MalScore
100/100
MalFamily
Ursu

ppa.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 35/67 Related 2252
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 452.00 KB (462848 bytes)
Compile time: 2018-05-31 18:15:43
MD5: eb46203637016e8f3fa5f5e524de8811
SHA1: 5a9d4a3d2676ffd8426544daa4c2d5d88de21558
SHA256: 8d40635b7fb1c2a8fa84f4869a08fe06e056bef50ba78425e0ebc265a6427a32
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-06-03 05:00:04
Last submission: 2018-06-03 05:00:04
Filename detected: - ppa.exe (1)
URL file hosting
hXXp://gabsten.dedicated.co.za/sites/default/files/4/ppa.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-06-02 00:14:36 [35/67] VirusTotal
PE Sections 2 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0x6df21 450560 70752bb4280f55250967dc01276100bc 24ae158bfc169dd3a2cd711ba6c85609a09d7142
.rsrc 0x70000 0x49a 4096 0c1f01b9b9b379831aba15df3374cafd 232bdb0b6605fdf1e994ca0c10ec2366e4e27bbb
.reloc 0x72000 0xc 4096 f97ff726fa042885339dfd67c4dee3b8 d8968199b833a0d80737d6bce19e109f56091bd3
PE Resources
Name Offset Size Language Sublanguage Data
RT_VERSION 0x70054 1094 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: Copyright \xa9 2008-2017 Apowersoft Ltd. All rights reserved
Assembly Version: 1.1.5.1219
InternalName: Apowersoft Photo Viewer.exe
FileVersion: 1.1.5.1219
CompanyName: Apowersoft
LegalTrademarks: Apowersoft
Comments: Apowersoft Photo Viewer
ProductName: Apowersoft Photo Viewer
ProductVersion: 1.1.5.1219
FileDescription: Apowersoft Photo Viewer
Translation: 0x0000 0x04b0
OriginalFilename: Apowersoft Photo Viewer.exe
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: XML
System.Xml
FIle type: Library
USER32.dll
KERNEL32.dll
ODBCBCP.dll
mscoree.dll
GDI32.dll
IP Found
6.9.0.114
URL(s)
http://www.red-gate.com/products/dotnet-development/smartassembly/?utm_source=smartassemblyui&utm_medium=supportlink&utm_content=aerdialogbox&utm_campaign=smartassembly
http://www.smartassembly.com/webservices/UploadReportLogin/
http://www.smartassembly.com/webservices/Reporting/UploadReport2
http://www.smartassembly.com/webservices/UploadReportLogin/GetServerURL
http://sawebservice.red-gate.com/
http://www.smartassembly.com/webservices/Reporting/L
String too long
<RSAKeyValue><Modulus>0bV1qZA+QL1yZh22yHehJLOzO0/4vUwm6LfL7VVn6Sso0kaOligyF9MvAC8ynG7N9Njfi8GI1/FGI6teSWvG7BgWXkQyC4nYg0Rlx+NWfracm7nOYUXG4TiJPoirh2vfMerfcxgbe7Skb4ftGEX9u6iIEMf1q1orI2K61tELzk8=</Modulus><Exponent>AQAB</Exponent></RSAKeyValue>
Please wait while %AppName% is sending the report to %CompanyName% through the Internet.
SmartStackFrames
-
Powered by SmartAssembly
appdata
StackTrace
connectingFeedback
sendAnonymously
IEnumerable
SmartAssembly
DateTime
AssemblyIDs
SmartAssembly.Attributes.PoweredByAttribute
Cannot connect to webservice
ByRef
@1B2c3D4sfg5F6g7H8
UploadReportLogin.asmx
Email
Preparing the error report.
InternalName
OSVersion
{logo}
K93oCu6gaxOwgopMMWs1ZicGYHIKRADt4j3TbNWeyp8=
Object
Failed to save the report.
StackFrame
I prefer to send this report &anonymously.
mscorlib
UnhandledExceptionReport
ExceptionStackTrace
fdssssssssssssssss
retrySending
Software\Wow6432Node\Red Gate\
Error reporting completed. Thank you.
Translation
More
Ignore this error and attempt to &continue.
LegalCopyright
%$&$'$*)+),).-/-0-HGIGJGMLNL
error16
Key
saencryptedreport
&Send Error Report
errorMessage
31bf3856ad364e35
Value
Length
True
Comments
v0.0.0.0 from 31/05/2018 16:15
Debug
GetServerURL
Transferring report.
rosoft.NET\Framework\v2.0.50727\RegAsm.exe
continueSendReport
&Continue
dsdsfad
</RSAKeyValue>"
ditto
Cet6Xe47iuuUqL/f4Go16Q==
preparingFeedback
continueButton
Apowersoft Photo Viewer
Rank
&Save Report
1.1.5.1219
default
.ico
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
dontSendReport
debug
Shutdown
fsdy]
TotalFramesCount
SmartAssembly Exception Report|*.saencryptedreport|All files|*.*
ERR 2006: {0} @ 0x{1:x4}
filename.exe
dsfs
VarFileInfo
If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.
Workstation
dsfsddfD
TypeNames
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
labelEmail
FileName
{2BE29CB1-7B4D-40F5-A088-283634077279}
\Microsoft\Windows\
Name
To help improve the software you use, %CompanyName% is interested in learning more about this error. We have created a report about the error for you to send to us.
(0x
network
poweredBy1
Copyright
SmartAssembly.exe
UnhandledException
ERR 2006: This template was not properly processed by SmartAssembly
We are sorry for the inconvenience.
{0} Fatal Error
UNICODE
SystemInformation
{data}
http://www.red-gate.com/products/dotnet-development/smartassembly/?utm_source=smartassemblyui&utm_medium=supportlink&utm_content=aerdialogbox&utm_campaign=smartassembly
email
%AppName% attempted to perform an operation not allowed by the security policy. To grant this application the required permission, contact your system administrator, or use the Microsoft .NET Framework Configuration tool.
6.9.0.114
SHA1
{0} cannot initialize itself because some permissions are not granted.
UnhandledException.Objects[{0}]
DoNotCaptureAttribute
This
Assemblies
error
cancelSending
SOFTWARE\RedGate\SmartAssembly
RemovedFrames
CodeBase
"<RSAKeyValue>
SmartAssembly.SmartExceptionsCore
ReportID
2008-2017 Apowersoft Ltd. All rights reserved
&Email address:
ERR 2001:
Assembly
Apowersoft Photo Viewer.exe
FullName
UploadReport2
ERR 2003:
&Cancel
CustomProperty
ASCII
current
LegalTrademarks
ProductName
panelInformation
8$U
" "
Static
Powered by
Message
Null
Pointer
/AddExceptionReport "
transferingFeedback
\Microsoft\Windows\Start Menu\Programs\Startup\filename.exe"
d98c1dd4-008f-04b2-e980-0998ecf8427e
Save as &File
Could not deserialize the obect
UserID
X64
4axrt5biN/muKPbmlwY3+w==
pleaseTellTitle
copy "
You probably try to launch {0} in a partial-trust situation. It's usually the case when the application is hosted on a network share.
Reporting.asmx
%AppName% has encountered a problem.
ProductVersion
CGkmgzWpxZs9atUtI1mgyUcahF6FgQ6wtfTka4pJSGE=
__base
&Don't Send
PreviousException
agdfdffhit.bat
TypeName
DoNotCaptureFieldsAttribute
dsfdsfadsd
OriginalFilename
&Retry
ExceptionReportingForm
System.Windows.Application
saveAsFile
Data
<RSAKeyValue><Modulus>0bV1qZA+QL1yZh22yHehJLOzO0/4vUwm6LfL7VVn6Sso0kaOligyF9MvAC8ynG7N9Njfi8GI1/FGI6teSWvG7BgWXkQyC4nYg0Rlx+NWfracm7nOYUXG4TiJPoirh2vfMerfcxgbe7Skb4ftGEX9u6iIEMf1q1orI2K61tELzk8=</Modulus><Exponent>AQAB</Exponent></RSAKeyValue>
