (<
ih %
ewyqt
=$9$
fk#6
Concat
[%;gs
R^zV
c[$ o
StringBuilder
[2K*V4+
h5?B
k);B
H'_s
Pd2
J: s
'DZNo
R Z[j
GXOk
k[Q=
U#K.S
v(3_
*U7QL$
:="
ZxPM
$Qwy
VB+d
NW)mB
b~H z
Ou=
<Htn)
/`a
^$~$
/.D
xl 9
7gUU
-5lvBs
QEz;
>\15
3; I/
e<&Al
5{R"3
U$%;O
C]w%
='A rGfZk
get_Hand
$39<3
^@]:
"U14
|}Qv
9k"h
)*pB
0,GU
i[^/
g,T"$`5?aQ%p6T18=1eaB&%C+
Hn2/
y&N(
tPy~&
b $e
[=/s<
{[r~
AlW#b
J+1/
).%(
ii%^
n_ dJ
mAR^js
FXqIh~KO^En|otOq|V<*7P/%
_nJW
dh If
BL<*
-*" 0c
5M)-
.text
QL5a;=)
#aYQki
fZi
<gYFIP6LYAa!tFn@Y0h!a"/U
FmnB
tNwM3NwN{
DFl;dO
AssemblyFileVersionAttribute
-=k
U&)hkBB?z
System.Text
JD7=
0=dM^
NoIZ
6%>H
Se/8
:nw1
g>jk
rM12
k]ol
{Kzk,#
FXt;O]>8"lP@a}%mX2ai#P`;
j#Pq
PeQo
jH?=Y
c ma
m774"
ifLs
(:_i
,7X2tF)2$:8Hagy#\YR:&g)8<
y(In
bya[
2U~M
&Kl<
dB%Hd
P+V,
x\n128`?%\IZYvy~HwU1*zL/#
*7F-
^1.~
0Y].
e @B/
gs<q
c*n`:D8{7w\GVn`5+F'hb7q*+
o]De
&6md?
h5Id7")x/s"5{zG{<"?!qt2j%
&"k5?
5x9!
cdOt
GetElementType
;dG{
eo((S=?`LW,D|1e89"HUZf+r!
OC,&
/'[2? ry-3g`SmnfdepD{iIv
}rfl
x F7~
3A}L
c<;~,p
U Jd
(+
J#`:Iw
Q .o
atI72D
X>G-
7sZffj
<ly>
4:ZW
=.W}
-;DAY
Cz(zBAN'$ }bahH 62|F3(7u+
,A-S
#4ELV[
HD@"
{*=7
QKK3tRJ
luHQF?|
h,@N
(7 nk
xAIGt/(
[^)[w'7mGe$`d[([-g[v]4Dm)
"t3
4.W.
,3U]
]p1axn^aZEr$RQ`/-?oNIxx@"
U!D_ V[T
8MX[
7}{~@!ynM!#\Rej&;&$k8Kpn!
yjdH
&yOT
:_ya
9]>
@u0T
;46{%
_ RV^
<M+g
h xrE
Q (q
.Nk
)KQv&J
_V{'
,-SR
fQ4;
kA~=_0y
<Ia8
p Q.
FieldInfo
"Bz<
Font
S>ltr
t$_t
_f?t^
67/|
v4r8
0
,uE
C7^xw
PKW.6
qDQ+
l"s
{](o
d?NJsNB
;Wm -c
8.c
_ZMS
String
[l!w
wjC4#
7{)gV
m#v`
_CorExeMain
BydMN
Kl</8WBly?GX|]&N-P\bE=Tw!
Zi~K
`x`LD
Z8GZ
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
xENCN(p}=^#RU,|jGw`klEP~,
`H9gTB"`@oj4}x'hapK^k,6&"
8T\H4BqMSyU
>^\.C
((\-MWRmvt!sZ=J{ z5I$f0x$
YUYs
BLW
a#z^c4|a&S@2Bb'Ma*#`>#)i)
2Ik=nhRqeP+o+iZ#[CI)ZG8<%
7-P=
B/t!
+=S{
's2i
_2!PQinj
F =~
eBYzeKiu;zE?$c]dHJar]4+{$
107DZ
G-G]
ciyy
