MalScore
100/100
MalFamily
Malicious

dedoc.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 21/68 Related 2476
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 599.50 KB (613888 bytes)
Compile time: 2017-05-13 03:02:42
MD5: f4a8e9410628abd944b4e5d599823487
SHA1: 73a7f1c6099502c88ebfbae26e4d5ea8fb3f531c
SHA256: cb4a3da84d751c4b9a44f36559d03d2d88c66d09baee7e12fb135208456f3cbd
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-02-20 13:18:05
Last submission: 2018-02-20 13:18:05
Filename detected: - dedoc.exe (1)
URL file hosting
hXXp://prosciuttiamo.it/ice/dedoc.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-02-20 12:01:41 [21/68] VirusTotal
PE Sections 2 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0x61df4 400896 613fd1c57ba85acec685ae193e4fd06c f67b9f186b03897b34a3b507fda31bafd833274b
.rsrc 0x64000 0x33a60 211968 4db879de241959a64fe85450497febbc 45082e0a18acc18c17b3b50f0bcd9aac5c09b015
.reloc 0x98000 0xc 512 62f1c47f66e96e53920aac745ac9b1b7 c089bc40a9654fb7e7c8fc16cbb37078f076f830
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x64130 209740 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x9747c 20 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_VERSION 0x97490 996 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_MANIFEST 0x97874 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: Copyright \xa9 2018 Ace Hardware Corporation
Assembly Version: 0.0.0.0
InternalName: dedoc.exe
FileVersion: 1.3.1.1
CompanyName: Ace Hardware Corporation
Comments: oyonayaweb
ProductName: Accu-Chek Connect diabetes management system
ProductVersion: 1.3.1.1
FileDescription: Accu-Chek Connect diabetes management system
Translation: 0x0000 0x04b0
OriginalFilename: dedoc.exe
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Library
mscoree.dll
IP Found
1.3.1.1
URL(s)
No URL found
String too long
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
dedoc.exe
Comments
InternalName
2018 Ace Hardware Corporation
Translation
5ebfbda0-f332-4548
5ebfbda0-f332-4549
5ebfbda0-f332-4540
5ebfbda0-f332-4541
5ebfbda0-f332-4542
5ebfbda0-f332-4543
5ebfbda0-f332-4544
5ebfbda0-f332-4545
5ebfbda0-f332-4546
5ebfbda0-f332-4547
LegalCopyright
#Gasz
oyonayaweb
VarFileInfo
5ebfbda0-f332-4559
5ebfbda0-f332-4558
5ebfbda0-f332-4557
5ebfbda0-f332-4556
5ebfbda0-f332-4555
5ebfbda0-f332-4554
5ebfbda0-f332-4553
5ebfbda0-f332-4552
5ebfbda0-f332-4551
5ebfbda0-f332-4550
1.3.1.1
ProductName
5ebfbda0-f332-4528
5ebfbda0-f332-4529
Copyright
5ebfbda0-f332-4522
5ebfbda0-f332-4523
5ebfbda0-f332-4520
5ebfbda0-f332-4521
5ebfbda0-f332-4526
5ebfbda0-f332-4527
5ebfbda0-f332-4524
5ebfbda0-f332-4525
5ebfbda0-f332-459
5ebfbda0-f332-458
5ebfbda0-f332-453
5ebfbda0-f332-452
5ebfbda0-f332-451
5ebfbda0-f332-450
5ebfbda0-f332-457
5ebfbda0-f332-4564
5ebfbda0-f332-455
5ebfbda0-f332-454
ProductVersion
5ebfbda0-f332-4539
5ebfbda0-f332-4538
5ebfbda0-f332-4531
5ebfbda0-f332-4530
5ebfbda0-f332-4533
5ebfbda0-f332-4532
5ebfbda0-f332-4535
5ebfbda0-f332-4534
5ebfbda0-f332-4537
5ebfbda0-f332-4536
Accu-Chek Connect diabetes management system
VS_VERSION_INFO
Assembly Version
CompanyName
dxy
5ebfbda0-f332-456
5ebfbda0-f332-4513
5ebfbda0-f332-4512
5ebfbda0-f332-4511
5ebfbda0-f332-4510
5ebfbda0-f332-4517
5ebfbda0-f332-4516
5ebfbda0-f332-4515
5ebfbda0-f332-4514
5ebfbda0-f332-4519
5ebfbda0-f332-4518
StringFileInfo
FileVersion
5ebfbda0-f332-4566
000004b0
5ebfbda0-f332-4565
5ebfbda0-f332-4562
5ebfbda0-f332-4563
5ebfbda0-f332-4560
FileDescription
683b590e-5300-47
0.0.0.0
OriginalFilename
5ebfbda0-f332-4561
Ace Hardware Corporation
4s5 ,
0@e1
V"> s
}Pc@
cD:2
8U5/2U
9GimU+
SFko
[HC4>
=gV H%W
Tg7x
:M-G
ZdI1
\4Cu
3 S~
y/ZpF
71C;O
~&~N
HHV`i
Color
&08b
e@'`w!
PNG
Pu7C/J
e\>W
i/dk
4boS
C#Va$
j`GT
B%I6+
yX77WT
PLl|w
R Cz*
&,/hf|
H !P/a
q5lh
M)hu
W20t
qN *,
j ly
AV'
y mX
%s{&z
ywYc
M{E
%ik?'8qU
gQ(m
ysQ
~w19=
<q]j
ResolveEventHandler
U/+r_XZX
K#X_
^Efx
"w eX&
mC-8
_Qa#/
.RM]
YmZ%
<\l"
Y[uLW
Ax}k
i}f8
r(A=
MQk=
<)]i"<<f
L#aE:3
^ yr
E 8W
7+-{
nk8~
2s2?
x=O;
fcg
@byj
:T-T$
%[j)
w^m/
/YFy}
@%yt2
0n~FGd
!+=-
= < < < < < < < < < < < < < < <
LLJO
*%,q
RYYU
tHw7
*R<?
7OXb
lpF+
}j?_4
3tw psd
)+yft
<Module>
no"`q
kdho
H.%W
Fo)lN
:D:IM
OnPaint
K0 &L
n66r
y=gy6
?BQG>
+"3<
Rg-)
m]Lz
Olqn
&P9d
=viD
r~*XO
Z%hl?u8r
(=7P/
'p!
'c$?
U{C"
L y 4
PuHt
I [W
l(/
}4 |L
&262
CZQr
k $R
%XOm
tuZ?
vs] J
b8x#V
R }g
.cctor
]BsA
Hr#EQ
):UBI|
k2"[]
SeE
(G@(1>
get_ShowKeyboardCues
|=HP
w5{
Pkk
AhPE
)^IVI
xd> 6
I_1E
+)a7
3%1r
D|G
CompilationRelaxationsAttribute
O"Z4c
bHr46
4r82)
FJ;
D<Fm
OnYq
q`Kz
<2 ov
jhq)se
d!!=ue
Sw+It1&
System.Security
9Ycd
OverRect
}IDAThC
l)"9
h}t&
pB!<Z
/7cv
%=|??
L@up-
'zYB
ZGeQ
@GU|m
=^Q'
tKGc
u?Ep
kMG
mscorlib
%2qD
cMLV
T9Ml73
*yxiR
tw;LMw
sLV=_
^E)l
&[|O
NtW0
HHO0
z~Y'
'I@$
(e=G
eMNT_I&
Q4i;
?bY
EditorBrowsableState
T7P$
s&S|.
,&/(
6f/!
Tw>5
UG?he.
?BC&4UW
get_EntryPoint
-Jc0
Dno
2Bi}V
QP>? :
ErN
6''e
U%-f
leh
q^HW
+_Z[
sw.H
73-(
=1n&
WC"p
@Cpc
9mT@N
|WFB(
}lv#
Ekrq
WWeM
42 d
u 6Z
- i
[Zxx
fJbb
# c2
ZY0
X].]
?9zRAxNaq
E$L
set_Alignment
sxo
( a?