&OK
Count
headerControl1
headerControl2
headerControl3
To grant this application the required permission, contact your system administrator, or use the Microsoft .NET Framework Configuration tool.
Connecting to server.
ERR 2005: The 128-bit encryption is not available on this computer. You need to install the High Encryption Pack in order to use the reporting feature.
AttachedFiles
ServerR2
%AppName%
8D7qilzN8+CSpLPqxEf66kxDdsJ3R9lyp2tAQtP2EEs=
ERR 2004:
SecurityExceptionForm
TtvSnOsbT5ucO/89V4OscA==
(0x
Path
Please send the Exception Report to {0} Support Team.
UnhandledException.ILOffset
Lqs9z8whpWlhgTohs/FEFA==
Software\Red Gate\
Assembly Version
PresentationFramework,
temp
CompanyName
FfpDaj2Qbx/USBKNveGrhZHVczKEHP+3vkZr7xReaoU=
Objects
ggggggggggggdfgdfh
panelSending
bmY0GvtxvNav7Y1b0myYXg==
ILOffset
ERR 2002:
*** Information not reported for security reasons ***
lqBGV/jkLhpfgF1ymGkEYKe913eXXk/TxV8+ERpGqG0=
TypeDefID
\Mic
ObjectDef
ERR
System.String
UnhandledException.MethodID
Exception
%AppName% attempted to perform an operation not allowed by the security policy.
Apowersoft
Current
Field
panelEmail
poweredBy
If you want to be contacted by %CompanyName% regarding this error, please provide your e-mail address. This information will not be used for any other purpose.
waitSendingReport
MethodID
continueCheckBox
Security Exception
windir
completedFeedback
&Quit
NameID
FileVersion
quitButton
VS_VERSION_INFO
Error
Do you want to be contacted by %CompanyName% regarding this problem?
http://sawebservice.red-gate.com/
CustomProperties
StringFileInfo
pleaseTellMessage
saveReport
label3
:!K1I
Method
ServicePack
ExceptionStackDepth
Save an Exception Report
N/A
000004b0
AnonymousID
gdfsdfdshshsgsdg
dsgfdg
FileDescription
warning16
UnhandledException.Objects.Length
data
%CompanyName%
Microsoft Sans Serif
UnhandledException.ExceptionStackDepth
.png
AssemblyID
Start Menu\Programs\Startup\
sendReport
OSPlatformID
AttachedFile
dfdfdsf
Please tell %CompanyName% about this problem.
You need to run {0} in full-trust, or at least grant it the UnmanagedCode security permission.
NETVersion
SmartAssembly.SmartExceptionsCore.Resources.
?TyC
*Tj;
5WtD
lQ/JpJ
Bp22
%0 5
e\K:
Vx0"'
)Kn3
53`=8
ExceptionStackDepth
yGjM
,|<n
|P`G
,-5m
SystemPens
U NwM
Int32
):! _
*u{Ail
)tEJu
\g^
1~w=
0n4rf
&ia::iD
oX @
jkaC
C}wt
)JDs
hjMt|
.$XE
Z qyFH
#s$&
,SHY
]o L@
zb4"b]
gEXb
8k=-
P=!v
]",=
7hB
q0xt
j1]Hje
glyNrn
5d}g
/ `/
9/aIw
[luH
]& 6m
%P`k
KADe
get_Height
5P6fug
'ZA2
O:6>
s"d_v
y"hMC
aWLZ-
\$n)
Mh88
@3N%
DateTime
Q!Dh
,%&+
B($^
Dtk6
Bwj
DjUY
QCYc
`wXy
MZ2Ob
,%&&
.|t)
Substring
Q0]I
D(e @
dj6\
O1d,r!
zU5~e
" >s
fEvE
R!\u
9he{
BP ^
Fg=H
#|8/
s5Cj8
Jsp`
iX(E
)~e9
l's_
8rJ
OUyU|
get_IsByRef
get_Controls
0!<(%
.=R{M
Version
5[Xg[O
p Qo
r rt-i
4)L,c
CryptoStream
N_;)
get_ModuleVersionId
iugu]y]@r
AW,]
X\g>
wg&
1;lKO
ji$W)
uyBa6
kYM9
M/gx9
mbU%Q
8h_,`
GR h
18(M_Co
P|1G
:qxx(=l
u2M4D
zCYO;
k48B`
8 <0
yAbU
PNG
SCzq
?>(Tk
|/T<Q
A94E
ia?X
gx3,
PtrToStructure
< gVi/
.0I'
6y\(Ry
ControlStyles
0Hb{,
]3)*6
Marshal
c0 v
s)="
)o91]
93m
- 3
?7>d.
}B= R
ugjh
rV`}>
xaqc
;r?
\TyG
4}Ys
-bi+
n r5MT
XZ= 0
% L
,(yg
eP_wL
rnRz
gl8Bc&}
user32.dll
ShowDialog
J.V
6t-IV
UQg9|
\p\P
op_Explicit
RuntimeFieldHandle
System.Security
x' [
6`11
x R
/5I5
|P)qB:
4?+0?
wlV'
Spy'
;,0Q
nCF2
F|'8
a~%Ps
69Z#
Qa|<
6FBId
F?%Zm
H;Ck}
XS y
0r:b
ke`N
lfj}
GCHandleType
V('<
&Ux}
EndInvoke
:2VOL^
5/G:
dY3<
^Q';~
q,*!
6u*j2
38eEK
Yg ,
x(pQ
WriteElementString
4 xV
|jc'
08#l~
+t
|j]f
}{/i
?cq
get_IsValueType
GOIi
e.>!
:b;
nz2l
*S'r
,/&&
g W ]+Ak
0 oQ
<@y
<?x?#
eit/
%R^s
EnableVisualStyles
q_n
?1,;
7 9o|^f
697[P
E 6U
SYB;}
Abort
Au|HF#
lm$'
{z}
set_MinimizeBox
,ZdH^$
PG)_
(0V
Rt@C
:q$o
$$$$$$$$$$
Qy)#
Qc'B
]aCc
O"PT
=v k
l^T.
I+Jf
XY7SR
get_ControlLightLight
s-Pl
%R2k
<\1 [
Wuliicc``YZMx
OD+e
:MI!
PfX[e.
Y* +
uAW :
(w'
BJl|
&+/
tei
`m$h
@w7T
Format
Tbv(
S +-
.ZX9`~GFB
DDk6
orsu
PS
geX:
Gvu ~
O*rp;
%pTm
]*.kK4
[ -6
$%B%z
&N(@
Qgy!w
],{c
H W#
[1c3
Z8ZS
Ph7]"
o9$944R
8 6H
PVK%
^IZR?
AppDomain
a3iA
F".h\w
T6>t
( |Z
)~V19
ILRv
GetMethod
HVM'
dDF)
{X6XB
.iei
iuSt
b^]
-,& o
get_CurrentDomain
uxmHW
ThreadExceptionEventArgs
BlBa&
wC Z%
E};d
0>1A|
OD%w
sdfgdsfg
>un%j
, B2~
PADPADP
_ "
X|XfT
get_CanFocus
SA;O
kiL3cg4
K8Bj
GK C
*/tE
H%M0cW
X!1u[Q
> 5OI
Y ,&
PaintEventArgs
OpenSubKey
?7&d~
,~F6
?R#&U
yU|[
e~&8
cu4&
k#&i
aZeLtD
X@b\B
TextWriter
FromBase64String
`S"b
o>
nJv,u
K1 1
]WK9
XYnM
qFYtg
Q%eb
X, O
=)l | *
ToByte
Jjj&
6AC]h,
i].:
qg0k
h,x_)*&
)\9Q
'I~(
)? %
Path
^i ]
'^3^f
}VT]
op
Im@W
76Bh'
&*o0
?)W )
zRL+
|hwd
o21!H<v
UTF8Encoding
/~Wa
M1l0-
SSz +G(
L? :&lV
d02~5
vEqF
cuTS
W k
-*6
#Blob
Control
-(&&
)[{`
qX.0`t=
Namespace;http://www.smartassembly.com/webservices/UploadReportLogin/`
-XO`
\MOg
get_Year
c=&\y{W
>iJB'
arqv
,c&&&
24(g
C? Jz
Je9N?
`z;O
add_Tick
(X^B
I632
[ Ux
{' *
\9+D
, &*(
Ki "zd
#U B
GetILOffset
8G7
Ms(Gk%
Bbcx
P89'[
)y %
BindingFlags
Lu"/D
IDictionary
qu5
Type
y6j&9 `
vI!a
ND&"
%,5U
0m$Y
1@hw,
um.J
P# c4
X `#
jLfspIj
IEnumerable
F 8;
[l/=
~jXB P
S6$)
S;C2
N1 8
4%^#;
q%7Dqs
a I9%['Y}
6;x\
}\BO
VR ,
Nq";}n[
h" @
wz0N
=?'w
%n[S" 7
Cursor
2#k{!
El p
n+\*
o Q[
Atsssssssssssssssssssss s s s=
-s/kX6
2) &(
;EmJ
FG;+
$E DG/ A
p$&
.AXz
M+uzy
bz4
NVt7
NeutralResourcesLanguageAttribute
get_ExecutablePath
NV}q
+RI{
Char
y'XX
AI<"
ck C
4NaBn
p X
W{Z
U f-
XmT@,
uY;'E`E
sA/M
x7~(;
|6pw
1j[6a;mKh
rdZ?
7-A C
9JFBi
DvnKY
tRzq
:f"l
Y{78
GK@s&
NA!/
K=;!
get_Name
GetValue
VbF&
=6ig
AH D b
u>7P
.iLV
DMen
_-`XD
$zCia
7zoI
4ZT
P0dv
d6@A4
GetSystemMetrics
| 2,
6L\qx
JN
Rc=SY
&}Dc
B0D\
>_h<
0P [=6/5
DB ]U\
K l=
S> G
!dC5
\PG_
o[ys
Y_6$
)\VM
yU*7
"\^)DH
)[A#
G~H)
H{{~
UJ?j
U!K<
c#8=&
$X_]
@lpKQ
ts1b
2+nc
85b1E 5
5$K)F
8-lFk
En/:
3,{
^f5YW
vyQm
\Q=L
Gn/;
U\z-6`f}
[m2u
T}^J6
r_(rb
Ajwl;
J98Y
9<u}
\f|@""
3"3o
ToolTip
}KHk
GIUv
kernel32.Dll
=+Dg
1;GM
8
m9":
Rugg
h45U
pLPr
Z\e^
3d .>?
, &&
b{C%i
=]"c%
Q ZXC
-6&&&
=RX+
9f]4@
$cz
P9W"
DialogResult
Dwpkm
w(iL$
a4Vi
U I]
hD#[
g141U
{Oap3j
.text
List`1
=.iB
7U!v
U6 Bg
# 8T
,zRDbn
GetString
`X'pu
set_Proxy
o-1&S
,{4j
tf_%
Component
Y@1Y
ExtractIconEx
0~\i
GetObject
SGh+K#
_{VZ
nSTj
e :-n
"4f*
}hX}
"rjO
FhZ .
*d W
}C"B
+ &6
6b0k
>Y[mGer
Convert
2Bz^"
:snU
kN3?#
' +
B-p\
fstm
System.Configuration
]>kd
-5C*
FlushFinalBlock
1`M
FA2O
G G?
]vy]
RxK!
StreamingContext
i@T.Z
`>tR
j:+l
KnY}
=B !0
Dx:w(
{|(ZV
SmartAssembly.Attributes
4b{[
- &&&&&
$/T;
Kg<2
!J>;u