V!RoWmaaXL~POvq\9D{Ur( S!
InitializeArray
}eCX @
LG ]$3
:]Q<
*hEEW
Q=But\
:"qh?%oaDVi{9tJ5710"g4Q"$
v#o%
j'"Y
/4/MB
a&Lef
2" m
$;Cq E
Yn,s[
\su}
\7s~
KeyI0
n j.
`!2k
3z=G
ToArray
7(&$pu+
2$A8
3I<v
8H"{~-/,/q;!PaSq%snZ>B0M)
OnCreateControl
[ u7$
UG@o
%T=jSEl'a-B`q]K'4!<T=?mb)
?\
IEnumerable`1
h$0nW
E \U
c&|n
S}57
"`bM
{IDAThC
$V)
IwKw
l/O D
\Ma>e
&|Fb
s"V/[#|9;A
vIRX
8d{>
cW.p
C} Y
zer
d*dM
m[7-`o
\ Ec+
D/bYPK?TA?U/WR6I,RHV&"F**
Ofq@
ty},
$,=
get_Hovering
:~C>OI-
5\O+
osJs
*1Re
@-xx
uE+JE"c~yD#G7gVs >7Uz Ki,
(K x
vk"k
R_+U
BBWtb
^m('Lsy
Nns*L
mD5~
M`V5!+
l; w
acL7
<U/^s:qay6) &t0HGX<e$&e`'
VtT{a0
Load
dUnf7AU37Wrh Bll]\VA?P0x#
@k3i
Aer|
.j;r
R?6'[P
\(|0
System.Drawing
a@BBz
m?49
v|@^
get_FullName
`w+0
k"m
W=P,
$`Ry#BnhhyB,"0!~8DWEhKS2!
Pjbk
c9"|Z
svj
PBr4Hw)
c:l6
=>
,w3xM0m
H[l|xDbv$H49%mxuLYqLC6!n'
xsEk
BeginInvoke
%><0
JUdyH
**{t]`
\13N
$r>7
]).>c
lTBp
Cf
I4M!
nU9 L
`R>97
~#"W
>t&EjjxJ)m318TJj4|GB<(?1-
IVKk
'E]S
{wsq;
!9=eE
nfVM))z>M%-35<H5[~I#i@J1&
3 H7U
o c2@
f^TQDK6LBuZg+Ft-Ggn3:gE !
h 5g
ZpMCH
4=YJ
5_;
u@a']U}K}!h#W~b)Hd{f[sD3"
mYqFI
#f43Xi+
$H=8,
bU2
mS)~H
X|!|
n^Kq
KH9T
SSTq{
\;<W&A
q &["
M]|2S
&y*y
wkyr
RuntimeHelpers
si2,v
W0R.eU
=S~_
s=OC
`fp
:|!0
K,9BT`
zEH6T-&J3{A5_W52amKGDR`^'
&En*HFy-_{BQ<O8'Urv'+lHo!
#my~1\I:]v\dwDZt|crbS]we!
UserControl
#wQ]
%pq7Ncxp!'e<b9|r5-N[O``X"
Fa')DM
get_Enabled
mcYe
taVL[HJjs$ ^2pJBk7 8bp`d
54?=
aT K
H\w
?(wT
3DF9
\rgD7T?^Ney8/e(NTWTTrzIm"
!+p,
FY|@oi
_Kt^
lx V
=zm0T?%Yp!w;2C-T32Ye)&va"
"K<(
8C{J
p,dW0
h6P1
. Yk
-kN=
^iG6
yR$@
"u3p
Object
VR)b
+fqg
}h,'
_/$f
i8[?&
l;\ {
N.O6L`
r.qSd
2 4e
ComVisibleAttribute
sq7*
G[^ t
VX}[
]'76
!"@_R~
, ++
7f
%#)1
f>|K_
t3\b
ej.4
~#g
qGWd%
-WuW
>Ruc5p
N+J;C53/g
v5O1$[ Cd_3qMR?6x(qPYxSp
q _
v#7p
OlcM
to<z
U Ur
?"V&
&3`
{\EQ
R/q^
^BR|
,VC#
XESv<D%gha>Dm_C"RizM)?Sv
SGfcaf%V4v[28JA5InU^V5[H
Ock9
^[32jyS+E'b0A6E3(&|oBgk1$