IE5o
=u #
MSe;T|
e[*}^
'9~K
3kOl8
:.H0
xi=i
p|6yX
@[j:
`"<:
mq9_>
a]gA
t.#~
/FL;e
<AS
ZuP}
cdJX
})>4
5Ze`
C6\8
BoundsSpecified
q h$a
KuzMz
I{-@
x^TA
> Li
o_ w
9q/ {Nm
r}Zp|1
X>E]
nG?!
bQk@
get_RightToLeft
G!Ov
iu<r
>#{a
DezN
]c 4<
XSx$
_L'D
yq5N
c*rq
O>L~c
vFW3
\F;
yYC[xp
+Ahw
AppDomain
t5 +
/jg(F@gW
g^5*0?
be Ep
}f-T5
CQyD
?vE&
v2.0.50727
_)>z
wcN
X+/3
f_(+e
%z|l
d~96v
CA/D
!tM^?
|y7
G*b
&`U4V*
@syL
matemdeea.Initializare
SI9^.6
4PtcI
jUn~
rP6<
#Hc~
Mriu
ncNf
]DxJ^
?F%y
~5Le
ZXy6
Uv"j
yk,
{3Tz
oA0p
MZ&{
?H& }]
MF4Q
&l5Ea~
{*D,j
: Lz
3k.JD@e]m:g'
mL_g
`(x~
R(f];
matemdeea.ControlFolder
M(II
S4:w
oAM'
/fg_
Me+)
zOzxw
$b!I
,hS3
JJO"Z
;#l
eh5i zi
`QWd
*nxZXg
GtQ$
z} a
b a
by1|
zK*v
I]ci
[ 7F
%M}5
cB 'F
s46!
8bp{Q
7/Th
V*8&
o15J
e{Xv[
B63NL|
/:\}
g2`H
<xiZ>
' dR@
=^^xLi
lPl-B
7i+4
Me+]
/K\1
SYP't
m@ 8
o#6V
Bt=,
L DSTH
Y 8M
[:*3c5
YJ.n
mV_.
(cfN
v6)K
IiFE
Lh:*
zBk|
z6:x&
Ge8D
N9f
bZJ96
Z7{P;l
,d6!+[n
Y[v%P D
TpbT
!+zo
7zz6M
V,j,
=G(@
2m &
Vb!8
_<K4m
$-)w
&;n+hJ
rd`]
x0LH
$/J5"
* 0
62:l
$:Lw
Type
%QB?Jr[1
0I4'
}uI,
g.6#
PTEO
Brpb
{f#;}
?na9^.x
4RlQ*
9 :2
05{Wl
2fmZ
LHB46
Ru&3x
9} 2
2|I f
R>?w,
/~cb
Jc*a
N(X?
h4`~ (
get_ClientRectangle
System.Text
C^e\
i+dJq.Ye
n^@J
Npf+
fDm@
6(1
)G =
ogfuz
Z'\=
N5cc
$, i
%5Z))
P79N
lKd
:7/1
w ^'<
&.sMb
-`&!
yG[l
35L 395N
j:]T
/5VZ
JgFe
tVC<b
U)(6L
f\Nt
M!:)
udgs
>~li3
D.n3
-06!W
|*9^
i31=
PpBrW1
_6XL'
>N;%
vg3
>)z9*
6aQp
XT(M
gHFW
\O~I
#oK
VVW%*
As>K
KB33%
D|t#XP
1 Zr
r_Dh
T [i
"T37
s(78
?cpdwT"
8.G|
{lv3<4
] 50
uSr_
_Ho(
M!_=
\+q?
%:]N
A- a
L*Gg
l.. jtno
String
11@SM=
{# W
r"5"
ls_{
Z=tq
@ xY
I'u2
dkB (
C$Ar1+8
%`0*
Yc3[7Y;U
"'`@
Xr:D
*aYw
\s/K
Bet9
b"X2
?1j()
:5zG
NZ}N
'&S
[ Y2
B)h:
+A E
xldy
Me+(
7"Hw
} k|z
@k :
^Lq~
~8+Fs2
xX ,
:aEy3GS
tsmK.
yiT5'
]BFZD
?oZ.
lsb(]
I]<
0>\w
#c<P
GHCL
G !
G': W
?{I-P~
tQ &J
w;gI;
$W(1
*!O2
vum=pz
ikv1
-P74`
@#)A
;FXiY
x%xP
[U,
fG=n
T:JA
^~P; &%
;q+U
>l)/
graphics
xO[]
NHk-N
{BUwj
<I49B
$CWR
x'jU
yr3:J]T_
-[Y,V8
52;2
i-Tb
.text
*WI*n
]^ B<
N >P
^lR1
yL_J0
hU`o`
Nj4?1b
\%{N
vg'O
S C"tq
A> \
D\ y
eIU\
b6NF 6d
#$P[
ub~$
x}&%s
|>0p
%2]/
RQ(S
04L%
Zz`}j
_YT?":
J][Qz'
cY^,C
AUtz
;WQ/Z
%SJOZG
!5e~
=A7rc
? kd)
;p"3
Ev9g
t\,
2Iu
5w*
Kf6p
LC '
_{V7
F85[{
gnO}
| Q
!,Ch
[[5,
s$f V
TNq0sB/zr
5)BW
n_L-
1D9D}
?$ u
|TTk
RP+;
k,P9D
/w7As
:}Vi2
a.'sJ
}uA*
zf,]S
d[J
t#GA
& e|
_4~M
Y5#H
$&A
: ][
B4/%
0Gzt
F 7R
k 6:
0XnVL
/0F ]
a[qBI
fVN?0%c
->$m
~<2u^Xhs>3B
in_#V
H_>2B
uWG,I
y9C;
?^W.]l8G
CcG/._9%
0M|0
Jo C
,CL>xXL5
9/>Ae
ff)<
?R@c
fC3U
;Zg1
w~bi
>G JO)ZX
f?`g
f {q?
8ec T
|tyXQg@
-,KS^
9eTC
_XkV
#rb z
IList
!'g@
+> E
yUZaq
#M& Rs
RXaJ
lBXk
~YLS
,krGIg
Fm/'
*XLh
<](j
Control
QJwJ
&'NL
.rM )
CV|B
>^0'|
JLi8
0:v
[u17
_<H
/\A
s6D sagq
s-_X
7>tq
`.rsrc
d9>i
8B
QDq
+N E
SuppressIldasmAttribute
:{z~
zY@ E
set_X
+W4ro
AMe+)
rMha%
], 4<
ZZ{4&
F5t`.
InuNV
&,vV
}*: (p
ZC?D
)S,T
qt9ke
!-Rb
qu".K3
` ]X
1$f9
<'gJ
Hqka
Bkp#
HHvO
84Du
6qJ}5
@wCGP%B
";'K
qO,a>
Uhp,`
<I9h
}%cH
(|kC&#
",Vb<
PYFv-
F,.8
L{T0
&_-
]~s"
%X7piD
G=7`
{\*z
!3?R
tze=
;[}s
$Ylb
^.,T
r)c|k
*Nj!
m@=8
5U`_
[ls@
,s G
W&HzP
_0=O-
Pc(BZ
ho[8UR
^ I+
bk{@
>Q{>
*t#%
>,9&W
#(Du
4 :P
!vS:
>E J
sQ\-
"1h#
i _
IDeviceContext
pOc{
G~00
{a*d
ktMGh
}Vc!
iY=$
,%2 %!
gBv0{
^UJ&
MvS
,*[L
"xHO
:c U'
pP)'Q
>.d
Vc!3
2)B
jkcF
bq,x
{@NL
%\ae
+,o6
9 "c
1{+<
8!&<
Kb~E2PHv
%bKP(
3L"P
IqNA
MouseEventArgs
49G\>
#uoCK
4f"]w
~})_
iqJ'H
Al4r
Chh|
7.sR
#\gT
rqDiN=
UFmr
r?UT9
?'1H
>1XG
@D(4
matemdeea
3.Wy
x? 1L
/Lw6
G7\bN
6!E)
0$+R
huT)
B/5X
c x6
N'.g
@'$
QN5p\
e3y?
hk8M
:c9|B
3i*k
(&'0
CWgw
UUO,-}V
:@729M+
]WS=A
JG4u
tmRa)
PH>ku
2 4&
UB g
8fI`
d[ -
atQ+
U\~W
QJoei
f'$uD&
K|Q`
rAJs
vJh;
"M0CAh*
,2-4
84sHm
1.K.
1eq7N
"*+;%
0es{
Cz'[
P> #+[
0F@%
\Tw3m
f{= S
gu Z$
;8KI
{W >
7c"-"J
\5bn
h`Z
M\;c
I Aj
i)dM
:ph.,H
++>2
7=IR >
RA&
6T+e[
]_Uig
}jz/
tQ_&
?x7`
m{gJQ
br4R
5#H
gya#&"Z
OnMouseMove
C~\9
F@@h
SFwoN
' +T
Q J{
7G5R
=L%3J"
w`VQ
1OK\
au^O
0! -25
GK4-
H~aX
get_Assembly
get_Control
4kgZz
S-]u>o"}
1/K1
g<1J
P2WE
r]Lp
kKuq
sQrd
Fin2d7h
N L+
/1}f
_6LbCX
MR|Q
PltZ
vKI'
^V&4O
J [c
=^onp
E8 y
`Y~}
m$C}
e&<y
Me0*
nrN|
\~^h
&lPT
JoLI
#KX,
GmMR
|KH`SU
K-j>.*
Ne[z
get_TextBounds
Z=wQ
L~^fg
0=wu
%<UD?^
B.Ue
RightToLeft
LE:f
G"RQs
k+d!