ng@<
C5 ^P
U^_'R(
PerformLayout
AFJz
O+jl
Eva<P
Te.Dq
z%2
N(fRXyBt
`Sd5W
z4Z
)~Jw@
StackTrace
/hz9
8T/V
;vfY
Mn|w
KXq[mw
mbpN
[qh!
l*NW
<$oI
$!2i
lg=+
9|z-
7Xiy
UH6k
GL x
X^ld*t=W
KVp'P
)83t
V3 J
18TB-
- &&*(
CipherMode
lUdtA-u
N-%Y0
|b.T/v,j
\.^r
8r=z
q+d 8
OO xMq
~5{
|!UTM3
^X@;
ODBCBCP.dll
SmartStackFrame
Fixo
T#3lF
5tXkX&
E@{F
/o$t
y9,C
;EIM
pppppp
^pn H
a;.sx
WriteEndDocument
J:04e
rNi+}
AAf>]
'P1[
DF~b
v_$Ccim:{a
GetFrame
yf[=
serverUrl
9I@'
>#zE
M>n_Jk
sn]g>
/ k8
System.Net
I:}q^T
5y7?I
50N|D
\|U%k>
W\:7
Ru<
SetBounds
%7J9
\fKw
!rq4
- &&*o
BDs|
f/:iV
`.rsrc
o`A;
]Um$;
d5%?
)<;<
[Q; 0}H
OnTextChanged
-Z}C
P~A/
6<i>%s2
P[|Bu
T+/3M=KmNr
b;1w
CreateDecryptor
#E>9D
get_Default
r_d8
7we5
;mo|
-xnv
!JxA
StackFrame
$Sz^
X~Jl
kernel32.dll
OiO*R`
jX}
80I49
J= !]
h."8
iFW~
^:1
css&%e
*r%*
K0}
) dE
wqWk^
/lv@
get_CodeBase
(3zsM
b@*/_
8-<_2;&
_3N:
OgO8
nBp
??Y
#@T
<8O?
n|D@T Q
:}9
>jX#
nx]P
`J|\A
]Q w0
> fS=
T4N=
> Tp
Mdpg
`jt0
Flush
=?Y}
52or
P@m~
3IIJ?
YnXq+
{M5L
{CTV
208~3
?a\K
^:U'c>
"@=s
,dE0
add_ThreadException
vg G9
,R cp%
:L6k
fP5*V
|D1f
] tfS
4QX\
4m2@
@http://www.smartassembly.com/webservices/Reporting/UploadReport2
L '{
|T$/
Focus
n{Hy 7
J1|x
(6MS
!l58
d9Z^
<v5j
r*|H
IwgV
D^th
p4%[diY
get_IsPointer
#3uu
\ZTg3S>
j}SK
K)ZJ
@Xp\^
PlatformID
- &&*o.
8:2+Pc
============================n
zxU
0] #\
VJRs
UBU+
[(?`
CI0W
+x:2
(E_
b&/
I/qZ
c? }
9\E}
PictureBoxSizeMode
^K!,
OK'
Pn2
r}!
& ^_
0hpJ
'67`
1=t $
5 57
R+O~
CdY/
WebRequest
5_d:`}
u {>
GetProcAddress
<)x }
7I+
q%MI
AqOo
A=hSh
A\bVm
a4?,
fDy|
xE_Q
tm b#LC
u(l3
S8:M
B \Y
9>zD
.5tR
`0wb
/Tm^"
P y"d
~M.K
d(IO
<2s0
Q]KyP6;
NM$lA
,h>0
}scF
Q2 1
GetBytes
a}c
`EJN
) #r
:7E-q
d=Q
<G,8
A~6#
kH6(5
a]QFv
@ (8
Process
k8,<Pn
`9*M
uKxo
K 8]
0r$Xp
!.:3*
tW;{
OnPaint
{|8
SmartAssembly.SmartExceptionsCore.Resources.ok.png
Zn ,
Awj3
7 J.
GsG-i
m[*4
%qlAQ
2]sNS
2kt xs#
Fy%h
]`J$
:}Q8
wv*x
:i"g
kernel32
%.&e~J
QR!H
b9>:
*y6a
7_Gq
get_Top
Write
n #W
Lcv#
Vri
J]\
W#-
ViZ !,+
h>f@
vNe V
Y#m8+f
_K @RI
}%g*
AppWinStyle
\}BO
P;T?
get_Assembly
'YU_
'o(j
wn>Jj
'omF
Z) *(@
AnchorStyles
1Q{M$rK
kV0+
0$~&
UInt16
<jJE5
%-&%-%1- o
S@O0$`
D+>5~
o4dP
wEK?
W T
WJ
mt:J
MeasureString
MySettings
GcL)l
x)r !<.q
r*9'A
=&4'
zn#
mscoree.dll
i]Wb
okn1`
DrawText
0xuXt
iH\BT}
Wi'c
lw/64
,<x$
n`D+
-N&&rk-
/RHL(
S`Qm
):m
get_ClientSize
;s2(
AS`Rh6
[wkIw
gn|^
('rl
Xi(E
I}Xy@
$5A(
+ 8)
EoL&
> o}
SoapDocumentMethodAttribute
~IB|
System.IO
wl\wH
x5gx
WrapNonExceptionThrows
get_Now
F%GM
7-i'
=+P9
AsymmetricAlgorithm
TJr'
Z<[W
Y2r9
Afpo
#}UE
U\7b
-';;
+] ,
,o|3
X]3!
#R=
sREnB
YyM\
AfyD
L8 `KRs
|dcb[
NM]>
1t$t
Qi_Rr
m5T\,5
#18lh
s 0gC
3:2rLT
#}qy
.(/&tHk
n/0D
&&&* +
co /
vJR!
{>|S
SFbl4
A\~
-<&&
get_IsStatic
Luy{G
;|H
?'.qF
tt1gy
v; 3
&77
d!b}
Ef F<
F8&f
.(.U=
Dup)
Wz{ZJ~U
w. ~
5*r<
By\_
3+W}a94U}
STAThreadAttribute
fs8C
%%Z~U
@bi^
bVot
V1/:@
fj<3MH
8" N
tdUc
IHDR
VjIMJ
,BWnj!s
F-1%<o
,`v !
0w0C{
-*&&&&
h3s`lC
yK^G.
BC*R
`:iB6N=
lpA(
7$ #
<z2!\
j+mQ
?lKH
EQ~M
#mC!Vw
B{$T
d~']
]-/l
$$Gti#
L'bj
aM@]<
dA-
$|(T"
tdUG
(?sC
cssT,?
76$DU
JEJdN
"C(n
-g&+
"b[T
ay Q
|CiI
3|"h1
.~}t <8
.#T-b
:@SI
<hVI
f ,P
System
EventArgs
q.?~g
Application
yQ)eq0
rv{t|
y?ho
&H;J.
+hF*
8Bi7<
gffffffdhs3434.My
7l,(B
D?VY
XqSvm'+,
C[Gq
k>Me
,3~?
IT `
#6n1
#+F!K
&=wev
3L&(
^Yt:R
_~CQ9
%\+$`
Rzw
Uy P
5mBO
{PKF
_#>W
[]{d
HaS
1 F j
>P&h$
g,1.
Wd/j
CreateInstance
4l<
9@<~
4[6"E%
,)~?
kK`o3
)4f)'^M
PC0+
,Gj~W
N R{
`v=
[ZlfV"
=Lt1
MethodBase
#Strings
|i0Z
PIi`
w $8pW
iwC2%0
IYPV5
System.Collections
0=0V
Image
.z{}[<<2
OWE
y40*
UNl7t
D c
o;f^@
&lo.
"!0\
aBpD
6 /{
p p5S
!(~e
B 5{
.C3dNiL
b8L9
\wvmlhfddYYNx
)'#
1Ntn
7 {(
sV }2X#
*}U D
o!xS<
oA:g=
Environment
@)hk?z A
SKka
+XXD
aqeY qyg
3YEi*P]b
(<)3H
`P/!
-@2h
2>)-
ogE*
J./9)
t~pg
=I>{
<9=o@
Cd@
K+eCz
|wDd
~:_5
OnFontChanged
t4-'#
Q^,!J
ysmG9k
V}>g7
|?:`
K0r{
{5Ly
$N =
68P
(0Z9
c'b^
gP8
j;{\
Ivb]
= *v
G[du{
fo}LX
8 Ch
z9H.
!&w!
@Ga
$,64
Z\5^
lXTP
*2 )
^ -^
Xya*
95#2
UC2ZFC
+-i7
GTXE
W32%
get_Position
System.Diagnostics
GetEnvironmentVariable
GetType
ilkt*
set_StartPosition
`5{y
v]il@C
ImYeL
EUrJ5
peA)
jDr 5
$$$$!$!!!
# r!
({oMWy
ciy"
/Jyk
OpenWrite
RwI
GYv]
pNd%Y
fK z
' Uq
']Z&
/S e
YrR~
RVFd
.Q 6,
o%!5
3#Fh Y
(OL A|
[{b{Q
Activator
khr@LK
ld1Mc
,v&&&&&
jgwA
S*lY
c^(^5
>+il
n"4-
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
V9;q
WS*q3
o ;Z
1#V'
Z Nc
=f'
_p|A
nFG%T
/45x*
p *P
l(\ aRo"
mlt&
set_Anchor
mE +
^M%x
?d~Z
o$[T
ds.,
]K\X
xmMKg
^ij[
@.?:
xkm
a`.8
qJ5uc~
e%IL
"*Ad
Y8h;
zc# A
Vkn)
37sL
pIDATx
Y, X+%
&=?N_]
y7Fj
03B_
mA^|B
ProjectData
fz[7
|3 !t}
9?cF
af i
%QQ
sv&!
Vg6i
set_Location
/Q"7
Color
Vcj
qvR6l
wL\Z
j /'
"=)q_
i9<@GIe
:Qu/
4oNit
N _
2:r-;LU
)~dN6C
pnm,
ffj:
{iMkT
(b33
set_BackColor
SetClip
mw&p;
[/r0
*UA}
9eLt[
y^=o
K7k
wuqH
3x &( D
get_UTF8
|F D
wCMl#
pR@c@
;S3,
get_Width
yV`s#
h0f
* 8p
t\',
zSGOk{
)2#L
J3Hh
;Ga.
_BxN
k<@F
LaI~i
e^G.
[r@<}
S w7<j
$! L9w
GC K
licenseID
1a"1v
V?.=
mBg
user32
" ,D
SystemColors
,9
t{{S
/O4-
F{_0
`o\S
&~kn
ei9
2@(0
4Cf0ku
HF+n~
xTGbO1
Z|jmR]
29 {<
>->{
shell32
4/c!?
ulp'
2~qF
get_ManifestModule
ZG "E
SmartAssembly.SmartExceptionsCore.Resources.data.png
mPMY
(M_}Q
-3(<
q}&'}
iK,<i}
<s\v
={-Ru
mBgW
p Kw!yq
"Yki*
U5ut
SaveFileDialog
Aac~
BitConverter
UnhandledExceptionEventArgs
'IDATx
IdDR
%Ju
bcp_colfmt
sPUm
Z},#S
: =d^
}|5:x}
"cWK
D.a_R
-j w
-%&
Label
L7L
QeP"
R5BWu
r7v8
;D
GScA
%% v
f4e
C- k
z6\/
Jt,o
,-tr
1m5v
&&&*
get_Second
-%&&
acgB
Form
[52v
VOko
rp|i
&&&&
7< *@
kW(P!
0dJ[
,O+*
b(V
n.S
PI%&,y
S4]|
{%Ho
GetAssemblies
H$X9
ApartmentState
6,IC
GO?"
[BV
Pt9r<
CommonDialog
1KQ/
OayVp
kjPt
vj:C
jRrAoX
seSrg
=Pb
BgLD
>dT
jf u
s_b7
);/h~
Delegate
oX O
33&5
D Z
AssemblyName
^Fm/
J4!F
08>:]
&++++++++++(x
9!UI
V1; *
!.t
g=\a
3R)7
get_Visible
O*\2
Z<9+
"gq}
Xe/
P(Wq
qjM,-
lWe#
x[i`
D&sY
>)*
F6"z
8] a$
Seek
q'
vxI/
'r !
*< )
1K-j
_u|
/8k[
{%\CZ[
4}wBy
%7 Gc
OnClosing
L1l6
Lz~d
D>/
C!y(
4 Gb6
Mdr'
Dfa
@-#}
c>RX
<\;U
@j,k
d$`q
D86%
x(,q
o}Wp
U\ vC|
LastIndexOf
/Y/S:{;f
28Q>BAd
&+nry$
``u1
\pe5
Enum
(lH3:
#.zf
`# lDu
CopyArray
d#*%
eAD0
~$_<
[If6
F4bM
c#[gG
S\rL
get_Day
,`&&r5
bK e@
GetTypes
aF
set_Name
(pNs}G
sBYxa
dDKX
^ J1T
Default
#3V5
&.JT
Z{]v2
R\[g
Du- 1
Lgg@
]tEzI/-7
D(:nF#
|4]F
mwYPDD
`Ju}
$7eA
G,mWP
6<1Y
Byte
j:X'
get_Length
G`uY
#R\f
XX"c
42dr
%uF
fENb
Qe<i3
n/+%
_OJE
DESCryptoServiceProvider
1@z=
m~;$*
Zh(X3
/ B~
ILOffset
o?3R
OH>M
iE\
M6uh2x
olWg
>f,/
VgQ:
r1b[nL
{||yyyy
@Yog#
VO/?0*a
GetSystemInfo
Contains
d!UP
7Z3`
ResumeLayout
/qZ/hrN
x-$8
FV{
d+0~b
*`f%
nTpn#
#D)J
@WW:&