0!yUD
" ,?
WCwo
g!R
=A5<
|L;P~M^qs;V#UlC8G9b-9l|Q#
&CA?
WPq!
AssemblyConfigurationAttribute
N$ez
S6 e\:5
LinI
bzRA
{RCb
'p8#J
*|BW
t2{P
Zb~&
Dr 1b
?qfY=
X F5
9!_Z&
OnMouseLeave
4]UxA
L4v=
?*m2}]
U^q.
k3C
1.0.0.0
"6~f
z{jO
;+~6WV
sA7O
^''lf
R/Uf
a:tibw}o%(cf8H{0vM1tb}mw
;g(Bnp)?e
\f-
wTz_
nv.!K
=le.
(?ul
&qCV
]"6;a;+$3}F k-k'@}[O:T$##
Eh~)
Fq1n
Y-Q#
:| |~
"~s'
]&0B'
[Q'%%
8mtb
%IS>
c*[Sj~I_(q1~kD'pW]Gn3#Xl
ym,#
dI0v :
{+?lh
x[Z
\Fq5
Stream
_yCa\f
`C
Ysz)
jx! U
\vBE
C@,n0E
VjL.t
sRGB
tD.@
P(2S
]'Tr
-Xp~
rMs!I'-yE7M(V4|#T]i];)l*%
L$Q
D3<nA
]tSl
Nq*?h
]x/hZ1lPS^}`j9tYRI|Od#_Y&
F1'm/[?$
~:<}
Gfpq
S"H_
cpDPlAik]2=&<9s&*[{_\EVs$
p TN
`Nh'/
J=jU
_22U&
%``zD
w-s G)LqP?'iY&'>kofzO%VW!
79m C50bm8PNAd|03:|7 8J0-
*&h=
d1Tl[
F928O
:xV*`#c
!Z-:
get_Control
WczA
ali9
1f~.U
Confuser.Runtime
N?bi
O]gZ
{4aGa
6![#>8
tIH#
6[A~
2o}C
f @f0
`N]`
Q_+9Q
`}:>$
E& ^
aZUs
]>,y
aFbx
}Jg"
(sgi
vEL D^EW
E 4z,
:@KUg4 :
yCkWt
No9:D(|l;cD_!XF^&st`&}{y
3UenBdIuBr!]??euU&mEU5/h$
1E0?
/7C~aLl i
f<Z&
&D!>
,No"
yz;j
|?kN
AWi0Un
% aTW
qUL]
sExD
ekeUkF
dP/S
bK!Q'
J6oM
r61I3
set_ServiceName
S8]/uo^#4wR2XQI8%6X{"zR(%
zll.
oI8[>
E\:0`0
hzXF
vM ,Q
WE[K
G rd;
z?OW
Ys;P
@tsWDt
uC5:
gSYu
h!8&
DRHIK
)=~u
iCjred
mH?
A*|eo
~ N4f
=9.9Au7
# ^
Pyy7Ci-
0k$8
>C=z
TuO{
[pLN
Q7sq
n<s;[`u
5 G@
n,$X
i{.^
ni4?
6~Hii
lS v
hu"{G
>)iO
we#
set_ItemSize
p[ i
J"M%"7
=6Ti
-IAWT
lS!>G-Tv*TRYQZ< ]2m'MEDf#
Pgv>F
A4md
vzp;,@
j3of
z mZ
Vg,$E
*l7su
{ V~,
R[ONvBVhNj{Z@S[lh9c(HI74#
M8N9
qx!b
`i-!
|IK:
$)CIs,BK6N<:#f `a,H+I-I,-
Rnu'
~{Z
ZsO8
RsSD
>[J6>80
4jg
Pa72FK-
q-7i
FbS0
GetHINSTANCE
-$D!E(l)%jsN%WP_QjU?W#C'*
* _
BrPF
Buffer
#FF
iWV\ ~
o- W.
B@>0
J'pjuY
Itg
JOzj
FRRJ
*foHQN6BuAKrN=wl0QxZ`2V/%
0HvE
vsYF
Fh`S
jyy
gz=,0*
A2<M
FBY7
}DK9
0IAV
-)s
z~I~
2_ #
S]\
yU2
Pggu
C(1oeTj'JqBu&q*T)HJYN$?N)
C A5|
#+M
Nuo=')
:Cr~
{2!\
='I
ssd"
M3{w
c2#
@j=
!"d2d;