>dmM
WrapNonExceptionThrows
n+y !
ZP+*
!aA!
:&R3w
%'(
f +
uK:*
RuntimeTypeHandle
;m &
mv-7Nw)
^k]o
lqb s
!)Rc
7:r0
JF@
LRC+T
u p697
\xz2
?,;M0
Ta(w
q Fx
get_FontHeight
r,y]T
Fj,*k
G9q~_
MsWZ
]. U9
y<!Avq
wO y@
bWcr
{mg,}
d@[1
3ax79
o 1_I
=W +
r-RhmQ
M$XG
aiBQ5
% Iq-
I9,i
\ht1
G D\s
x!mu8F
0OdF
{vLu
&OLN
8zR^FJ
>>/x
S- e
xVQE.
UA1p
twIIw
55#Q
8g,|;
p%cE/6
YN KK
TC;a
e jja
YZk6$)
;;(^iD
IHDR
Append
6EFAC0EE8C248566D5441213E5936E72128EE1FF
JCexyK
ufc
5#r>V
oh,U
9ECF
`7e~
U&Z0<-J
n^'6
#5n
q^'[
Fbg
29+Yp"
)#x/
s128S
T&)d'
Q3f^
)Rz.
**d&
tsci
A.F7
<wln4
8ysvT
0{qj
aN|a
hh#BN
et#-R
j>W}u1H
rtI7
Yo7*
FhbI
0^v<eS
!@Ml
Wmqr;
6dg]
<;Tg
d$';;
I$c_LE
sz?(
?&C?
EventArgs
#$.QUTz
XGh*'
H+uLW"{
NB@5u
<LwOL;
gb,h4QW
RnB2ok{OP
),GQH
{G[*
BmgW
7#_A
m#`9!
AssemblyCopyrightAttribute
SsI<G
((%|
&*8f
L[hU
<D1m!H
?JhQ
.UOt0
=I9y
bk/)
m v7
r]I)wGK
u3 46
KSb[j,I
>FX?
"x,&
aj$x
mH tz
X"~@
TfRm+
X"~B
b T.
O(s
Fcel
t`ap
]Vc)
DEuC
V0rx
;"0p
cr0u
S8 <z
;/l:[
*]N{x
SioVc
9[7j
x]DK
C__
mZkP
Niw_
T<20
-i?C&
J7!n
B*OK2xTm
7 *
&0|M
}Zc!
+zMW=]
rvG_
*2Td
\5r7x
T+c2
~m S
tvrT
W<=ZD
SeparatorPaintEventArgs
Z|f#FTf
?t >
Bo%#S
9@E4n
{E<[
;!:Z
kF8u]&
p ^k
`/{L
VY8t
LCc}4
#wtL
Z`yp
q@1/TD
[yPo
QEBr
Qb{K
,^d]<
)}8>
textBounds
n_ D
O<8i|
! &'
pp
Gihv
wyk$
,C[D
\7 {_
C /
J,gy
rH.h
J*[.<
"E\)
LHB44
Y6je
W\(\$@
tx@J/uQ
/>UT
mscoree.dll
zL%*s
=6^o
,w4~
matemdeea.exe
< < < < < < < < < < < < < < < <
P$C:
;f*
m7 H
N<Jk
lqz#m
!-Sb
8nfu0
fJAp
v4mL!
g}xw
zVhFC
_DD6A
), 2
,7@V
]5g2
J;E2?
80J&:
(B>/x
<9]* 5u
HPwZ#
*-I1
zW `
B5 Q
x}:# #Gy! 7
@w%5w2u
*[m/
=S8a|
zOlVgk
L Bi
O37r
->}s
<z'*
=1i
Pe;1
$[sd
IDAThC
1FB(
FNs|a
[rR>h
w`g>
^ntuf
~;vZ
(=)~
5c8+
P^)!
etL^
2jS:f
q\Pi$3
xENM
|'%C
9S{g
qB0[
QikIo
1rCK
5"6Z
</22
zYN\}
(5DN
QCb7
_zns
>]4/
{gxb
JpvE
nlX~)
get_SelectedIndex
OverIndex
''_FF
7)p
$_Gh
US `
WY/"D
TabControl
G.zX
W$% f
Y(yg6
+$&Z
@aRdg
vnM6
t!VD{
U-#D
@DT.
rnP!
(+he
tRx!
:Id!
cC&V
F=6xwpM
^k>9
" }Q&
hH%>
,)52
}^@$
B--h
.0>&
.U[$ew8;M
YiOS
Lp}j
1eZ1
uWjg
;:@'>
s- ?
|W0p
NkY6
mZ0
x#Kjv3?
FaC
*e0p
FrI|g
|TV#
%j O
6i\2
h{(/
yW2_
Hqc2!
CEon
eYhV`m~W
lpHu
8kQdQ
fc#B
AEHY
N:x2
_?rn
RgH,
(j0Z
sB~S
J:a8
Rx@'
;4 q,
4AaCdr
oF%,
B)X>{
?$T(
XyJPgL
KD6d
I9b$
UJ 1L
<M@4
O)T>
<+*!z
}.Naz
Cdsfssrd
sz:>jL
>%r1
AssemblyProductAttribute
+^ pA%
$]+G
r6#r
Oj,/
t:}<3
K'vf
pXZ
R4eg
-'lS,.}_)
Pt..
Yek?Gr
hYcK
cSy?|TS2K]N [9 %z
"ye>4w
9z}H8Hd
Dd7~
gh[8
*y1q
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD
S0j3t'
C/@4=
_PuI;K
l]lb`
O\ <
&P4 [
"'aF
"hlZ
34)g
o-=
(,j+
3qrWp
=@g'I
<c}Vi
Z,YO=QE
*@J0
=7Y#
>Me+)
NOMNE
[PyS
SM_lP
nA][
$!+JN
set_BackColor
tF7D
J0lzS
}n@`
W/DD|
-p2H
NEa
O=oU
$M)w
>xsVN
]?Fyj<
u|6#k
.A,t
Xry2y
dN cj
fS,F
|K"fh
S;J+5
Xh]f)
Mk i
J2],
n?SF
M}L8V
>#x7
%#"9
~=GiG
]ygv*
!D F
iNu3
Wi68
System.Core
~Ka
"s`}o
n,$y
@ $K
?5|F=
, y^
V :,
dzLXYT`
'_4<
{uu>
4+7
A7|=A
r;f)
?wDQ
Kr$2}
oUPa$
d&5.06
#a4&C4
Ayl4M
1OFm
)s+}
;9&obL7
IlH\
./33
/:k#r#j
W;/,*X
]ZEE
- U}
g:MK
laN[vxSd
qevL
X/ hYV%
*uP z
LHD?
U=7H'
B]=~
Y +
H"Prz&Sh{
/;78
S"Cw
fnG;
{3 6G
fCU&f
#Me!?
ukJ.GD
sJ*xj1
xTwMRQ
Q)F y
4 BC
AssemblyCompanyAttribute
-%Oa~
tjJ*
Contains
Ta3p
]oJOz
HTF9
g- _
>p>;
dV}\
v#cM
[N
gX~K
p>V:f
O'}VR
&iJ~
R@1ok
F I*
i[pw>
{IDAThC
?9Ra
Ho4( "
3$G9I&
S9ql
TabSizeMode
db(yB
#Strings
a>k
:B8E
[+zX
0mt*a
IU:e9
LV,\7
|4*.s
&E<
_E4G
/hr }
K^]j
mq%^
rcan
\peK
_FGRzA
m#Lm:
vTXI6@
System.Linq
%f ^
2X;i
.H)V
~7 1
q)48
gdo2
Z$^
"j: P
h]Ek
}`F%
0vn,
2ex
],*Gk
?=$E
9eX<
$%p8
n(QQ
System.Collections
/`d_
NDX~
'U]E
pEd}9
e5 .d
L2|"C98w@
'Mec|B
1B
(~Z#
6&Pc
@GVH
]( 4<
Z\NH
q]1:G
;&' O
#x_L
>*f
|Q}|
>H,4W
AB6#
o-C<
]* '
!E.E
thNd
IEvidenceFactory
]L9e
X?v`
4{T&U
Y|+N
RlN%
b\g
JY +
c2W:+Uj
]Iv<RB
ga> y/'U
]UXZ<{F
x!uee
3)ur
ee;OPy
GuidAttribute
]g\Q
!EM
W;ZR
HkA{
&hhO
8"
J g.