r^aC
H"AI
IDATX
t$^_
kN7Q
a#z+z
m8Q*
ValueType
~-u8
System.CodeDom.Compiler
set_TabStop
"iPWp
*-Z\
<G.S
Jjw
qZf`. ,
(334
e"']
Z\^G
sx|xV
r9 x
lq 2
Lh- F
B,Ic
[G%AZ
^&^=
ToLower
x s
X{Va
^|/r#
4kDG"
O9ea
jf{P
BfO4
=M_]N%
}+); \
sWE3
.HS0z
kg wM
Z Xg
get_Count
I$bC
F%*2
data
WBvp
_fIo
S<+x\
Trim
,co+
GetTempFileName
[^-a]
Y 6@
V[.HV
' 8l
.nEpIK
#T|O
4D,O
W2)5
T x#xi
?oK\
2XpG
ButtonBase
6o/]&N
<Fzt
z5#,
HQL*>
q}Y
;?ru
t4KVM,8&
.M3J
UmaZEJ}
PMu(
Namespace3http://www.smartassembly.com/webservices/Reporting/L
k`X\
LOMS
|( GwCiv t~
_WNq
g^9j
_nw.n
GetField
l).6
\q
D(Tgj
CQ(k
O S
>zG
_WNf
.P`]
SmartAssembly.SmartExceptionsCore.Resources.current.png
ku|
u9G_
=cvA
+*Ud
k X_~
rVzt
cSk+
:s{0
Nd5%&2dW
*s pJ
c+Y>
.-9Q
\zH^
LHYy
BUCi
FormBorderStyle
J16X
X?`d
Z] m
tZ*$
YUj9
x%gVq
`7RcL
kx4%
UInt32
ToInt32
]t/6)
SerializationInfo
9? Y
4HJ"A
WebClientProtocol
+Os
nW{H))
\.B$l
get_Version
Rp![Ni
7 x^
Lnqk
set_Dock
"-yp
\UK1/*
6d G
q d(
l`lXPY
ToString
>K>?kS
'+t
vP-L
xq_!
a<Qz
set_Timeout
4bjdl
k7u6}
)a5X]
p/at
-2&
MxJba3
Ug^o
Utils
e){as
_C_A
GetWebRequest
ZT <XD
] f'
Cursors
&r~
dT=nN
i}tG`
y RY
dKEh
k6Ii
|m\So
1kSQ
ZhUk :
&&&*o
M03T
>5hC
v{kH
'fgg
AP& Ql
T$m=e
5i }:
ClearProjectError
^#}U
*jr
Split
d14Ls
XGT*
_vk\@o
.Cq?Z
RR8e
U'3+
[5&=i
[ 7Ix~G
juMR-
?Fn?
q9%W
^sA11
tuG7Q
CreateGraphics
'U= {
t|];
T22>
UR&z{
ICryptoTransform
Ghttp://www.smartassembly.com/webservices/UploadReportLogin/GetServerURL
f 'X
GetObjectData
tjlC
/gS}
&&&*(
Kh p
(F]5
" -8
2#qjc
hB<;
D)>}
:'uy
L"C_
%^we
!m"?1
CUD9
Tv;{
_h4W
b,7k
K;n1
k#@.
VSVW
10.0.0.0
'O-E_>
L|'V
7jgz
hkf@B
HSFJ
PRdf
U!\s
;V,b
xN*d
8 U
G3$naB
A1eq
|.->
k@l<"z
set_FlatStyle
@"y]w
+!y<
U_WT
KH;2
}t*U
K#^'
k^Toc
System.Security.Cryptography
|X&tH.
wGmX
U*\x
42AtZ
G{ V$:
l|X6\
MemberInfo
w:W
^<hk,
:TJR
OYCtR
bRMD=
K 9)
SettingsBase
b!:[
nOl
.ZH<
Start
Combine
rvI*
5Q `
Y99,UK
2vfK
qZ1=/-D
+Vko
u/O{
hL.^F
!x31$
97Gbq
-D!^47gI
}6%j
Wx?v
UpD$D&
m0(
c>e3
mz\
%Q 9
Zc"s
t ^Q
g9P0
T$.D7@
b"bx(
F U.:Vl
LinkedListNode`1
l+*^D
RegistryKey
a@>
MethodID
]oQVw
7HB
"tcs
9a&g
b% 2
08j 6
ZwQg
#=+b"
Int64
rrqJ
LinkedList`1
;] !
O.^ i
L*lH
n gf^
]lo?
W6-v
Y}Qjc34
Filu
se/3
-/yu%b
VZ j
O7Xz
HO<n
XmlWriter
dtck
oU
pHYs
.ctor
7Cb,|
[fBD
*g$?
i%Lo
RCC
"Hx`7Nvs6
Gnh5
A"MXH
CgO!
xgV`
y&(*
_S&H
K#n9
/\MxE
~+V9,
X:nO2D
# ;
z0D^kq
W [J
^Kzr
""Y 6^l
$$BSJB
*4!,
@PX*
Ko f
R~K%
Mllg
Gi_*+
E:g0
+H o
HV%ICT
mL>9
flws
W6<
&* 8q
D^S`K
Invoke
;:^Q3_9JC
uT!/
NNlx8X
3}yD
q[E,va
-yy9
n-D`
X:Mm
.~&QC
O-;Ybt
(%h4{H
`8f
)pJ:
eh@V
-FqY
DrawImage
Name
fNk^
Ur_'
lhzcB
[!Z8
M5J`R
urU
wyUT
8xQ&>D;o
nq#'
g}zt
)M?,M
),Jq
vv]>
K/IpM
ajKi
|%`$i"
Wk6P
}G^J
l4qB
* T8
Hg%d
SelectObject
KXXw
Gk(D4
M2wq
Module
!:T
p 9>
V6X;
ot^hT
f^cO
(j!w
XFqL.\U
~CtM
Array
2o6>}/
,$&+
+"cd
jbN
Ka 5a\
jO{~R
aC`1
3(K
0W5X
LoginServiceSoapT
\'vt7=7
\/m\
L7xB
@.reloc
WJ>2
)Z%G
sd}H
k6w!
~6%H
, &&
tG<D[
#K&$q
&+Z
cIua
PBxU
<F|?
CompareExchange
GenerateIV
} =c
,s"p
z%K {
H4p0
~{.*
fzIT0`a
6F1!
*}eC>
$78b
1gv;4 D
^.pq
-@l
qBm$
-%b>p@
%W=um
"d*rn
q9.N
get_Chars
GhX$\La
Y#L=i
a{AU
KPnr
CryptoStreamMode
ke Ei
DnO2&w
z* 1Q
MoveNext
0cZF
(yc(
_>:p
|Wf/=-\
d~mD
get_MetadataToken
TASh"_
T/E5h
get_ExceptionObject
H<9_rk
of{6
?lq_
- SxF
f4wP'
xYaM6
w3aH
dQY(
z}7
s -|
d/N6
Wj
g|dk
e<5P
LL85
set_TopMost
4]@~
EK,Q
(Bgi
2p@;
NSTY
woc,S|
sWz|ebk-
jE .0
H|pP
al]T
3qw{_
#CeV
{e15
rW`
E3H~
ppUR
z7 H
GetVersionEx
] ` u
K5s&
JFA
4?Z
3"ZeW=1
g^8<
^+kjh
Ea4k
`5NA
03 {
_5Sxu _
MessageBox
cq:_
@"W2
XEwold
pug5{ob9
H{CNI
get_Location
b3iM/
f.}M
,2&&
Av2FVxk/
$4*P
rBGla
System.Web.Services
I#D=g
)Q7[2(
0E8_Ue"@-
5"o7
Yf*I
jsP=
'z kA
B{X5+
"wwO
TqcgM
FvcSu
= rVK
ZO c
9EP$
gffffffdhs3434.Resources.resources
~w}0:ukYm}
2U {
4y&K
set_Url
0h9`
'G9!Y
Xh"
hGD@
set_TabIndex
: 5D
]4s2/
|'JB
Xq }
Q|3*6
uFsi`
c)4
Y_iS
}d`<[
:4 )
*J.y
VTv[=
<Cjb
O i
6;P7
$zVl
/uu,
R6k9
get_Item
23WI'
>/Y
BJ1E/
nl+I
FileStream
Zjz
[ Z|
e4%W
RuntimeCompatibilityAttribute
*4g}
get_FieldType
ZD{>
Wf r
.fE^
<$P]J
**********%x
jRWXX%U
oZ5J
)9 8?$
q3RPv
Assembly
T|Dn
\oXX
.resources
DelegateAsyncState
k~z<
Y5-
RRzG {
oZ/{Y7
G+ q
4D??
qnEd
+PG/k
GraphicsUnit
HsFk
/*Zr
3X2
h ,l'
>M u
}k4%
uK.
u[5l
$>AW
QL=uf88
Z[-u
p~v:
-Xmwxj
>TT
IVFB
~*%u
|a="T!
Io L
e LUt
,%&&*
1tFF R
E MchtN
-# =
d _wtb
SuspendLayout
Sqz>
set_Text
Z`V0
Q ~d
4Wc!
_bY
Synchronized
5$h[
Gk zhCG
3U*E
oT!V
_j=a
%,N?
K~Wu
;x;z+
v;YC
PE@k
;&O{y
7 7W
i]Hc[
m;|E
|z?>>N
GetHdc
I):_>BT
RSA1
da).
*7C
D^#
[0?e0,
,\#36
3)xz
;IC;f sD!L
NewGuid
Db5r
_V<^
PS|5
,D&&
:Y.}
RZ]]
)-uu
;Wak
<w {Z
]6qv
z<gl
z)lT$
JF}F
) hk
$`a
tB>X
?EZ
,SEWc
1WFO
\(fW
In("6
YMc?
D;D@,`
IN(+
X$&%
hRcN
E-iX
Y=(l'g
Objects
2.t%
v%s~b#
YDse
b&B&
,2
K2kEld
H w]
=Zk8lI
IContainer
PmR,`
Clear
BRVkq
"sS8}
0kw&$#
|Xm1
<D >
=B7m
wsV*
DDDD
ZHG.
80GfiLYf!b
1+ y
Srj9
][W@
I y/
-W&&
j*pf`
05{c
;M:@hc
A~hR
XE3(o
]Z!:
FZVsc
+
%J,|
?M_[
DsD<
Ey7%5
gQP,;
~6P1
eW S
rKAIp
ISerializable
$AOb
${]
B`|,
TiC,N
M( HI
;Ra
Wx '=
6gD Bon
f*4Xp8!
AY" SM
f,.T
pwlA
T# 8
.-d'
\9$|
cc3Q
FontStyle
{}*{
sj*ul(
cZ/2b
LrF9
set_DefaultExt
x:>q%
(TF#d{
.&Ti
tz&g
@zPrr
4xGysn
T?eb
set_Height
$abM
|?,m
tL["
3EKX
Fu|6
C$3d
%h]q
Myz c\
p:"|{
ZAF7
3ip-Q
FBjrI0F
h)sW
] 4iq
pEdh_A*
-@Rj
FpZ
]. c=
0jyvXE
aBrW
PUUQQTTLKKKL
9X3-
`Zwb
^QB
|)3`
WPd9
G}Q5
~z>"
DKr|
~g!h
SlSU{
H%'d
@`}A
:?^Y<
! eT
be-BY
set_MaximizeBox
I.`!
s1h!
& Iu
5 WPf
O4/0
uZ
:I#
ww l
Q#}:s
?YA!
+N]/
(>)Q
_)s,
ResourceManager
Show
:AO(
2^-|
GetExecutingAssembly
ECoB D
g?>ed
f x7s
Js*w'
gc0!
9G`'
,z@_
S=&9
PropertyInfo
XmlElementAttribute
"]wo
Fn>`
b CyS
\P6g
G^XP
=\FS
RnaJ
ctm|
[[ 8
S%+"a
k @d
i;<L
Z__??
^,HT6
8.&G
>=d58
EdQ }
AA^?
/H*y
xPHg
ofz
]16U
5sZ.v!
IWin32Window
-}\r
gI\`
Reverse
cabK
p& H@
j5^/
uaUm
oQ d
EX_b
utK( c
u%$0
<SE1*f[
m^g n
uzvgn
?([`
] *
Y3Wn4
m?JV
px\vq
Z:Fs
( P
CreateProjectError
!lGW
Interaction
xDZh
;9]A
% jJ
3MTt
E".q
$ S&bq4
H&P*
SB{"
@b<9
>;Pp
, &*o/
R:W m
^yp}
nxj*
7D(*
Interlocked
)M?3
P-pS
61y2p
DsxSB
hR:o
o(9.
mDJ0[
NjA$
J,N!
>1G
(|8aV
HNOFT
uw\V
[$x,
Th5%
FsnX
!lxG
><I
f 2t>
1>3}d
`$*:Bwo
b Er
, &&
eY X{
YB)kBQ
^~1>sW
?x!D
k5t^`
snj%
add_UnhandledException
m_UoZ}
8.n`
zeCf]
-.}
W0K-
i<k(}~
LoadLibraryA
Vr$A=
Empty
^i+yLGT
heVg
};p~'
NYKq
Y 'FJ
YX
CMx2
y]7)
S]\
9l){qc
l 8w
n)}
WYlr
tGGzJV
&&&&&&
gka*
o@%as
HQXx
i4J
5X;
;9;qF
|)m`
;0Tfg
~/\#
,l7k
f&J4
`r|o
LL!C
8hU.
\w!e
p f4I
<Rz8
8$N`
eV~
Lo0zB
GHaRo
% ,L
I-]aB
l)u2
6$kN
mM69}
-+L
F>Ul~
9od[
IndexOf
dIs9
c*%j
]W q
U k
p0V!a
4Zt=sr
set_ForeColor
,kxj
T^~>
a=<wZj
w#<a:
oeb|
l4N(*
K>hV
^+b.I
;syE
\ bG
i0Z T
`#LK
pXcjIO
P^Aj&
- &&&
Encrypt
W udP3
&]0r
O/k~&
-~-\
F1PnZq:/
mEl5b
qsi"a
"Powered by SmartAssembly 6.9.0.114
oZK!
y0Fs?
1yY!#u
xxx%
r(dF
set_Enabled
tgz
/l+^
;6?`
appFriendlyName
pcw>9
EL_#
-H_4
z= ~
Read
* ,C
*G4s
QD|d
xRhDi
fF\6
,{&&
fIm$
J'\]X
`FZ
n|do
'Nf\
%6x@p
rwgw
;r
value__
WHWW
4 Z
=,Ww|h1
]i}i"C
T CD
^ nI
YQG,
5No)|
9 kr
& ,w o
&hb
MSnK
ls(k;
F/0V R
set_Interval
o1/-O
.bw
nD?G
f,r2+z
8W-P
.lED
LPn:
`Ktq
ez v
RuW
`\n 9!.
AddRange
#M[#,
get_Font
kEl/:v
gAMA
E BI
U|V
1d 4
{qS 2
lo;\\
7Gm\=
Q2P}
8tm.
Jsb
'v 38L
Odt
6/"
t0!e
Tsien
cCfjr
P b/
h'WB
~<g i
)$' L
j,BD
$7x"
gp( 23
FmFj
Ceiling
]e}B/
get_Left
.cctor
3SB7
AsyncCallback
QPE^"
-lgx1
'eM
set_FormBorderStyle
8^ch
S"I
mscorlib
ep~Y
GetArrayRank
P%.h#
}+LE
ScD1jK
[8Tp
@[Fz
k n&
sv02
[7q3
q9{}
goy>
"w7)
r^H0tS
Z n}
tJ,,
Refresh
{gup
O[$/
17l'GD
00 o
i)i
goy]
'k9w
58qjl
.t V
JkEj7
R8PO
`fyv
kn 5
[f~p
46ou3
?nC;
8j}I
ControlCollection
INsx
T45 u
VF"T
Rx$ ,'
_ [r
]L)h
=}Bx
xaif
RSACryptoServiceProvider
F<C,
VSw1
V4b>
Guid
3*%L
gFjIH
{;,l
3=*i
R.<G2o
Om2 #q@
Lp%d
y@F_^
/ 8K
kM\%
@$4G
px``
@ /
x)<+za
SOz
V$K,
y^]V
lb$h
Fn9kj
8g QRd
T5$c
{ 7v
~H[<
rUJm
ContainsKey
c,L)
System.Reflection
mG +
|yyy
DrawLine
j$!B22
p="t=h
yN?3
@Jpb
D_ =
!Vr47b
d`2
j0X`
rW/t
&&* +
RuntimeTypeHandle
e}Xv
907
x07 qW}
Mw#'
dI(/
jOe[
wg:tv
x%Z
I]P#
Rx| c
D u)$bv&
DCJ7L
(ZrCi
7n"Y
VS6!6
:prd
<Rad
B6E!E
*z K
!8GX
set_ControlBox
UInt64
zMnE%
@rhxa
Xfc
H(/]
3)Kp
XcIG~
ToInt64
,j\.
Zhd"O"
NoAS
5^/
qfSVHr
UNbx
["9U*
Ki P
OGU,LAs
TdSF
LsZ@
-TMn&
o]
d"g[
iDK~h
<+ ! g
Size
HKH@
G (,
Append
hJlE
5"m
53;8
E.Z
get_FontHeight
<d-W
ww<Ym1Eg
F'@_
wIx]y
set_ShowInTaskbar
Hqn>[;2
Rfc2898DeriveBytes
_RwA
25xL5