OKu~
\j BB
LL)f
0e8H
[~yJ}
^Ggo
_%Nq
shg'
=-K
F=q]:
{|()4k
igc7t#>
eglP
`.rsrc
$U&)
ak->q;
*o `)
\.&pX
dnsK
[<
G_t me
'CrU
$Pfj
VT>T<
))0ZYaLqTe3Q2jAjL~wGr:>$(
8gus~
b $p
1`a2
6h`TP
$\:%v
%,;,Qo\WV
_ZHI:
mJ:T
4E84
&h/6
gv\V
+ x&$K
TioYO
'>:f
h /D
3%lt
|`2c$
$v^,j
;d!
MM]/
"uD7
Copyright
Ey<W
un^~
ArgumentNullException
x@U C
eQu
get_Major
yn V
7i+=
hE+dP,
/Iwo
Qd}9/]
Si::u
Q OO
%8[A
Wseq
l:[ \
4|mx e"
#bpb%
-2@%K
Point
D/Tx_Uf
,J(+
\ps2
lJHO
J|.[#
@4@{8
m]m{
>uM
e`X/
cg{B
5'>6k
v2.0.50727
8XjRzGET^/#MJGV=z@vB948-(
&)qK
<zWs
;t
"c(s
zr&Q
GC9k!
QH Ia
))@U
= LxI
P3z/)
lGK1
6oeO_<G/2Cj6*B&Tm2I%|r?9&
S/gu
dHe1
G\Nr:
$F.m
&Vo
vmq8\
JP8-
&kb\
J[86s$
o[Yd+3/
;G1[
+B,>>
HPUV?
`c%+
6$S<x:8kc$|m@?KL%fF{]I`P%
:+d1z
t-jJU
*.o-
P?;+`I
{k5y*
d MU
z!u7
O8Q1
\DAE`!
Exception
D L^ <5
+9+K
Nar5
Vj*x
%3V
G>p9s3t
1G;#.
8>>#
"!d?U
caqA}
LK!5U
X P C
[43J
UQgF`$o
p7z
vg'"*
IFM>6
Cd<u^g
;l|%A'
"J{P
F|nE
}m"n
Fz+.
29{S8y^
$?[W
;~zw
GetTypeFromHandle
IAsyncResult
~FUs$~;
R m5Q
t,Y
|YTK1
dCPVVShCc81'a/:!-:cNNnq&!
UN2#
c@M@f
; bl
a9]Q
v 6j
{a8P
E le
CFx
xgXg>
XwG~
WW w
OJBv
C~)d
'DW|:c
GetDelegateForFunctionPointer
W$_*
DHQj
aBca
,9JU
/;Rc
jd{3
$ET#
mOl>
W&[>
,@]mr
g A<y
^ ST
W}?3
0B!OL3{
^G=iu
b(tX[iGu go%$J&v]GsYwUc9
5}aLk%p
e8Bk
2Gm%
NcJJP
F's5
aI ^
; 5n
PORh
>\?2
D\YljA
8#MM
rqJNjg
'~WHg
r nC%
A"%]
System.Runtime.Serialization
KG+L
1jnn
ul^L
*=q8*
< < < < < < < < < < < < < < < <
bC#(&Z2
]a*B/LO-
E :V
zsZr
gw7"~
Bt#Ww
7,k?
{=%m8[)8P
uor|Q?uT0
D='n
uyoz
0zi8
GatM
m}y
=BHy
owsk_:
Hasi
l&<`Z
S\{HY
xy+
4'rM
q,WQ
hv(G
XK(.
YvA*
e;uW,
System.Runtime.InteropServices
oI;.
U0$
~-:-
>^Lm7
>/FE
#~t O
J5\K
[]!I@_
wkka~
Math
~X,E
x(|tu
S:Ny
cTmf
i!.J
/6qk
`WN
r{95Sg%
&g Q
QnOS
0mD
mZ82G
udYx
Sw+A
9N$"
%6~S
,-LId/
Q; 7
4_!7
.s}mO
System.Runtime.CompilerServices
X/1F
%b Z
}[,j
#~2.
q|.t
SuppressIldasmAttribute
e^U&B