5o/D
FE5*
7y$k
#iw%o
4E E
wEWT
i~sgx
3Yi9
CmAD
17#e11Q
_AppDomain
]))v
Nz:V
Hj;-p!
?#zi
$da529d27-6b47-462d-bf79-6a61ac5f08be
9AH
wBIc
=a"p
value
;4NQ
rG>Z
W0z2
X=#*
lW,g
"KI
aN?+Z
|GC+
j-M|F
WbR|;
-4iw
_naF
N%Q
d_,l1
sB d
`nUQX]s
p7F-
9UP{"
WI@i%
7-/z Xz
[[T/
=My6
=&Fa
sG?T
,_Ot
hi5h
O2 T
Se zoj
`O/Lx
}2#D
<h0v8F$U
yC`
&45p
vTI>\-
5z v{<xp
.$3/}bY
d3QM
kcP-;
LL&2i
KNYV
4qF{
!"<%Z
"Z5_
H HH HwJK
Bg #
a1Dlv
R8?$
Y5o[
98-<T[
JHB+:?
aSe-o
%V c
]r8Ge
k"G92`
cE)]` 4
!,z|
4Q [j
[\xD
Q:IrJ (5F
} n(
OnCreateControl
<Kp6O
Ns*U
8PO1]
RN+Qv
>G_[Fv
?tP$
,F+m
x)Ne
;lU#
[h
A*\F
YNcL
HB>Y
&+C$
bD ?# W
ouH~
nY!X
*s|#6
7YQ=
( t+
+C-
sVc
3E~F
kO:=y
.m1e
>{l}
f8G,
^->.\
P<<i
Ru;Mr
8n1au
Enumerable
[xKds
G39N
/,Rx
i~ 7Q
aW%</
}4;"
zzc-
^-]^
y97[b
qU[(
DD&<o
T:{F
9(A~[
N+:
lR?y
dOR#@
L%C9s
{O=Q
&\T/^
&i]v
W/kq
2TC'
_4/<q^
xc'Z
<trY
RbS`
qS Z
4JT=hh
~3%)
2iWe_0
q 4
G/!v
S/Zb{
VFypj
zWW@
.9SE4?1
X [t
" 30
|; J
6b31
$ke^=m
&m .
+XmrjJ
KJNQB
StringBuilder
<!m,
u^Y Id8x
At@(d
DWL.f>
cR{&
8[K:
zyXm
1.K1
]uVV
rXT5
J[{\
1.K6
Yqf|M=|
SJd w
L(Y@u[O
OL;
Yg'/Z
]:lJLc?Zt
*rBPl
8_H{
1.K"
/NTIgb
`"B$
P0oGN
KhnL
iQ*!
O`Zi
.'GP v
ce*.
mr1S
W(Y"s
dZ:S
e2O*
wXx@
-3)q
HNqJ0
B tW
n72D
{3t#
/#j
hggs&
ycs0
O ^S
u1&x
-Rb
w.m:%
Z"J1(
u/O)s
? RA
{ H6
\6;``
; 2I
[ Y2
hGl0
ITz3n
r3}8
t/?!
R*.>9
I3k;N
%fF]
flpCGY
Q /
**C7
Zd7q
{a-D
C06:w`
TzRVh
z}EDLHH[
|#y-
S,Dk
{MQe
i]9Q.^
rFo0zO0#
i::J
>Q)Z
width
b1Ri
[h?vKLkw
e.y@
h7Lq^
$A/w
@>!yt*
rbi=W
e` [D
Concat
?!?T
y\H%Y
U ST
Data
|2}@\
sT<7H
CZcJ
get_Width
pz%d
Ksb|
guAB
IB&E
"~ J
get_FullName
p`@C
^ |
{-Yu
7 AZ6Pt
s!)(K
u4!t
KhYz
z\Eo
Jt-n
%0k#
- L'*b
~lvtF
LHC46
^oc>e-
y6Q1
s {{
96?`x7b
gX{8C
]wz)
q ?s
ValueType
[xO`@2
k-3ae
}T\6
@:] fLmd
pHYs
.ctor
e|A?
>E6)
N)]
mBBU
AJ)d
WmJh
:3^u
|eY96Q
rC_d
"H E
A%gJGn
ov?Ij
ZVFI+
h *J
g3Tvx
=i.O
EDF}
:<.(Is
"'_#p
q|=A
Y2R;
93SC
{[vE
-NU6
Wb0
>;N
w0@
/a1G
|i3w
4OD{)
S,Rb
"S[5
r9NYg ;
c8Dg
da*Z
fx"-
G* d[=;
W 51k
}n0EBw
Jhnk6{
"?W~
&#il>
.Aq?:1
SetBoundsCore
Gl0a
2Ba@H
<LhHWP
Cef_ O
d7)5
.?G
UqnJ
\zJR{%
d ?.
EeF +
^u7c
zWq1
ldnY
(^CQO
Z7qS+
System.Runtime.Serialization
qO0xMD
7 kb
,yq#
U8F%
tnq+
&pOP
SP!k
evO3
75NB
b}mSYd
/< 9
Cv#K
'Z0B&
AnYu
#go&
>Wm>
@;46
[+V$n
zv\J
(jh x
B}@!
D)60C
Array
?x 9
QWX$
!M"B
Ng<*
WBp.G
x Wj
} I}V
}93
J Qm
N( j5
@iw(k
%OEDH
@.reloc
SXbH
~G@=
sjSUg
+E E
GetTabRect
zEo~v
lFU_
~gko
kW9{'
w`+r|
]l&e
t2#D
( L%$
C@9C
;TekejL
ItemWidth
\#MR
6#gG
c{Yn]
Wv8]
Ueno#CO
yG{M
3o?&
M +
F8vU
ozs>
j ~Q
Byte
L6]`y
r(z8
'Tqt~
lzc@
k,&7
G>QT
6Y}v`
iHV*
v29Z
Ku{0Ku{1Ku{2Ku{3Ku{4Ku{5Ku{6Ku{7Ku{>Ku{?Ku{
U:D,
Fc0'
1aq !
90|!
bJY^
L0cI
Rf1TR
b8 d
l5
n8Fa
[n Tc]
0$n&l
^ 07e
(}8x
OyY$
%=F-
1to{G
vzq0
u]*P
Mo!Z
~=w
BA?_
DIcf
' cMj
bPc.
GcR~
yY{/
Z}JP
k.uC
(SS\K
#WD[
E;W;8
get_Font
Nvs,0
TzR2:
ZP4GZ
=+P0;Q
`'eo
gVc'
kt%T
!iOb
r$@F
set_Font
ad0r
Dy?O
.fKm
TextRenderer
Pt"n/
`.F h
"mY}6
Gw/R
}b<\_h
'-1B
`4ld
Re@_JG]f
shdb
]=%(z
t"0L
WzC'
8P C
1Mo `
]A Q<
~GC<
iF^kc
uvq;
,'sFy
)V0'
vsA4
#' @
9Y:t
&8O>
get_Location
c O.
`{bq
8sw[
!#&X
label
0 :Vz
@L|=
fgBme5
}U5l
L7 #
o>~/g9
O*r
Ug3N
WYJb
2$wesqMmg
PWPU
Sc
}l
V<p,
p#5B
^1@
dSq$
xe(l
uV x|
9CNv
.Z<fJ
Z\S
add_AssemblyResolve
8y[
}TR"T`3v
D0oE
j 'Wbz
.J~l
Z#J@
MF*fQ`
~%
IIV2
XO@`
DU.\+$8`
8"kw6
ICustomAttributeProvider
Kc@PNy
nq% PLo
J^n'
Y 8)
{^QB
24hS
!@8F
@VQY;a
!rs3
*JL
AM36
1SK_
uxvc0'(
j[{9J
t6J5/y
ZP +
Ug%E
^W?M
T8X1
&TRn
6708c07f-b3b1-91.Resources.resources
DM `
c2<,J
(Cr96;
RuntimeCompatibilityAttribute
fWqM
8B^-\Y
/b#e
A YHzn
@tfK2
M8Zcc
~9X)
t =wz#
hgIy
["}
@Qpo
Y5'p
Assembly
135! mA
q 0K
eFiZ
JNG
/%,?
Copyright
VFYT
UEn4
zE`6K
y)<`5i
q?G0?L
*w(;
| h(8
8eZ>g
XpNUI
*qIU
R{"5
E2X
_8Rx
zP>*Ta:
h r
zZl>.<
U *a
6hdc
IGl->
l0x$
9/y
D:}K
#0JT
Y6K$
Graphics
~8<S
|_18e
chwsl
5. U
O!q/8E
mBSN
'L|$
%=8Y|
Invalidate
A;n4
N@* C
@W.B
P\eQ3O
?de_
5<pe
p+*Qi 3
set_OverIndex
Md?H
6g|r
*(OS
"'g@
i&z1
7sF{
a&X>
*THP
;H:@U?!