op_Equality
Cy9o
[+1%
:z+tU
xhtQL
gy x
/+ 3u
!QT"r
,K&&&&&
$tn,
A([T
)dg ~*
Bc6 qL
@+;,
^\1K
=]Sr dh
'x )
ug*h
#Kvs
#Sq5
<`1o
XgOs
#u|Q
us0k
=NZ~
cxo,[
=FnD
lydE
8Hc4
TextBox
;,\Y
yBCU
TR:!
#1b:
^kr%
7z>XR
9U_-
;l;}i
dUvb
6AFE
/+7|
-)X%s
7B-A
MjII
$<{^)
5 +a
Q9Sv
H. h(
vP1&av^i?
P/fy&
g[^ni
4 Kb
9{uW
hle5
p@4$\S$
t#-U
aeAoe
,za.
uv<tW~
!!2&N
ifb+q
w-rt2
BSg&
J-fpU7
,9&+!
V0O]
^Ku@
}69C-
5BH&g
261F
F3x,,%
Ad#!?
:JGo
gF
TX2;
M_rM&
- r
;?W#z
Slh~b
!Q-2
OAJ;
`[U4j{>
1E?d,
A0I"
EndApp
u~uU
E}ZGx
g8Euvs
~CC u+
, r+
@5~.
)P+`
8"%A
uz0x
!!?
gp!m
UHE@
S| G
KeyCollection
j@|c u
|w~XZ
wmE8
Q wt
=v5o
fIlc
M` m
9ulF
)zG{m)
+IQ&
F~)mA
P>A~
^D[#d
b _H
O6O
l cQ
!!h7T
hFD3~
!(E,
Tu?m
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
9#cU!
get_Rank
76Sp
<C!D
ex|-Z
45|_
xI9|^
z0`I
\S~Q
!* y %
_$Z~
L;VA"9
)_FKfu
t;qUg
-TsoM
70dk8y;
W x_
&vg[
}pzi
(sc]6
wNAm9
a6DFF
[]-v%
c,a&
~gxseg
get_Message
!This program cannot be run in DOS mode. $
* +
F>KBf)
["`@
DelegateCallback
Kmu I
w%#AN
xH,
m14Yyg{
File
f@f;
,+R$
Ca<
P/Tf
* 8
jj d
~T_4
r;8/
..633333333)x
~w=
xk`i{
ArrangedElementCollection
XmlTextWriter
Dispose
rJ~t
g'ct
Pa}g
xu64
K>s`
!ZM
BU.V
Qu<V
&=^e
*@ A=o)
WriteAttributeString
Sl*!
[]8LH
Fs5f
+C9X
niin~%
e3M|GN
`k2!
:M3;
TopB=
ServicePoint
FromArgb
R`n7
64P
~$C-\p
Cht<
Y% :U
_p-z
o>,8
)<RoH
HM "
-NJ2
KYRAd
XoYa
get_Window
Ql>2Zl
33 Gh
!p+~
jDaO.
sxpD3M
rG8w
set_ClientSize
ewE,P~
RiL9
q)0Q2
? tQ
&/{?
0>su
^J}?
rU*\'jidMMTsx
X;f&
VY
+;E
get_Key
PoweredByAttribute
DlrZ
D#I;
+ ^L
8HN8
-&`_.
get_IsPrimitive
+S0dfv
:R=Zx
;|NAx;
l3*h
<h8~i
Y>ei
/ &Z-
[Eav
yCR2
sBh;*
;JK@X
] b[= 4
)}y(
9cbz
c?vI
+8( ^"
-ckB
SetProjectError
0D.O+x:
c]ui
VX6;
AddValue
0qep?
C{}X
ReportingService
T9!oJ
wI{[
`of,
C,*n
avW[
bqc
-T(4
r)!z
G+5@
Z Sd
dRzo
5$EpI
2>_B
]c!r~
H,m~6
2[,((
<>Eb
wj E
op_Inequality
dS+y
w[$_
GetManifestResourceStream
7+ y
Nb>2
Hp}34
GetLength
4H= ow
dr(w)
"z1;
Ku6
SeekOrigin
cnj
E,Vn
id~I
i/ @
_'qE
Strings
pw3H
Delete
IntPtr
get_Right
n================ABA=========E
u:v+
KC~j
q[{J
TqIf
%0pj
'Q h
:mjk^e
iQM_E
%qrS
{.yq
i~:/F
O_zk)
oPaS
}o}m
[Q%S
|Z)y
je/hoH4
*V7V
+[~i
6"b:
ic9&O
->$>@\$I
U_||
li)J
>{|?
ed ;
hp\u
zR+
Zd%IkDL
wR73G
gdi32.dll
wc7:P
8~;lC
Microsoft.Win32
s<n)
FileDialog
N#kM
<>p3
8nA`
m~ h
E1(-
HE{`
TETI
KW g
R905
3?2^.+
w{9>(
z"faY
!` |6
io&a
L^$X
TPFl
8Ae)
nd?i
VKC<_W
w.Jp
< i2
>|wkq
?7L
InvalidOperationException
$u>'Q
/]dE
r4X9e-B
JtR5
`y>xV
:xb/
6'B'
8D1^
vUQ^
L|dL
)V^AV
3^?
RijndaelManaged
5&y
wpI7
zlL h
!/{!5f
,GXa
I7|;
get_FileName
m9%@
B7'W
+f#P<
ZH $
cxD?
\y~p
ZIa$
z_;^
2kk{[2
'IL'3x
-Mg6
_gkBE
]r\TK
J(f&#Mc$
,$M.
:"L`c
v 0
uE|"
9L46
d ql
[.PTO
,s<g7
i8f~
J34|R
]C(
`:D>^F
%(O1
V,AvxcG
tcFs+|
5!FN
BlockCopy
1U5=zq)
GetProperty
A+%V
%,22
DockStyle
HXRx
O<, A
oFRWu%
7d}/t
GetCustomAttributes
^ P5
uz;S[
8LS-
zGH<
hS+Z~
2]VZo[_
s2M9
@n@@
D^uw
sim\Rb
6 8Z
)@o>
FfAr
(nB7C
kDe|
(< xr
W(t:
t1+)
SecurityCriticalAttribute
6n]C)
wWU`
^$+
:G,q
#ucHj0
set_Title
7e,g
g)XU
Ev<#F
X[fee
Xrst3
vRG{
XB9n
_I&v
SHV6
&+'~
P<${
-qTF
SmartAssembly.SmartExceptionsCore.Resources.error.png
EP`7
6p(ar
BMn
set_Visible
!oRo
}78`
W|tT
k;l:
a b=c
zulP&q
&&&&*(
sg_S+
&&&&&
d D\H
,"&&
ky9V
{neW
System.Windows.Forms.Layout
$g@5;x
ac<a
/]0B
$T_K
%'xUq
kVOv
@."Q
1R5
9s`3
tO@Gs
Boolean
kL\NF
32Nz7
6t"'EH
EGu8
0bU1
tTpV
P";*9
lvb
}ibX"
+ H(i
get_Checked
,?2\<
^`=c)4
t. {f
5GD((
&J?":
`i
H;e.
JYT%8
[PRG<
6BLR
{ {.eG
4$']
(F?6
*DJ9
MethodInfo
JbM^'4
1w*J
'Sj
^E|Kuw
a^k3
P=K],
};J$l
Ukx,
;Ct$
2l[s
<.%Y
get_Keys
IRP
CompilationRelaxationsAttribute
KjN S8
-J2IH
nlN"u
B~YA@
Myzz
0n'hq
Qv d
(N 4
kX>p4
i@ gA
_
*B(@y
~:H|
q(uL
MemoryStream
AddLast
`2 :
,O"/"|
Av\$.xy
Q.Y#
j!
get_Graphics
#. }r
M,zv
.VwS(
get_ControlDark
+ LJ'
HttpWebRequest
TX7
I}-}
PX=QE
.=4.
r/tR
pzO
EnJa
SN2^
(Wk_
dSqmgP
S iQvtS2
GetServerURL
-j%9q'
GWF8.9888886x
!f !GKy_
JrSox2
J3@
;yKL
{VMl:
j4 @~
j=U9
UHXK
*+Y"
V4]h
]zB7
IDATx
0ZTd
XH9:
Z:v9
4S"l
47-
HnU;
bYnQ
I Hf
add_Click
(.w l
JO<j
4| Q
J<
Va/O
TQDd
ZQ5t.B
]R{ ,
B-gE/Y
=_\s
}yfT
g4/"
dh)N
yed_
m8(J
[5~n
9XV,fBYx
@ &+
SmartAssembly.SmartExceptionsCore
=ZR8b
TAZ 0
0he
gR%WBK=
>$w,
uTJ6S
?VvU
YdQ=I
('x2<yb
(b[
V||*
t.{!
WQ!-
g oZ
-8?5
SetToolTip
$wiuV
Microsoft.VisualBasic
J]]~
>6C6
, [;4
I%k}
?pIE
Kjkl_
z1b[
u.{2
[YR\N
|=qk
AA"z
XRD
1y10D
]yB%
=Z*N:
e`xE
K)BV
k4([
7!G;
ThreadStart
NLfX
4n-P
gre[
g>!g
HFe.X
[\Rl
O)v
--&&
5'~-
U ]d
~Xx
XGFk
4O.U
6Y"t;c
w 2%G
X)1> >
gjxB
buildFriendlyNumber
2?:mu
nbTbk
G rAq
;,h]w
#,zXQ_
)wmB:
/U.$z
o9AQ
ePPh
+bD
`va8
)&k/w)
-~G
jts
9)2u
.0$#b
CY?
\"{]
+m ,'
pr'
80Ly
&(;DM
?g>Eb
^ ji)
uhZ#
Rectangle
&&*o
-e3a;
$1^z
get_White
wwizX
,,ixO
&&*o/
6~l^rE
'<0
_("bI
_O G
bH$Me
#ix:#
s 7R
G>I%
.Fbc]P
BqjJnk
Concat
`V5~
-gty
i+":j
60S g
si%S
StringBuilder
get_Data
Qr}0
}5-7(
pH0T
BS
,9,[H
4=-
&[}%x
[r-Q
iA>d
pVxg
FQx&
j>TC
|$mw
h<>D
IWebProxy
pzWX
oLG
XQBZ
EgnS[
4fr?
MGBR
$h j=
#dua
)\ FZ
22lq
4iqr}O
G~N@
&&*oz
\N=I
&&*oy
p-Bg
N%oW
CompilerGeneratedAttribute
C>5v
*R?K
get_Hand
[&O<
- RCC
Nddf
= ,+xY_
_+5?a
nXh1O
H=zw
get_IsInitOnly
y +-
AMhRRa
F+z\aR
SDMc
<4 M
h><DXdV
dpJp
:Nb?
a8VCMs
\IL Z#
Oknf6
b=Ic
A2{h",
SizeOf
s~at%t
}*-
yO*7
ReferenceEquals
pr'#
Thread
2c8 UBB
0NNd
ZIL4Sj
SmartAssembly.SmartExceptionsCore.Resources.default.ico
~?X'
l-y3
9Z"Wz
sl);
|W9w%
6$nF
B0S!d
{+]G
Copy
{/]m
g;*1
get_IV
AssemblyFileVersionAttribute
) %D3
%Zx"
gvg/
Kl,-
System.Text
GetName
m]~#
_$&A
7k1dYMT
oD$E
cc h
Th]5
g7-(
w>%qW
t%]e
Vq)SU
Flvto
ZkQZaSA
hUf;
System.Resources
hKwo
w Rf
3 1aH9,
th`K9
[q$\V
GU3x
R$*v .e]Hh*N
|pqX
7t|aj
gk mjY
HE@f
E$W
A[ ')
bR)TY
l5z
: '<t;
+InpFlo.
:r `R
7 #S
v_l!i
-;`k9s
}oRt
KXL 2T
wvt#
AE@4
#bxF
GetElementType
set_AutoScaleBaseSize
`42b 1
fNWG@
. 8j
;3S(U
*v~;D
O4
}QC$
.`rd
@?j[
K_|
yGgQs
|3gW
l-@U
3v3J 0
!7qL'
]y2:8-
!s'G
;BCm
I *}
fq92?
#u2\
6>(I}'q_}
WriteStartElement
'wt
J6A})
OZU,^
S?nIB
,F&&&
;
*q#v
4ciC
06L..vy
Icon
'qSY
alrZ
{4)&}
Q&B5
3"z>y
aKQv
CFTe
uEN<* 5
}S1U+M
vT5`M S
AccB
T?1 3
GI H
?l P,
o#&c
Hc?W&
bU@6<
$8z(}
.(`~d1
;)47j?!
(=j1
DelegateAsyncResult
zZ+;
^Y%S\7
fT{@
PNb`$
#J#8
,YvD
uWVJ
N 71*
uy<G
2puy
--&&&
y/lI
(c;G
d x
TkQi
q2##m#
uZw=B
FieldInfo
3?M9s
Font
EloG xW
?R}u(U9
DH)T
Y{a
Locci
4gQ
TYHt
"xi-v-
Cs`XY
0g.RkB9
8<@b
%}/"
4Ale
Hp=
6X{(O
CgF%S
(Ip=/
!w6B
CMW
-n
;~jq
^I1'
t D5PT94
String
f$Fe
&rk-
ICollection
_CorExeMain
System.Xml.Serialization
Copooopooopopooopppppqpooopoo=
d<9HS
-yN"
);:$*
Avpv
5gV
-Fz[
$~]0
"xA]Y
<Lo*'
Button
<)eS \?
&|L@&
~aMQ
Rx-mn
np q
MA -R
"9^:[
>(p?u
DFR,
{4yk
Timer
j"oe
"\k[
pA A
+o*7
UploadReportLoginService
l/lU
get_Text
~:ok/
HU.F
InitializeArray
9c@V8
B4%A
GetFields
=BH^
CKgF
p(Xv
LtD{S
/ v8S
uPh,K
s0w
E% r
{PL$
yXlt
@--
Microsoft.VisualBasic.CompilerServices
P9Q.
SGtP
SmartAssembly.SmartExceptionsCore.Resources.warning16.png
y1x${
fSi]~g:
V _v
\`0%
=9oK
ToArray
le_
#,..299
dT)k9
a}
$[RM
0)"YRW
/#+q
_WATx$
EditorBrowsableAttribute
w#p
\jRO*
[Xg
%RU0
CheckBox
b`T9R
)!~4`
\grS(
,|mI9
,q?y
b.^S
`EG\
2.lk
Aj uci
u v)z
Kyq
6%Y'
Cbmn
tD[d=
wYw|
`;:v
$Ek5
t: ^
qZ]~9'!
^qh
3dN;7L
cQCpNm
{CrAEz
xBuZ
bcSX!
6MR?
'+^L
RHA
E$URDM
~^2V
*^^8J
u 0
(I,L!
Pu8Q}?N
,F(o
u+ `
1Z'"
^J`l$F
\D]X!
ZB8H
J~ 1
5$-
N$h2
c/}s
``fn*IzE:!
A)`-
W?=b
M a$N
b^fK
PB|sD
:!L@
~9"-
Attribute
o]1yx/
g %[
}Emg
A)q
uS'0
X:VK
System.Drawing
j-Q7#
$q+I
> 21
get_FullName
|y1
`b9g!{
tarI
: Hjb
e&"W
W 98
(A d
lKM)
v:Z{
A83I
eH4EIzgE.
GetGetMethod
Dictionary`2
$W4;
BeginInvoke
} &SM(f
Da$w
9tv)
f "Q
Lq).
(*]d0`
get_OSVersion
]:PHy
uU&B_
F8LT)
vr$m!
}48@N
MR h
~;{C
a,<?
&&&8T
+eSM
%<FN
y.g?(
X=lvq
Y-bh
AD]`
@~}[
5T?Em'
Eb<Q
k9 "
n6|5
-k
" l{
get_IsEnum
qjsK
YsEK
9iUo*yZid
KBvU
NT Y
NhTHkj
vphL
pnzSKO^aV1
[3&R
<lh5avT
grq0
9w&*U
add_TextChanged
e:'`
I,r-X
RuntimeHelpers
OFBv
V M$
"R1%
hg
n6R4:sZ
j<B"
&&*(
ZBYht
9),T
vDty
A?d\
*EdyI%
%DB~
get_Platform
5`L~
s5V&
}}Xl
2-"=#
(mWd
.L(7
A[xGsf
"`TU
$ADT
Nv8F
nxMT
rSs8)
oFP;
_49Q
R,22
N|l'
IDATx^
/?#
DU8^
K*t`7l
* G
;5:X
\ =|
_=` Zs
`AYyM
,?T6
7>?X
<Li X
N^\d
FromXmlString
M}Wm
Xg~tWR
I QG
;R\=
><B\
\z) V 0
Object
y|05
2nH!6
q1_rKF:C
|T%q|
Registry
>agi
:JB_
#dsB
k3(Bt`r@H
ec6HiC
V:99 u/nE
zJ'E
I(:
wA}a
:#^
/t!:e
XxtQ
a@J#
}S4s;
k7_c
{A*g,J[
sC t
N@g
Zt<%
*]9^.r
}=oN
pjWRt
3?v
get_IsArray
OI[||=
P&@e6{
6.y1
cHRM
H.$?
]..
, &&*o
#%.t
8gwBCC
-3l~tH
get_IsAlive
a V;
FlatStyle
:g,y*
aV@e
O*Wh
>NY4
: wR
9KUX
t"B g
B.UD
a'WyE8
-aM;
QE&F
EditorBrowsableState
&q) V
W/xC
~h3R
x_woUG M
JL^%
l[cd
` r:b
CG9#
}w<5
C|Br
1)JD
Z,Wp
kEwW_
tc5rg
Y8!8=<|
,]&+1
d;;Gz
NUS}
VHV(
,F,$
y"ttX
jo"bA
((k,
ZEL,@
Biyp|
0]8'
' s5 {
6X0:E
&Lt-
fRzIygyn
StreamWriter
A6^ H(
CTq<
7]TwhR
fx N
8{(_L
yy`
@p:*
_OqiJ
3LF
}\\.Rh]
`B^9
6UmCB
K=!L
B@DY
_&3X
/mW
8u@]
ScaleCore
4~1cg
{C^V V
Wv|H
*r8O
Stream
(^DA
9!D
8 NV
q*gL
<X%
{40J_J@}
>k]<
SecurityException
q 5F
+yD
fG] q|
(wB'v ,l
h$4v4D)
,t[n_
SW )\ Z
SKr=
&&&*(J
EeI{n-(O
^V(x
*t?&m27,
Y[;e
e<;Ix>
F;:2IA
OEeX
$dV
Q0)'dh
lmwH
<i r
?~+
Exit
Free
fX/aj
get_Bottom
l$0-
}p6Nk
O Yw
TzbK
5 JS7
&&&*(o
6-m56Z
get_Namespace
q!^Z)
VSjc
t$_N
8c,/
6 5mlRx&
!6k#+
7FO`
:yRA+
0oG\
#Mz1
RYf}
4<Mx
R 0m
get_Minute
N c2-
P 37
$=p/
^&\}
add_CheckedChanged
#t/
3+W )
"MCE
21M%j
rX]dO
2+ y
hQc{
;c|7~"@Q
q}0'
o/T\
( .zg
F}e.
3KJV
},j\
}bZ>
#3G=
E,J>
gC JN
W 1?v
DataType base64BinaryE
jq2>r
$M,=j'#
~R+]
Dukc
5Rg8p
Q-yH
;Jl~
!1fg
Sh&";
.Z@~
5Xz.
410L
VA"+
r']I
b>I/
@ lv
6/TY
9rmA
"h.p
E!ks
pr9#
dE!9-
e(ibG
CKqc
k5W&
T=t%
- Tnz
) .3ftZY=brK