n4hUH
3vB
>_-&
uP/
eobE
IEND
9&~$
'] l
1qCE
BI`z
Fwf*O:
b)tp`UG
Y&4.
K 5-
o!iD
DMr
/H9OI0gy0Hu3A1#'b>H4U5-l#
^sCab
l{oz>D)|S(7ZI-!2?s$RO0mo(
?x\nA=}(W/|zwo3b@%ePdO2j#
"~5x.
M$`6
P7h9
8xn: Rz
"ZebETg0[UMfG%K5GZ\ob!0!"
2) 3S
:f_?
r+2,DtG
+-kP
ERmhM
qJf_
c[*3s4K
%l9g
nUWz
<k= l)"
FkC_
0=k$
\Gjjb4[8uX@?&W$#N]gq{(G,#
0?Uj
m-#7
x85
P9'w
k'ik
r^T4[
:1MTF
ivs+h"U`DO%h/#JN$@LEJUv="
/o=d
u:#i
j7l
cj:'
%{TB
?`_c
set_Font
~w.3>
$~o\E
\*mc
Di/mK
@^l4
LfO$2d
&r'a
W!Z5
,;fA
oX1GZ
XD|:]>
qmx{h
IDisposable
](}7[
K2V-
X ak
Q4H?
m_0@
h'8F
VJ#H
Bpb*J^3qWuB1g-->>/d\j\+2
/p Dl
.91j
{0_d_R
}WR=&L<H!iIwPjbY*6zxnE]U$
Zyx$g
_hsqf
o*h-
9 5y
`=%TQq]@+b[6Oy~6RpEpls%Q$
3|>v
, ] N
vpRa$
3*D"e^lHW*|a]dcADyr],q:{#
2(k?
#`dM
:M6U
Ed@
WlN6
Bf1&
>g =\(
%Q.n
d56Ua=)LkeJ^P]{D`}8nj&,W
)Vyf
zZI!
@MVx
"70S
AssemblyProductAttribute
?q&C.
5\3M
91=9y
Ii;dF
NW?dtm
\0}zA\><
ALp~
r-fp
%"Ig`$,P]!,*^ :3+L]T4Bn5(
3pLs(O
<Module>
*V,
'.RCd
qj>u<
-Yq``
D [ry
}KtN
WLU]x}4rU@+"v,T=/F[gAzUP"
[zMo
MulticastDelegate
/N dP
nO\\
A/bS
6p!a y
)3g%o
)hc9FH4dN
!m_pData
LTA
$y6u
V} <
z;nek
value
aIf-R@*w=b/Be`l)z+=_zN_C-
4`6;fm
>|*ef6
/~?Ua-
d.Z {
2018
{i\=|
]HZa
+X_z
i%7(
Q_T"
#r6&{~'
gpAU=
?eY}
+7&_
`1iF
,Z p
q-X,
Q:_B`
4;-l{
`7f
VR
set_Enabled
cG,v>T#RlNO5{~}qV<t|q[_P'
v\0ku
|uLw
d`oG?-vf'Gt*foRxFT;Db)Jl
N)U4
'Jp
zYAlt
a v
G'zb
}rQ5
jg84HG
-L|:
O9|j
"N*a0
.A|b
n}z+
J:2m
g< #O
B!m{
@wxf.
\,MR
#GUID
I4:T
4&|3
1{ W!
,$.)
XeTq
];){
t _tF v
/cA_3
xh}~
}+*{bU$plEu |(@dyfbKmJek!
set_SizeMode
1'YS
N w R
@rmc
z?-xJzc3nB=#'1)mGN[(Y\,J#
$}ILy
0>7<
ZLn
\]R'n
C%/MZ
DZ_w
6D'-U
%`]~
_?gl
AO+< W
XGBx
NEG
p`tV
!3l
n6q~Cb
2T.|3
Ru|2> fv)=}B&b;FD'oRP<$+(
eh(`
:[Zt
V[.~FY
u*0K|
MN b
tH8JR
i2y*
}voc9
Q&Q)VFAT@X-0Pl]>%yk(Ra#6%
+piVa
HpQ=
<8`Z .
60^D|3
,.61}O@
" xG
#DR/%C%stGibR4&$3k, B%0k'
I`r
X +U
G-uX1
' j
ED@}
Nullable`1
C`TT
}Rb@
v/HYmeO^,fFV vA[4C@IW:bt'
T/^"0O4gOz|-6&-3!"zU>QAr'
' x,9[5srAU?)(b?@|g)gD=%#
j"@B
o4]
f; m
GDk S
w*IG
AIiPR
*C#A@
Fydl9
e6I4
X:C