JWnO
hpi-
9%}}
EEXyy
^BOo
Size
bVV3iX
1\aPX
en3=.?
.e<7-
dn)VB
x\6;
9oG.
"'/V
_R<9
'? 2cA
Wy\,
b?Jl
>bj0
c'aq
83MEyM
4@%0z
)HvHWFg
U5 `S(
T-$n
EditorBrowsableAttribute
^oMn
Jz!
"?`a
F CYH
%O+C
YFgJ*
D02~
"O8g
qmSG6
EB*M
|8&m
=/Iqb
Lk(
1KK1
Y {X
2;Xx&*
sd`w)
c}3U
e,|%
~4[M`
TC&aT
vn|
u]_#9
y&Kv
' &e
s6{a
=+<+t
cC k
ib U
nP3~
9^(Y!
[/0F }
Z:iI
Zz d
}D)A
$LAq
j^KR
Pn _
!:b%
!=1@Z
!6A o
bQ+
;umsj
9WVFB@
Ueg/
_W(]\
eB^)
Console
:F:j
^)q5
bA>I
XDr4&2i
G' %
MethodInfo
rn{U7v"
<hQy
472@
Esh&
NWX>
b?Cw0
zKM
u"v<
ISerializable
}g|^
lHkV
";TL
X t
Fn8{\
;Z&t
aZ@$l
v3=)
}Wc!
rM(e
jo8i
CqaQ
Aq-:
X{V;V
@\*l
KE<7
B@Q_
^]|~"*U
)qiv
5+Mn
5@7A5
X m
YOWI
uf]{
8@8b U
M}{+
X T
'2bB
{"Jx
Gf)Gg
gN hb
' 2b
|t6.S
{K C,
>FCW"
O!(~
TY XRHI<
{P~*
qt~_
#]|wgGXB
jcO:
5`5[r
1>VL
zgy'
1Qdc
p\$O
a8ge
AssemblyTitleAttribute
uJ[M#
get_OverIndex
]u !
:KG7
~7SS
J~a
X(OD
eKEo
/8F l
-D1bI
/"7yMD}
Lf g#.e
M yz
1 gzP
tUa{
#S5t
X )
0e+#
V%MzU
M~-Z
hHPi
ZB+vX{
y)'#t
,3jyK
-9 oq
MR x
~mSp
?"[r_
_x]*
ControlStyles
d./E
89uj
:1-
>SAD1~
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
R^{L
W>84
=-@k
J2|*
3f]c
Ua0p
r5-D
56b
7FtB
zgC_
%/WT
!2^U
8. U
2/nS
+c)0
E3R".
PY@`]G
!; SIV
/;b;
2-Cb
1~&E
_#0y
K%K5
\)KA
f.-wZ
S_7
ke7
&9'&
veO
gy w
g=r G*
O({9 )
0Y*-G
nvj$
L7N>
q/q6
{R9J
<CQg
v{X}
Yq{z
~ \D<
*ijJ
18'2
{cV/
kn@o
-D!r
}P'?
hO5L
{ONs[
_|.7
5`
IComparable
R~E*
"%d[
9crc
S.WtY
R]OJ~
&Q$>
z9}IhQI
1/DD
^;-
BC,
_(uv
vHB2'/?
9M3j11
eHda
[\ "
YPL>
;f\l^
h%F+
Sl()
0aTB
j:VL
7Ug_
J#2=
js0x
LabelEditEventArgs
QzNF
Y 8:
&',~
ogO/
1:@p
D:Bb
Y 8=
lnB[
TopTabControl
`cHi0
Y 86
^[g*
3{r6
POS~,
.R [
t<)M
Gv7wcN2
Y 8/
)'7S
Il@uL
d4A=xJ_z
Y 8&
uCZs
ok8#m
LxV#
?gu7gpp]
|e+(
N|wQ+ x;9
<IEcr
BPr=
XHPt >
TP@91
=S
HE+;DZ`o
dW58
zFz3
W&k1
|Kn~d
;|*}
ai2
A`f=L
/0L
&g=>g
bJVs
Y 8|
RuntimeHelpers
^ H`
ob^v
j@~D
7Y 8s
KMw *|F
28uXo>
|Bv]t
Db-R
_,9/
=pWkN":
>Ima
Y 8c
(O\
77 ;|g"<
wYLq
} Ak
dQR9
,R_2
fA4%
v%)!
pRQ+
d7sU mF|
.T3>
Y 8W
m#_2
t FN
Y 8I
LHg{G
rGq<
;Zm (
yhe
+<3q
Ti7,%
#*Ue<
yqn|8#L
XIh*5%
08*r
1 9/
]"gJg
OIsO
p]4:
nL W
JWU"
(6.%
tq?}
:?o <wS5
zZv?#5
9H04S 3
82}'j
!m|6N
>TOS
RURq
s #\3x8
^J (
F+#Jo
};o;
L.(#
KftF
xvA
b]C/bl
GN %
s)C5
f`<q
#10C*!J
N"sk
r?&|
k]Z^
\C6.
F @C
$6Fuq
=E{N
vtad
PaintEventArgs
"'a2
z=I 0
~w>s
i jH
S=_}
GlDH
_j6Q~
g'FP
#u!
XX_jv
s]J^
;/JxW
# p1
:F
*[Ms
NNJ%
%C&oK
Nk7VM
//jx(
a<Cz
Rlkd
:)5x
nm%j
ii4]
_[P"
g '> $[y
`n[2
o07"
3G_
aB`My_m
/A )
6Py\v
^{;c
JDZp >
5CV$9/
M5 8
gAMA
cPD4x8<
_o>O
n,dO
;3t8
@?{)
IlO:
`#"#b
-|9\04
'*AD,|>
J:W<
m > I
E[Xc
{9 !
Bt5#
!gns
S byE
+]*m
m4@2z
9P!_?E
C>F;
k_ =
gU5
%k``5
|Y N16
oXdu
MCZw*
NuPH+
Vr? f
<De~
LvzP:
,|3|
;v }U
:hcyU
@n]HM
lH)GT
iUS|
bl's p
glm?
S`,UO_
3z*t
e q
K)Ra
o]S3Aa
KbVg
9#;R
Ta0p
CffF
;JPfN
MeasureText
CLw*
z)6
XnHXo
I7ag
h|n(
\mHq
#'gA
;<W*%
>3+)
=v|)
V;f2
_X$Z
iO{2C
8}0=
g3ln
9 eR
d}B40&
|.MV
M[j"
+J/3
7x\^
zP(_\S
#WCR
/aJzW
f>V1
get_TabPages
I-W}
5ZdT
Rc&&
"q1 R
@ ^V
$VG P
qA~E:
>XI[R
:t<B
J}<
/;A9
%$9X2
'Cd*
keQO
Om#~ t
<@^+@F
=s3
jm~ZC
7; BFP
J7o.
,D #
j5>^
'~8yH
2v<vj
4XMSFo
uwNq
'X:}
B4F0
Ky.U!
w7C;{
{4Hww
8qziIA$]dA
/K8l
b_)*I8
y ?A
#4D!
c2KP
-::k>
C @h|
oBj@>d
7 CM
System.Reflection
v6Mq
u*>O
LO:A|
/>xM
y t+
V5%$.0
j[x0
Lx m
%HP4o#z
FH&=
R a2-
.@H
f] |
bejQ
kD~=^8
Em\!
'0qz
]]N2
:xm/
:(Gs
,8?Z8
r.,?
/HPU
*FSAw
4gpV
[\C
%"6o
'yEr
1uM6
NDgX; cL0
`'gJ
0pwe
`^?D
{=4i
LVQN
q($Ud
` Ty1
9%_8
+A6B
eSgX
r[]L
Re+#
[+?^
~o^pW
5C6N
q\6<Vt?
System.Runtime.CompilerServices
Kf~
LB:-
MCj$
\cF?WlUGRoTu
oAsMr
4C328BECF729897AC2F385EEC7A4AC09D7AF383F
Y7'$
bf"#`1
d %
9I2Lk
XS3"
PK~h
;(0nZ
TN._, r
=X*'
j?.5OK
'V|'Jh
*eZ
%+ `ua^
#8W]
GA
FT^\.
0%;?