&* +
m;sf2
{Pn
Ki'7
`'PX
IHVd
iO #
3_L
iK5S
n!T#
(uuq
iYtM
ZYy,
OperatingSystem
yL)&,
H!AJ
HttpWebClientProtocol
fp6O
:}W 4
JB;,V_
]Sx~
xxxxxxyxyxxx
P<n2
J=1%
B\yK
]L^
get_IsLiteral
3Gx\x
g2_/LF
?~4O]
E7<P
)Coo
f`D!
"U Q]
$scI
,T a*q]
FormStartPosition
@L3=
MReW
L `O
\Q0S4
LH (
Alloc
FA h6<
o Qp
n e*
System.Threading
C=DS
PictureBox
get_Month
IDtl
Vs#cH
UG^p
Ea{.
uhdF_/
*DN~
b(V
zxPn
MessageBoxIcon
63\ >
;+-}
isE1
Tx (
rDsi
UnhandledExceptionEventHandler
System.Web.Services.Protocols
==Q
$l4!|
iRNZ
4e %X
5NSQ+
eo@pd
&~Wn
<u4}9
]Zm"D
[6'R2|R^
O@[9
w8$%R*
UT3h
qU~{
^g ke
Y\8C
-9HIX
VXf<
U[Eg
G'uhm
Ztj B
]U5uAmw
|IHvb
%IbE
:}@3E
.dx>
X |uUqze
'v1
#%/i
O}Hmm!_
41 -
JrhU
na9E
.n#^O#w
*}1x
`UF(z
B<xQ
H[w&
Dh;E
J*n<yH
K|8S
>jm
set_Filter
BrP@
kkCwd
Shell
]x#H
Buffer
get_Current
|!c4O
*V&5
uQ K
R<]l0*
' )m
5* L
2TL
Zf+U &7
a>N;
'JG4
<|,Q
9w-:
k`Kd
M'<o
/ZUH
get_ApartmentState
-(mxgJ
=]K6<
sdfgdsfg.exe
M^Kb
&uq
-lj`KO3
K Me
>mS
/FCKA#
; 63
S&Hm<
5(n^
cft
&&*o
LDzy(4 B
ll'7:]
)}H4
1#PX
rs+V
*pl3
UF c
<>\
^,RQ}
J<^Gf+
UV|b ;C
MY+}3*
, &&*on
Z}Q\z
: E@g
$W$P
!cV*
v<[i
OnResize
S&L4
|_b(X
6\[/R
mj9@&`
GetInt32
WkqL
r<|8
x3a#A
5y^}
ReportingServiceSoapT
`E;x
bBLd
8 Kq<
k<FR
!hy
is1S
QlB~f
4d R93
NL0]
6vP
&ov
1M+i{
!NR*
EndsWith
=% y
uCG(
p{5uXG4Ek 51<
w.*9cP
oig[/
^5ju@Yr
,Z&+
<.|~L[N
3MB`V
&&(X
ox5[
8E&Ed
pBzw n
/jfCO
^ L'K
(i`Z
M%q:t ,]
c^
-'EOs8
Cg}o\]
Kj~\iH
z8o2
cK(]
SmartAssembly.SmartExceptionsCore.Resources.{logo}.png
myAR
get_StackTrace
c y
ja^u
F /u
5p+
sA2E?
u1pV
ACaGA
rC7?N
Vr;E
h}e{
?uToHZ
3l}y
Qz7S
.^)/x
J1+9
sq(f
get_Major
sd'>{
6<;2
]gn)
:+6w
Evo`V
Kk i
SoapHttpClientProtocol
D!mZ
Tliicb]YWTTJx
7`0*Df
&}[rq!
k22`
yyJ/r
Point
get_BaseType
< x+
I`NS
#}j-
.YYH
fxpc
xg^3
9Q<B
[M~
(y.q
{\^
y6{4
4.(H
wm A 4
iw/*\
v2.0.50727
+h
~?[I&
rbGX4
?u;R
:<
f;Tk
6=^h
V%:m
,==P
'jIC0
1!?tD
-P&&
h1=Ybc
WcCZ
:g,dH
}d g
Vmc^
set_Item
YP1g
Ze]v+O
ToUpper
;anGJ
TAI=6
S*+N
gouWk
r8+z
hehg
SLBV
Y<[=C5B
AP}
de;F
$g(D
O*H,2|d'=
^JaR
36I6(
8#[
4{ %
GCHandle
IG'th
N O]
E;f"M
gFfK
ONR(
zGb~
Mf%D
set_Expect100Continue
j9bT
!gw~^
-&O
|.Fe
=zDDDD
`&'b*
(8rRt
nWV8
T3am
get_HasElementType
Exception
a.'}q
?&\&
1%{F
9=*%'
R&GFN
(EN!
@;3R
, &*o
o&uJ
nvY:!
${&Ip
} 97(
}WA>
3~XY
)_:I
2SaEq
get_ASCII
[W2J
8Clc
F]L/=
O/:R
=my2#
Kh{@
[8^M
7u>H
Wy-f
55a5
j`|R U
X>oa6D
W%0[
ySWV
Kx-%
set_Size
WriteByte
GetTypeFromHandle
IAsyncResult
3uh:
'&^J
6R#C
z 3Ogd
raAk
$JYYI
?[7Z*z
@>l@
GetEnumerator
8;s)
SymmetricAlgorithm
}SNGq
q x0q
(7Qb
+)K
w*\E
WNev(
A3oG~
0AY z
g^xw
{A V
GetDelegateForFunctionPointer
sLz*(
MessageBoxButtons
1)(I
o8 i
avw1
Int16
SmartAssembly.SmartExceptionsCore.Resources.error16.png
Au5<QN
bF0E
c6nr
v #F
!kC&
6 X)
"/t?
Graphics
.>ry
"vvm
I0]l
GuL
% WY1u
`\"9
WvVd
@[_/
ao6w7X
+)r y
FsB#
I{b4
/<6l
]: ,?
ApplicationException
|Eel
7Eh;`
ToUInt64
4 \z
8CMq4
UnmanagedCode
System.Runtime.Serialization
YgH8
Enumerator
LSQcB3?OE
M7Vy
}_'tB
aj@
9ClVd
cvJuE
F}}pF
I8 .
4!C]`
(S<T
F>|D
PVs=%w
+$2t
y;{c.
q%[A
#s{t
?8R#
@ .}
C!pI.d
]v0#F(
}*s_
S'}I
G Cb K
set_Position
_l'd
ca_m
YtCC
JU')
h;0/
x.N Y
y*P{T
/'[o
*gd#
~MUE
L~Cb
R+_
GS>V
Ni,J}
l`p\
7$&&
System.Runtime.InteropServices
[!Y8 3&
`S`p
H E4
pnU-p
@wHk
PA+:w
Y3#?
g1Zh
`6)'j
Math
6i2b
EzOD
7P$MS
set_UseMnemonic
b 7N
tEKB
sP*Q
| =n
n]{R
I&pb
1RX)
jJ|P^
[.: C
U"nch
[gZ[
w)r?
fyx]9
ThreadAbortException
u[uP
+,z4O#q
&...././/...x
yYy;%
ll%X
/;WH
Q4l\
%]30
~$b+
U'+
re{+
N%y4
System.Runtime.CompilerServices
&/Is(
} G
MC{f
Z]Ea(
;r=
gue=
X@P%
ah9T
f?[j
-*&&&&
-a><
FD$W
SByte
lR{
HU<._
*+ P
Y=TA
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
;Pu;
,X3
EXIH
a*Rf<
M1%^
+ria
{LZDz
JV'jz
Y?KA2
V{DmY
%+O
$CU+m
+W@qa
B] $Gh
(d[m
x/3`
&[sZ
, 8;
Pe"\Y ^
W3Z;
& 1,
Y{@6Z
0y ~
Pf//i
0nPo
)8d
Kem>
set_ExitCode
BringToFront
k <d
].*(
(t;P
eB r
6 /?
-{,m
?'Yc
@p 3
\=bh
n;^
TransformFinalBlock
*bz#
NfB#(9|j
r6Gl
K&4W
P9rM
P`~]
$ Bw
1u G
KiJ
XREyU
email
set_Font
'xY^
gt%}
HbNc
UIntPtr
znUp
1Rff
Ds}
UploadReport2
2kXS,
!ze-
MGiI
Close
get_IsTerminating
+/u5#
hR/E{
|Z< ^
[-5"
IDisposable
OZ7
.E_
Exists
@70d}
RokN
X58N
}3EyO
H h<
']CmR$
FromHandle
(v*v
a)Ebh
iT{wB
#$(r
j^2w^.
n|'7
B a=
-Qz*
CreateSubKey
Q.(L
set_Mode
-i!%.
C@0M
~h?T
+1fz
FK?lX
Oa@j
W &
57 q7V
knsj
&&*(n
"D5gHf
'_h_
R!8G60
$ ~l
~,T
m$cE
5#hr
4>rWXn
|3Z1u
+)liLz
'y2.'
Kahw@
8&v:
S)l
pMB
DrawIcon
CA?^
^AZB
f;El
wYA,@~
~}9v89
5 a[
OO8M}Y
pTE'
<Module>
cFf"
(e {
s b wti$4
WriteStartDocument
+W:Y
0 KP
:us#
pyoO2
cqX4?
pD 1x
utl$"
77u4
?cG
#7\-4F2
"O;k!)
/n$Z
MulticastDelegate
T}oT
^eZ$
J/2q
2iPy(
Pp ;
CancelEventArgs
,Q |_\
6,ax
dc"
i?P1
d?n!fz
6myC
IBYV
\uQHy
t\wG
NcC )w
r yj
r6sW
&I}2,
> +2
Bitmap
/q/d
SizeF
^LD"
get_FrameCount
&C2
U>NNI
get_Hour
R?0%7k
m<_Tu
3QO
%=r7
cU5G
^%v%
0<%%
6.0.0.0
P8git{*
StartsWith
hlCq
FyB
r{$z
uUO3"
1)!vF
;-|/
_5+i
e9{;:
k&$a
#{[n'
9Xd
|:{[Ce'
3. c
=4hG
'SPR
:m)9
HDb&*
XGLC
lHlz
glN,
f<0yyz
pu00
b0d]2
CreateEncryptor
~<C[ 3
z+fR
L,-5
n#Hr
jK5)!
ThreadExceptionEventHandler
V[o]
wxCFk
*JHqU
:ckY
2h.b
#GUID
Panel
_7%T
?# >
GUF+*
J~Rpq
&)9 Q
3:YHG
5/1]
fNp
2heW
nNsv
[hQ`
set_SizeMode
Nmu6
get_Exception
AOieT
8m`Q
)mcC
q Kh
$}J4
Q=$r
B6F>ie
?. F
!T\
M7N!
p%U;
@5uY
P }Wp
X}=`Wn
J/ lE
Qkkbal
p7-g
T5z
_b`}
cE"C&
{)@4
mA[5=
Uf!XD
Fhp~\
qlgRg
QFB~I
K$LZN7
1 (,
Lf)|+
8#q
tWX:
}p?z
w#{z
P]h`O
X9k-
@1@g
ToHfont
5a<u
Q# dx
.< Q
ApplicationSettingsBase
$_qj
{|IV
0xhm
9V.}ZA
wcuE@
66 b{
kFb?
set_Image
mV}O
8 {OL
b^'r
j'x9
QT{6
0$^e
_>2}
&* +
" ^d
EU<da
`#pg
e!-G
=Ls-w
;W#i
k?)K
0l/b
,>&(,
InGS
B\r:
^)A
x] AR
EventHandler
+5h[
EIzXJ
z;0/
DW(5O|
Rt]Y
2gE@
pp.c
:^iW
](Vk.$q
]5FG
P$G!
Fr/~i
Gn=n
D#f9u
Ntjc@
^pB-
wjFT%
K Ihh-m
>-v79?
gut9
DFo,p
SetValue
4*g s
wkwu
+tt#
Encoding
]feO
=Z
3M&!
9i:\
,}cAc
-e&&&&&
gDsp7AB
g#$e
GeneratedCodeAttribute
get_CurrentThread
yXEh
9s{$
<k3g8
QaSP
) rUd
z# j
JRSg]h
\jz!
EKA
! |]^y
ZNR7
xP}=
+=z 6
xqV[
v$ E
w H`D
T8*Z0
dR:R^1
x[QL
get_Module
A~rk*m(
Du{,+ T
:99X
CryptographicException
C+)0
Os r^
lV<u
N.IV
OS)}V
1`(U
'J{u
F@SN
?% Zse )
WebServiceBindingAttribute
ls\D
yICG
_Ui|
fyRNo
Jk:[
Gi+h
S Cc
A|J
xzjYFUZV
DrZO
k|#`
V H
O>u?.
]Bs/
$'j{5
AddrOfPinnedObject
dSi9
< 9e>
OF$`
hELHz)
uk'
*e.yA
7;
d EA
`. a
,'&&&&&&&&*(
lv]kK7
get_Size
CreateDirectoryExA
fPEf
System.Xml
X Y$z
}6]
OnVisibleChanged
Y@f
_`95
?nD/
-+&&&&&
8|?S
!WhG
fW?'
'-i} g`F
Fl~*
3>*
k.-HX
H &m
W&~i
({]Q
A|?%
| L@KV
|3i"
Replace
set_Icon
M@l~
System.ComponentModel
]s$/
LocalMachine
ReleaseHdc
\S(i&
XjJ28s
cZC"U
0Q*9~
.eSD}
?g;dK
"=ju
dLs5!
;rM
-!B2
L)RI
G/6K
F$Z$
>\rM
UL+E
0~^4
0D%`I
fd4(
'V,]_O
f s0
P x
O%">
1y,}q
IEnumerator
6+L:
t/K]
#*/]g$
vhC34
mltzo
G?Oxd
1&I$
wW v
EJ $
^.Vp
y"pn
/Gu)
d\#2
#BRZOa6i
r67b
8 8J
k*cQ
ek!w
M3Pp7d
.bI$i
)"P ~
pDm A
7`j
#SvJaH
~@H
SCa\
]6 tn
c )(
Twtsc
u <Y
wwwwwwwwwwwwwx
qAx<q
<JZ"
1'}F
8?[V
O6ub
x5`0q
ggA L
HTv`
@Er<
xnh:
3R)
(d"Fi*
System.Collections.Generic
'( u&V
7\&{
V"x(
B6!jt
(%19
W?4t
v^vy
\X\H
"m?(f[YF
gJ `w
OiN+S
Oo?xU
.;n6m
F~
mAgI
F{)\
;EYz
ZX46K
nFS
System.Windows.Forms
set_Cursor
Hv>Dt
get_DesignMode
c3p;z
dT;\9y
(ME4
VDwT
*`8"
d0~{
. <@
yICkhA
e~Oq
@ %0
zMk{3
3{2q
get_ServicePoint
a Yv
>[9n(
I:S2-
M/hD
m@WS
O7!@6
^4y[-
qcr{
7< Y
IEND
4rA>
H\#i
, &&
M#jH9SF
\AQj{0
w,\Kw
sU(
Qg|{
Dj1!
zl [
get_InnerException
SetStyle
~5&T
M1hH
PP*n
;ZiI
tZ;v
WVpg
GenerateKey
|8.f
&f+<
7-J
zoe~{d
i9el
+o8P
WriteEndElement
-\zUc_
\:76
Qi^]TKGFF9F9x
Uo}UM.r
|(S+t
b 0.
6W
* rPH
)#;tM
. n`
9hH&=
ToBoolean
)@G
+ui@
* 8
FQaQ0^D=V
KD<c
-En "
nvT)1
5L K}
}[u3
:|c
jskYc\
8cesi]
%r&~
<>cY
SmartAssembly.SmartExceptionsCore.Resources.network.png
"oSr
|Vo5
`yA^u*
z'rc9
(`De
vI~P
1]%gc
i(E
)K*73
))`\`
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven04b_64 Seven04b_64 VirtualBox 2018-06-03 04:56:12 2018-06-03 04:59:05 173