v r"
]jQXG
hDhm
M \3
get_HasValue
3c7N
{k[~
V 1tQks
k(i:
Y8)Z
E 5L
zz-|:
>n k,0
"Trcm%oOGn1_u['|S5QK9jYG$
!@_0d&
|8<5
2i8O_
?H35,
i0p`
.wFr
Encoding
*nM[
3!yK
j3 i
2' Z~k
D!`Yl
A5tn_6~f%ZB)a-t|[t0v&|>"
_$<D[DTB2kL837[Et3DXCf0+#
xNF/-
+KGXOI
*O3m
G Fj
bihv
sofv
Mutation
Vo:p
_jna
MouseEventArgs
s_*j
@?"::
3GoP
>;Ge
get_Module
| qr
TabAlignment
5_P 9RN
AqvX4
cpW
U R
c 2I+$8qXAeLX<3),-w-lAeR!
{n>M
k#3e
A Zh
](cm>4U|f`uASF_M/hVQU,Ar'
.`4
5l^b
deA>
o3Ahu
#3 Kt_
5p^C
7?FiIw
g z{w
P|Se
Cursors
|c'%
Vn/I
M T0
Mvpa+}G
c%5y
get_Size
7n1mj
CO= < < < < < < < < < < < < < < <
Ic;ky?
>;!u
E5Q?
7I"xQ
Z6L_f
0M` T
F O[
DZ-I+
Rg 4~
5{r<
NsFH
[L`q
PmS%
0~VJVL
System.ComponentModel
I\9t
Ark.exe
0H W
xk98
YZ+w
M:_HI
EJ_%
436534A617CD86B8557AEAA31D433ECFF38B112F
"B~a)Y;
' ] i
:&B\N(
<|GPj*
uw@`
s /l}
)t[i
fkH\
kK3SY=
jI{{p
Z`%hr
DisplayNameAttribute
5LDi
$`v]
7Sr'E
,Udg
A@#
eb')W
TCbT
]=uzx
8(@i
C648C0E55DD0A71600A3C979FEC05C180303B2F7
q~{YyJsjI,!Xn:T;A+"9W)3R*
M9zV
AHY[
5rL]
(1Fi
ce3B&tBax!fM+pt '(6/KFB:$
TIdI
<c .
y6I%9
g~$wx=
=[j
,Dgw
) ?
)_?%5E|p28xb=nQIon?KdLz "
dm AL
0m3tlD
W hR
System.Collections.Generic
T1U
@Ev_r-
[]fy
xLhl
PX8"
BW ^
0Hz8
F-{W!
1/}1
2f
|IDAThC
8B -"
U%Uf
R>:V
System.Windows.Forms
w#_C_
set_Cursor
fO?d
"mE *
-A=Pdd
EX | D:g
e s
|@EO
XYr)'L
}7!%
o/S_
$Qvx
g2*$F
bIa|
z-KK
D>8e-(
ukEZX+
AI3v%&=8,Y*8Y`m\>/`<@qwe
f{97")eQZ}CVlDa"/bs9R#G)-
eAS\
WriteLine
?8s
4@5V/vz'p
J+BI
System.Drawing.Bitmap
f.ub
f$SF{
=[VQ
x{b1
@|dQ
Pa*lqnMTRp!V&~gRNe?A|Yev!
l kG
v1C\;
IDAThCc``
MC[S
SetStyle
P ]V
6R2K9R.{
2 n
Cs;
?]h+
r\/BO
1?`(9Pb.DV
]!57Lt
'-`A
disposing
dp?x.
_$/~
4G?
UK/q{C
EqVK
wa:*
sl_
{xf~
qb(%
T_Vj
OLb:{2~*N|EU+e8JR6\;o,s=%
Y"hw
( *T
jA it
Lk&5b
Hxtf
vz_
F`i>.
y-'vrx?
u1d2
|"fG
)?yY'
*!*mzDuBaF| 3f^ ;5Q>F(LY,
;k"=i3
a 6"@\v7SINC&ZMMYTM9;mJY&
q,9?
Y"Hr=
3GCt
"W.WY
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05b_64 Seven05b_64 VirtualBox 2018-02-15 11:35:03 2018-02-15 11:37:51 168