`',7
Incarcator
m9h
`VQ?*
cQXQ
J{;9V-
$4q'
c{y
W9'q{
hf9
,,^S T/2
M0p1
]& 3<
^S:
aV4H
Va0p
2QDAg
~u`V
Gp=N
%+D5tWW
P5mIv)t
C2N<8
!B-[
OnControlAdded
pHH"]75
E1crB
oN'J
H 4i Z
Bfpt:"
aVq9^
2K\C7~
JOhc/a
"4j~5
qy P
%Rt]
%p
Hu1~ pQ
tYp$
n8 )
1e"\
0B'`#
m5-
V`~P
[)!B
"K?2
_#SrA
CJ*]I
,geW
msD)
S||{
S" 0.
'=JP@,
pcUK
jo`S
]&31*.
S]q#
D;^)
V;C Ip
>ycO
"'e@
+MV
pv|R
0~V*
RBh0
Kc%!
IJ1 b,F
z[nW
g[5HX
-!,NaEwfe
}Q 8<Z
=es
ES6I#K
BSJB
.EE5
D3J+
}59(1
zl:<
PPrIL8K
]1Q|t
xl?a"
\$]3
lH.
& 09}m
kzd/
m>E`
[no$
'2[9
=QKqS
I|_c
drF
_,*>
IYNU8
r!t_^
XC~hz
Char
Kf4sW
k:0!
`4S-Qr
8d]G
chfy7s
{1U#z
c}Aqz
,R\0
5OZ
5&ah
eQxC~
^I~~1
[[ M
,.GX
uv)J#;
OvX+
hllU= W
v)m]
&RYS/H.
ZJ .
E\ O
vt\3<
ny<cD
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
{Tpt_!
wK)!
ti:n
i(U
UnLpr
B(b/
s|3E
C_<m4C
qF T
$Woz
=}C
2%eW
LayoutSettings
&Mpbo
/\Zo
MFj=
9g^L
,St>
rMbw
_wa\!
!This program cannot be run in DOS mode. $
'Xq
C$3
height
z@2k
?k~C
I(E$
+G E
f;})d
p7cQ
-S S)
^C&X
+6I;
&SZ'8.
wBr,
Me )
T-S[
Nn*
Jn|k
zK#$
{ eS
c9qev
m9RLg
LJ45
pYxz
&_PT:
Og)4
O' <
fY9#
zzmony
!94~'
plWn
x~Zb
^k$v
6whEG@
}X9
vo{.p
d/N l/
)G5]
gQ1*
cC&7,S
G,+f
HY"m
!-TZ
WJv$
Cm`|H
O@-&
Q2Lp
8H+H
IC',1E+QT~R
&uO]t
T0-X
1)n7
[ ^ou
7w~_f
~[ N
Sj_
j"^L
?\'C;]
6J}4
6"6fXB&x
eZKy
Iy&F
U2#D
7pYE*
|$H`
3{Hh
pRTd
yIDAThC
#f,F4
m*rOGv
EM<W
1qZ7
Sv_
:Y[|"O
AJ'_
E9v$
s1=7
[E'G
9:)f>
G9j^
bb@C
e w0
7TDM
6yA1
q!1.~
Kj8h
_SX>
zIDAThC
#GUID
w40h
AlV$
YV
Z$vo
0E0FA1A62DEEBB1E981471F7A1F5C112CB0A9C65
oGFr
Gn oK;o
[ i4~k,8?
stvSPO
,)yD
ptm<
,ms~K
|O;t_Z
V2C
-B luV
A`ee
U%}#c
FRJDB
mf*+
}38S[E>
Xm<0
K ;dZD
O/y)
U-5\
8tkz
+<T <
\?WP
\k"w,
raE|
~rhA2
R%e Q
q\o&>
18M(
!.0`
x C$
'_y7
item
h T
'Mim
(Sr88y
&hdJ
?sj
ENO;D}U_
547U
\kaAj'
f!{6ib*
E(:<FP
H\# /
UaYM
miFj
RuntimeFieldHandle
:Q;W
3^ir
i:-J
qX;w
'yTR
?^1LN
L$ec
|#='
9c=g
NHB46
4>VY
#i{o=rCN"
e1zZ:
u#ov
xva
ydMr
?sHl n
lVN4
"~Ou
QU_|n
Y_-+
ydCc
get_Y
-}U<CHub
OR:2
=i(c
y_`VD5X
<Ff}
'6dJkI
!#SQ
~Ze%
"qY>9qD
P<c"
>kKy7?
=7C$t
j 1
\wX+Fs
GETMaVs}
/_` }
CnFFf
Q"5BJ
ResolveEventArgs
Oild
3e&A
EO/
HpY"
*Nk3
& 4p
byd^pC
zX0;
S{J*
k W-
Ck'
&.W*<
2p>tAx[
afuA
-S*E
ZS\q
T H'
Yp@|^
lzn>kd7
tq:6Z
a,q
BTl*
|HY3
q.zINh
no<=j
4AXL
!Ies
WK_*
??%qT(]
3,r#
^Abq
V vn
Ed9V
^eB6U
3{9`@
}.U-
@v;
7^/)
3zYE
InvalidOperationException
QUegX
I18j
kV@ 5
P{e6
H-cVi*
ad<$MAV
g^fr
r_b*
2!~R
V DB
$<c7
/cNUL")
0& r
V~M"P
'q^?
~d:t
L=X/
D p_,{
y~ F
hNb?
e`8
zwb#
I(Mp
!W 6/
REQe
Y]"D
L(^K
#7vGn
$:Er
/zQ}
#'g@
ujwVs
_~ 3
"V'
_ ~)E*<
4msT
;cr
-Moe
Kk6O
]7JN
Jl(K
@<BHM
UWrry
3;*[I#
0JB@
*YnoA
17o2Jb
Xjvy8o
hp}m3
HVbE z
2y&t^
3,5QKlt8:
1S@L
Kz2.)
78m=
)L_ e `
4}HT.X
r/83
>H:S
I_q9
fM]3
ha9J
/@Fl}
Qa&ZOk5jG
'j$5
R*M
]ThmN
yB5Hp=
[Q4}}
jBh7Xa>,X{
b L@
u^Y-
:5@%o
j(\B
-">p
/agA
[0O/
matemdeea
QJZ&
(,qQ
5kd6IUp
$z(Q
N#ON
X=^p
OR}~
m )~
mSt
gG9)pX
`s@u!
<u',Po/
h\q1v
L6-u"
M5V}N
H29@[
~J:2
jhQt
_Xnx
Mr5
m8D"
o.kYW
LalU
D@<h7
(`1"}
tVc &
hUgq
.Sv%
Xf5n
\~fT
get_White
~lbg
Vh2,R
`&ixC
GxI0
;- <
C{W'
25J~ p
q 1.
R+OUw
Tg!v
P;Lh
q3nB
y> O
AW@A
nY,h
?,SQ
qcEya
OnMouseLeave
SG3f
lO\^B
vQkl
q6M"
upHZ?
4+qC<*
!O7ae
FkG:
Y 8Q
~{iw
^&%y
=7O$
L(t&
k#zC
frufz
9 U0
1vm+2
rd7>
jSW[
v.y cL
HOg?
rD&*
1.0.0.0
Zimn
j+ z
(X&r
|?St
+EZ!
|.J\/3
|aG/y
tk9:
mF^}
]=WP
UOCN
4MR5{}1
L' 1
gg~j
G(Bl
fTG#
TabPageCollection
;M+uU`H
L.TGu
s,^M
&NfL
U`2|
dK4Wc{
HRu|i^
_O)xO
fVL"
8q=!
oe`"w
oS K
Ia %V, yLYc
NY5
~kh
_>EO
h 'Y
qD={-
Qa3p
U_*I
qZ16B0
#2!A
c~F
hu7>
$ Dj
;-byK
w f;}
UIc!
$/wo
LHB4(
=7C$
],!/
_?}>o
bNw;
>l7@v
#3;&
*>E;
P6g6(Cl8 h
Y ;|X(
V +"
2spl
Invoke
w V}
dn2<]
QfUt"
dEau
,-h~m
E%Oz+
('(|Bo
'W^q
t>]Q-
>}%"<
"J0 v
KGdV
oBP"
Q (N
)Cl_(
>}ie
94K_
lMjO
$8u0
HwwJ3
<"%I^
r_nxz
2#"C
568/
{t77
Xa3z
I=dM
o\T"i
Wq2$
xA M
@ZR"
&o>^E
M`+
L*;s[
~yo?