5 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven04b_64 Seven04b_64 VirtualBox 2018-06-03 04:56:12 2018-06-03 04:59:05 173

9 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\ppa.exe.config
C:\Users\Seven01\AppData\Local\Temp\ppa.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\ppa.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Users\Seven01\AppData\Local\Temp\ppa.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\Globalization\it-it.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll
C:\Users\Seven01\AppData\Local\Temp\ppa.PDB
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\filename.exe
C:\Users\Seven01\AppData\Local\Temp\agdfdffhit.bat
C:\Users\Seven01\AppData\Local\Temp\dsfdsfadsd
C:\Windows\Globalization\be-by.nlp
C:\Windows\assembly\GAC_32\sdfgdsfg.resources\0.0.0.0_it-IT_bdaccec94cc64df6
C:\Windows\assembly\GAC_MSIL\sdfgdsfg.resources\0.0.0.0_it-IT_bdaccec94cc64df6
C:\Windows\assembly\GAC\sdfgdsfg.resources\0.0.0.0_it-IT_bdaccec94cc64df6
C:\Users\Seven01\AppData\Local\Temp\it-IT\sdfgdsfg.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\sdfgdsfg.resources\sdfgdsfg.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\sdfgdsfg.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\sdfgdsfg.resources\sdfgdsfg.resources.exe
C:\Windows\assembly\GAC_32\sdfgdsfg.resources\0.0.0.0_it_bdaccec94cc64df6
C:\Windows\assembly\GAC_MSIL\sdfgdsfg.resources\0.0.0.0_it_bdaccec94cc64df6
C:\Windows\assembly\GAC\sdfgdsfg.resources\0.0.0.0_it_bdaccec94cc64df6
C:\Users\Seven01\AppData\Local\Temp\it\sdfgdsfg.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\sdfgdsfg.resources\sdfgdsfg.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\sdfgdsfg.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\sdfgdsfg.resources\sdfgdsfg.resources.exe
C:\Users\Seven01\AppData\Local\Temp\ODBCBCP.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bcrypt.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2348.2475484
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2348.2475484
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2348.2475531
C:\