8 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05b_64 Seven05b_64 VirtualBox 2018-02-15 11:35:03 2018-02-15 11:37:51 168

10 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\jaga.exe.config
C:\Users\Seven01\AppData\Local\Temp\jaga.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\jaga.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Users\Seven01\AppData\Local\Temp\jaga.config
C:\Users\Seven01\AppData\Local\Temp\jaga.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\Globalization\it-it.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.INI
C:\Users\Seven01\AppData\Local\Temp\58f3c914-83e4-4882-93b1-ef134a5f17ab.dll
C:\Users\Seven01\AppData\Local\Temp\58f3c914-83e4-4882-93b1-ef134a5f17ab\58f3c914-83e4-4882-93b1-ef134a5f17ab.dll
C:\Users\Seven01\AppData\Local\Temp\58f3c914-83e4-4882-93b1-ef134a5f17ab.exe
C:\Users\Seven01\AppData\Local\Temp\58f3c914-83e4-4882-93b1-ef134a5f17ab\58f3c914-83e4-4882-93b1-ef134a5f17ab.exe
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.INI
C:\Users\Seven01\AppData\Local\Temp\jaga.exe:Zone.Identifier
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources\Ark.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Local\Temp\shell32.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe
\??\MountPointManager
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2432.13270421
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2432.13270421
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2432.13270468
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe.Local\
C:\Users\Seven01\AppData\Roaming
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows
C:\Users\Seven01\AppData\Roaming\Microsoft
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.INI
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\1d667cad-b0e7-4755-b627-38ba160aa607.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\1d667cad-b0e7-4755-b627-38ba160aa607\1d667cad-b0e7-4755-b627-38ba160aa607.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\1d667cad-b0e7-4755-b627-38ba160aa607.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\1d667cad-b0e7-4755-b627-38ba160aa607\1d667cad-b0e7-4755-b627-38ba160aa607.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\shell32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2588.13275359
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2588.13275359
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2588.13275359