>1=(
h 3
B6Wk
f9:n
_4]
; K3
[|gm
:oyU
%*EC
G_Po
'U?[
ToString
7(cb
-v|>Z
lK|0
'ewob
/5F(}
= < < < < < < < < < < < < < < <
[<UZKg
o,ld
a- k
&.Ak
(PVh=6c
pTn/
*64 =
oV[mR
eySN*
H4qR
%# z
cE?)
e\T>
&rjQ
Z:Ej
%N'(
RHDf
@"9b
o ]R
eZ5\
Ft3o
D2#4 z
|zinV^
-8cFg
7K}[
)&sM
by;J
L;.KF
.{/2
M7NH
RY!FU
AtX5
GJKA
:,eW3U
qHe
I!({=^
zo "
9=10IB
dR)3
U ps0
MHi 6
3d>];o
7f+
KG8! O
?0.SF
w`\T
a7pXi
&<-
>d3$
PBUe
Rectangle
WsCx
_%F
+ y=
@vo@
!OEo
8vCc
IV? >H;
#nB40^
.W ?
/7\#
zV3'
L+cZ
1btwwH#
>WXo
7Rsq
m9=02=7h
sn4u+
IxmF5
D+n
%f,!
N ~m|P
~A{Y
nGL/]G
5V=~&
,Cf }
n+Z&
-mC9
ie:o
__ ;
fsB[)k
Mb/0M
' Sc
$uOq
KJ?g
`%^&O
B!K1
0Mx,
47,c
9,u4
@jLK0
:fu
=; g
lgo0
=06-
h~X&A
F7 $7
?XD
'%T|*
_,{nt
\l<"!
get_CurrentDomain
z[-jI
E*C9
5-L0
?h0U
H^yx
BaseRect
OTD
ab&j
ComVisibleAttribute
\7=BT
3$|-
)O_D
n"N)|[
\,F9
. \0
7~ic
NXE,
R!{63
aA0NzO
0rco,
_#El
|JW$N
{88)R
1=_H
gs:6
vCnrol
"Y+C
"'mM
&A%Q
}~}}R-
309e]
%kd 4
?|kU
t#H7
\;"5FhL
e0'D
{nW*
F\\4+u
3T.l
Ut6h%U
*[9X
b2,
`W A[
t"&9*t
V2::
PZ8
AssemblyFileVersionAttribute
JQ`
^DF]
{S%X3
63zYD
}Tc1
coPy2
Gr)Q}
iC:~
KI7$
%KN2v
^XQ
v859
}PbC.qiBK
0 (M#
Q1yD{
w'=yh
$Lx>?
~M94
>)YD
qK ^
X};5
|ERb
^Gg,P
&Kl2
pq<
O$~N
[ >F
{ v6
t7cNM
~R_B
4rf~
gpfI
"Ex@
L26J
]vq>'
'?gP
Co4u
QqR[
is)W
W"~B,
^wh
1{l d
i>OA
5|8v
n kL
RD9P
ZcB
<#kA
y{S7]l}
K6xwc<
Rcjo
~7Yk
?s+Q
0ckE
x9Gb&
Xak.
Ivg8
wfCG
;7v>
Zx_T^
7C?x
Di8$
e4D\
c'T{/
)1*3
oGtV
|Z;
& m[
?1vh+
:.Z].6
wmD x
/0F }
$$Ff
5DHu
K`gw
vUlp/F
+0.-WJ%tWp
l]Mo
Xt7P
BZMu F(S
5(/,
SQ}M
? +G
'vc
<zYB
z9)s0
bHbFn
]6SF
CreateInstanceAndUnwrap
Lf v
*N;!
p~^
.=6QE g
<$"R
iz{N
Je/.
9mHyusN[D
*1)k"+
Vx>3aW
GNWz
Q!F9
l=q:$
UaRf
UWp-
C=ii
Eow2
g Ho/
5iQ
i>PV-
783]o
>iLa
WDSO
:GzyW
/x+'
U$x~
Zo]Kv 7
fhWY
$EzF
-&y0UUav&
0"^&u
NKme
C[N!
))v
\.1UE|
Z=jsU_N
l@+qq
~S_
=Prkqq
1B|~
cyr)'a;
m(''
Zb?+
r<jk`v
z PY
o#O*
mp&o
=KQH
yQRBC
3( I
b>:#
=9o*/_{
u}
UzS=
,g!r
l--N
J. 8
eFsi
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
<F}k2
]tnA?
get_X
HhOb
{%P}
C,WR
A:o}
/Lu
+#rNQ
ncoc
[yE5
9:xJ
c6=(T
CGowf
3@UJJjEZWx
C1I*
hiX}
% ,
Jisw
tq<`
<r=_
/1F }
9A.P
InitializeArray
k?f_
:s-a
REu]
yCP0
nXr(
=E*Q
]8zC
[ (T
oN[u
(4H
SH3 ln
9 |1
->#l
MintSeparator
`3fm
p|'[
!w&#5
!:,'qk
7wk
[D4`
get_Text
=Q#b
,X<se
c8D#
^P U
72s"
(C{L
^F~<
B WW
n=<hfC!
}3cR
]f 5'
cf6[
K9Ar
fZV^
]rJz
j 39
GLRlJo
j=8N
c_%iq8{
OMQlg6=m$
a1{9
b>elZ
a7fO
= cS
Uo:y
3]oH
{sG7g
<79!
!$5#
MIai
Q6E7
&-WA
/AZQ
21z5
/@m)
~&)
^?k{vZD;w]
w#%+Y
wx9y
g/pF
get_Hovering
:dvF
68L1[
gk] &
}2!D
Ve~Q+
?kz\E2
zU=
naQi
aF ,
2~wX,
O/H
5oH
ftwwws
5a$p2
+|y[\
$#sS
r, /
NId y`
PaU
QMe+)
,=*Q$
#&z;
Xao6~
Load
o J{
b3S
3CK.
QDe"
+: E
Y;$[<
CE# /
:b`d
System.Drawing
o%mf|
*/YC!
AS!Qy.
$#\<
4mCWY
get_Height
]O-;BG
5g/\b I
.<'~
Fb7$
yG2$W
]k&3
CERM
QdV~
w@_@q
#+BM
\aU1
IG,L
yp&+
a>b%|
>z(0
Nvq&
>X/,M
wL?e.
+)XW8
o $h
pZO/
k.bP
mb=-
0;Se'
9"TA!s
w&%s@6
8`WI
~eg_<{
lcO$~
N3mP
6F VS
Mim/pI?s
B~ G+4
"/'qNTv
&ns0f
X3%V
9Eg,
.ma
Lu2O
}In
M2#q
8{fm
P6_V
f-Rh
System
get_Message
Mf^h
e3m G{]&0.
F%,Eb
T_:&f
L =^
&,<6
){DI
nxu]Z
l ><
V}9M
je{<
-c;:lr
gndQ
Xd:v|B
TG,2JB"
5rc&
of=LIj
Rve s
LEU7
$M7j
!)rc
KXe;
_uM
gpo>H
,<Nl
t &
<PrivateImplementationDetails>
Z5-j
GH%
Uc#D
grgr
S4[Q
Zq%/
YLxk
PTL
>^&p
Q ,Ti
>;.r
hSf$D
!H8@
v?Ik
&tMJ)
kfD/
I3$l
l}UC
MLC<
]b?%
y8&[
\ItQk
yK Y39A
_$d91
Rg%*
O"(XJ
5cxk
:CbR~
y^ap
y(M A6B
a?jj
a_~Sw
ICC3
WD %%
1FyU
;BFn
i 9-\$z
{rr)
b C
=[g0
e-C'3 EN
.uK (6
iUS<6^
;3L8
=7B$
O j_
<a+7b
1Uu
~?_S
+q+6
?"A|
|b0?
L`FcB
6_9&
39`w
=Yo^
JJ'"
v9#W
b6Bk
pzAIF
k?LV!M
i@oT
R1k@
2xz+
sbvQ
`)3}
5!X
cu X
q#d0;C8
_@(n4
=16a
{UEH
9H(
,Z>e
6,Z6g
0 G22L
LUP<%z
7HP27
xa<'
.<C=
sXH~
Tyc\
Y&K?'`4*A
UGqn
G.s
7ztD
5&3qtk/}b
V#{j
-n >
i.w 9]
@]+
PX.1
WMcY
'&AZEP
E;.}
Z{agJ
?sYl
fo-,
@BWY:_"
5d0p
> 5+-
T5/c
z(Y A
43frr
f2o
pdD)
u(Cr
F<u|
(?u"
p,?d
86eq68
liAm.VC
S,9A
&B\Z{
I8t^
Qt^A+
A0g1
AssemblyConfigurationAttribute
'SuxuA
#Ehcb
|[0p
-ip
Vy^ji
.M5~
Pj\)
_*[],
c8] rx
n{nl
pGfM
5~?5G
5tO
8U}
(?GW
.BYa
G6cF
HHx.