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\ppa.exe.config
C:\Users\Seven01\AppData\Local\Temp\ppa.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll
C:\Users\Seven01\AppData\Local\Temp\agdfdffhit.bat

Write Files

C:\Users\Seven01\AppData\Local\Temp\agdfdffhit.bat
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\filename.exe

Delete Files

C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2348.2475484
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2348.2475484
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2348.2475531

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ppa.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\793196c2\66edea4f
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.8.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Web__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|ppa.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|ppa.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|ppa.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7
HKEY_CLASSES_ROOT\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32\(Default)
HKEY_CLASSES_ROOT\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.0.0.sdfgdsfg.resources_it-IT_bdaccec94cc64df6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\12abbcda\2e1f39e2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.0.0.sdfgdsfg.resources_it_bdaccec94cc64df6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\12abbcda\6d7b1c31
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Classes\AppID\ppa.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE\AppCompat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\DefaultAccessPermission
HKEY_CURRENT_USER\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledProcesses\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\CD0D6445
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledSessions\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DisableUNCCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\EnableExtensions
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DelayedExpansion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DefaultColor
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\CompletionChar
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\PathCompletionChar
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\AutoRun
HKEY_CURRENT_USER\Software\Microsoft\Command Processor
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\it-IT
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\it-IT
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000410
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot\Option

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server\(Default)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\DefaultAccessPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\CD0D6445
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DisableUNCCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\EnableExtensions
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DelayedExpansion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DefaultColor
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\CompletionChar
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\PathCompletionChar
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\AutoRun
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\it-IT
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\it-IT
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000410
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1

Write Keys

Nothing to display

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
uxtheme.dll.ThemeInitApiHook
user32.dll.IsProcessDPIAware
kernel32.dll.QueryActCtxW
ole32.dll.CoGetContextToken
kernel32.dll.GetVersionExW
kernel32.dll.GetFullPathNameW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
cryptsp.dll.CryptAcquireContextA
cryptsp.dll.CryptImportKey
cryptsp.dll.CryptExportKey
cryptsp.dll.CryptCreateHash
cryptsp.dll.CryptHashData
cryptsp.dll.CryptGetHashParam
cryptsp.dll.CryptDestroyHash
cryptsp.dll.CryptDestroyKey
mscorjit.dll.getJit
kernel32.dll.GetCurrentProcess
kernel32.dll.GetCurrentThread
kernel32.dll.DuplicateHandle
kernel32.dll.GetCurrentThreadId
kernel32.dll.GetEnvironmentVariableW
kernel32.dll.GetUserDefaultUILanguage
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
mscoree.dll.DllGetClassObject
mscoreei.dll.DllGetClassObject
diasymreader.dll.DllGetClassObjectInternal
kernel32.dll.CreateFileW
kernel32.dll.CloseHandle
kernel32.dll.GetFileType
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
kernel32.dll.CreateDirectoryExA
kernel32.dll.WriteFile
kernel32.dll.GetStartupInfoW
kernel32.dll.CreateProcessW
user32.dll.WaitForInputIdle
kernel32.dll.GetACP
kernel32.dll.UnmapViewOfFile
odbcbcp.dll.bcp_colfmt
ole32.dll.CoTaskMemAlloc
ole32.dll.CoTaskMemFree
cryptsp.dll.CryptAcquireContextW
bcrypt.dll.BCryptGetFipsAlgorithmMode
kernel32.dll.LoadLibraryA
kernel32.dll.GetProcAddress
kernel32.dll.ReadProcessMemory
kernel32.dll.CreateProcessA
kernel32.dll.WriteProcessMemory
kernel32.dll.GetThreadContext
ntdll.dll.ZwUnmapViewOfSection
kernel32.dll.VirtualAllocEx
kernel32.dll.SetThreadContext
kernel32.dll.ResumeThread
ole32.dll.CoWaitForMultipleHandles
cryptsp.dll.CryptReleaseContext
sechost.dll.LookupAccountNameLocalW
advapi32.dll.LookupAccountSidW
sechost.dll.LookupAccountSidLocalW
cryptsp.dll.CryptGenRandom
ole32.dll.NdrOleInitializeExtension
ole32.dll.CoGetClassObject
ole32.dll.CoGetMarshalSizeMax
ole32.dll.CoMarshalInterface
ole32.dll.CoUnmarshalInterface
ole32.dll.StringFromIID
ole32.dll.CoGetPSClsid
ole32.dll.CoCreateInstance
ole32.dll.CoReleaseMarshalData
ole32.dll.DcomChannelSetHResult
rpcrtremote.dll.I_RpcExtInitializeExtensionPoint
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
advapi32.dll.EventUnregister
kernel32.dll.SetThreadUILanguage
kernel32.dll.CopyFileExW
kernel32.dll.IsDebuggerPresent
kernel32.dll.SetConsoleInputExeNameW
advapi32.dll.SaferIdentifyLevel
advapi32.dll.SaferComputeTokenFromLevel
advapi32.dll.SaferCloseLevel

Execute Commands

C:\Users\Seven01\AppData\Local\Temp\agdfdffhit.bat
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Started Services

Nothing to display

Created Services

Nothing to display

#infosec #automation

TheSystem Itself @ 2018-06-03 05:00:20

Detected family: #Ursu

TheSystem Itself @ 2018-06-03 05:06:02