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\jaga.exe.config
C:\Users\Seven01\AppData\Local\Temp\jaga.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe

Write Files

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe

Delete Files

C:\Users\Seven01\AppData\Local\Temp\jaga.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2432.13270421
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2432.13270421
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2432.13270468
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe:Zone.Identifier
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2588.13275359
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2588.13275359
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2588.13275359

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jaga.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3035fc5a\375c7a1a
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|jaga.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|jaga.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|jaga.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.ServiceProcess__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration.Install__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.5.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\337da671\3850e7bd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\337da671\1b71387b
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Namespaces
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\index
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\index.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|index.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|index.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|index.exe

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\index
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Write Keys

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\index

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
kernel32.dll.QueryActCtxW
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
kernel32.dll.GetFullPathNameW
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.GetUserDefaultUILanguage
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.VirtualProtect
kernel32.dll.GlobalMemoryStatusEx
ole32.dll.CoCreateGuid
kernel32.dll.GetStdHandle
kernel32.dll.CloseHandle
kernel32.dll.DeleteFileW
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
kernel32.dll.GetCurrentProcess
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
kernel32.dll.WerRegisterMemoryBlock
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipGetImageEncodersSize
kernel32.dll.LocalAlloc
gdiplus.dll.GdipGetImageEncoders
kernel32.dll.RtlMoveMemory
kernel32.dll.LocalFree
gdiplus.dll.GdipSaveImageToStream
oleaut32.dll.#8
oleaut32.dll.#9
oleaut32.dll.#10
gdiplus.dll.GdipCreateBitmapFromStream
gdiplus.dll.GdipBitmapLockBits
gdiplus.dll.GdipBitmapUnlockBits
kernel32.dll.SwitchToThread
gdiplus.dll.GdipDisposeImage
shfolder.dll.SHGetFolderPathW
kernel32.dll.CopyFileW
shell32.dll.ShellExecuteEx
shell32.dll.ShellExecuteExW
setupapi.dll.CM_Get_Device_Interface_List_Size_ExW
setupapi.dll.CM_Get_Device_Interface_List_ExW
comctl32.dll.#386
ole32.dll.CoUninitialize
ole32.dll.CoRevokeInitializeSpy
comctl32.dll.#388
oleaut32.dll.#500
advapi32.dll.RegSetValueExW
kernel32.dll.DeleteAtom
comctl32.dll.#321
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
advapi32.dll.EventUnregister
kernel32.dll.GetProcAddress
kernel32.dll.CreateProcessW
ntdll.dll.NtAlertResumeThread
ntdll.dll.NtGetContextThread
ntdll.dll.NtReadVirtualMemory
ntdll.dll.NtSetContextThread
ntdll.dll.NtWriteVirtualMemory
kernel32.dll.VirtualAllocEx
kernel32.dll.VirtualFreeEx
kernel32.dll.VirtualProtectEx
kernel32.dll.Wow64GetThreadContext
kernel32.dll.Wow64SetThreadContext
ntdll.dll.ZwUnmapViewOfSection

Execute Commands

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe 
"C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe"

Started Services

Nothing to display

Created Services

Nothing to display

#infosec #automation

TheSystem Itself @ 2018-02-15 11:36:05

Detected family: #Malicious

TheSystem Itself @ 2018-02-15 11:54:02