}$N>
^ pG
3 B,
Dx\w
.)U
A~'%d
^gd %
$g$El
d$y'q
!C,W%
i+nj
Q|6oD
[5VV
C=YmP[
M!8^D+
t3NN
+Xe
_CorExeMain
YWjMf
-tPj
(?OR3Ehi
26J0
~L.m
||(D
uMRBw
xl`
SFejI^
s>&@8
bi@T
>tq(7
_Rqsj
+$J2
MarshalByRefObject
$~!_
get_Size
Y(Kv
CHLJ
7eY+
B6W:m
lJ[;%
o rM
"sIM
p%{D
:3)P
]e}TJ
'sX2
V {a
d[HZ
sRGB
5N31
x9w 6
}B47
s3BK
V;dnf
tk5
- f.P5&
w$<c
Lw:E`
cm^q
}VW(GQ3p
]]L^w
bIfzc
t6:Z
+I:o
"Ip}
a xB
[y[6
N\`Pc4
J(OQ
'8{S
=a\p
m8Rin
14Lt
/.K;
LgA UNr7
<|#Z?"
!r(
&\R9v
/1nK}
y|xP
W~7r
aP1Kku
4yym
+ k:O
p`Ot
.th
UwDe
*+'" &
Hg#)
epzI
G&qx8
c;/p
/:nI}
qy6x
MethodBase
~NH
1Jcs
RAz/
jM~h
IM%y
39D$
+ .le
a ^
s:li
zl~#
{>*V]
M `z
}VP
mm#D
{'I
w1C]
1uOVj9;
}8cs
1_m@
$g)Oa
y\YD
$dY<
O*?K
_Agj4
a/a"
>qwjW
.0[\`
jywP
>y_
jyM|
tR9
-?-x
BGuV
{b&'
UQQl
%E6
z(:\ g
y{F3
+0F ]'
Wq%;:Y
;D#'W
bfKkZ
$KS<
}Ho~3wy
w. w+;
J=#W
_b)v
3/Ar9
Yn@ja
1(ag
]|_ Q4
O^u2
LYpG
3 ~9
Vc<5'
,)=s
V[<>
=O)g
^@?C
_Ee`
jW|L
0ssO
`{<`3
Y leG
8}!Du
y53T
System.ComponentModel
3zu!
fONYIK6
l'M]
V.Psjh
f#*#}4
7n&/
a Y#=
=6Q7
t_jW4
dE.6&u
k~)}
h~YD
#mew
U0a>3YZq
l8!3#
BHw$
:P{,D
Fk:y
p|oJ
vT:G?&-'
/ R}
MS|q
P:;<
12QpR|
>rc@@$
GEG<
U?/]k
2J,
get_Graphics
j<&]
_O{E
kL'c
M1[g
set_ItemSize
_9^8
4}wS
:gMj
thE!
;,&
qzqh
#6d|
U0;r
QS5
$jt\>-
+ =pt
#rq y
oE2F
*G/(T
6"W?
@bEIp
! R
<){A
xfDL
x"_D
'!V?
'f49!(fI
M +;
.9}'_t
..K;
1xHT
zKaQx
HV u
+]La
rDaH$
.M^4
Nf%U
%"t
"/*R
6yF(W
M(4Y
*WL6
<m);
Q~g^
`Qez
Object
Aqe9i[8]H
=t?y
%M)2
KC\l
'`5<
'tG7
V@PU)
D1L-tM
K)f:
g/z Si@
VA92L
Gf0Q
2m)~
;Aba
$SFA
+`sX~!
Fdlq#
e =57W
Tvg/jn(
4r~
pB|QU
n&UoCJj
8~'QYn
4,5Q=
7*Fm
}sG
iXz{
i!]q(
GHG|
9JZe
0l&E
8%U5
j6=e
:B?z
6DF71263AFFB3296BA91B14181DAF02693B8F22E
oEWx
LVC46
Pr8m
op`.qMF
@a<N
_1SC3
/%R`
W3`QP, Mb
Fm&SZL
a@&6
pb?,;
& !D<
r_ %W,\N
$>54|
?5U
{?x]/
V -Bv
e{+)
@c"
VZ-[
v228
&~&v
Q8")[
clF)
H_ge
^DvltZ
W[0,
"${
! Xs=
WF^AY-
Xk:,(}Q
-5$F^[.B
X]U8
HP7M
\ <"
}jPW
+^f^
#}jO
-u#P
I~ )
+Br*Z
a8u
'Age
:=JL
n;}\
OoYc{V
g=| ,6
a8 ~
lQCy,J<(
T9g-
5\KF\
M]K1
> Qk
jCJ-
5O;E
wz4|q
8LXz
s0iGu
O*!}
&V@9T
c6U;
ueC_
w4s.
r5i|
km~
9 XC@
5o
mR,,
3r U
)%'g@
m&)n
^pKkd
Sm(g
PM#D
n&l6
:%7s
QMt72
??W5
@B!#*u
\ k6
] JN
y%f0
\~W3
A <"
SrhT
ArgumentNullException
?z_W
`b0)
k?I,
3V 4n
}1'w0
e<E"h{q
DWTR
4LmH
( 4\lR&
EIz"
Mte5
TX{`
9Z':
Point
9TL'PK
set_Width
UhTa^
vc#7
5Fw}.
^\ >
=3Dh
JdjJ
/[fA
E`Fi
+o$_AW9
@}<_
7WU]}WG
5"9Vv7T
?yzg
m_#n
&J ofG^
F;HU
`PJu{QJu{RJu{SJu{TJu{UJu{VJu{WJu{XJu{YJu{pJu{qJu{rJu{sJu{tJu{uJu{vJu{wJu{xJu{yJu{
tk>:=9
sckG
vNNW
YVR=K_
oeb'
5"\_
AmaEQB
TextFormatFlags
2% -
get_Count
y{D+x
qmGh
HS4U(
Y fbo
J/to
Zz ^
tbb,
&PQ<o
-NNY
_ <C
A}P|%
!)'H
!J~Wf&
o{0^
k.K;
\"j
v1%`
[>e
K:\f5
j@U%
&>s4
l, /UT
g_3m
h##&
SfQz$
;GWQS
!J`*
TnRa`
(@5W
2VEQi
C:T s=g
W^m8
4}b'D\ ^Py
ZY0
aDtr\
textFormatFlags
$il}
%3N
h&\/
qH<[
}m"Y
DGMfx
If?@
>9'o)f;
get_TextFormatFlags
ET +
\t}7
*Gj"
0=1"#
Wb\
c%A@
6 )2
W%0[
,^4Z
E,8z"*5
'0%J
GetTypeFromHandle
,7il
.7p+
IcpKGj3JjL
b<-ID4
3WZu+
a"R5
I^1U
G?l1T
8xwT
tEtYBYx
j92
aM-;
N'Qm
yyGZ
b 0VC
f=Q]
Uw*C
j \is
I+nk
rVI
0:KA
b"w.
Z{}>
H*dDOp
D]rY
2g+i
WgIj
7C>D
?k;
<t<nm
|af(
pJ/g#o[L#{D
> YcE
EVcV
?1H+
ux'C=hFcP
ND1*&
|a *
wwVQ
AnPw
NS^>
/7-4
\G<p
2uU%
0]O"L g
+J E
Q-+b
FVo-
lIK
.=n'
V`d
V; @
N_`?
47ZR
AssemblyDescriptionAttribute
79+`3&
zr.>>
`:1e
t yq
5zGn
Cgq&
Mt+$
wc'$:p
""D
S'
j'a@
3M@.
0cAS
Hg$=*>
-@Nt
JSK})c
x[WJ
l g 2
&rQ^
P2q
JHv)q#F
"Dm
`Mt-J
pnGK
]-|o7
~IDAThC
Exception
DHG47
Elce
}xc8
>Dm*
qD -
MuRUo
wq*1
XR]R
;iip
Vn_
System.Runtime.InteropServices
YOiF
56g@
buF(
%LL9
Gzm'
*N G
A#9!A
FYw]
Math
n'fzL
zieK9
\/I8WP
AO j
zF/2&
hMKt;
B)}s
57q7
_@3I
dg+jwGllI@
specified
RiSC
FB%U
j`W
98~!
ei]sHE
%:,:=
{%cqC
5/(U
Q*J=
.muHf
r-/b
:7>fdN'0x
k 7x
/RL~}I
W=W%O
A-M#
!YOc
?bMbPr
$QKQ
}2%dC
4,p(
Xxfl
wZ7Q
O0h
=,8R
*(@?
x}:s!
)qT9
f H8
WL>
vca7
.R/k
8`P}1
/bN"X
(#IhWY
%/]
o~B5
j7\0
&-Hxk
oqb"
~R 4
)E[#
4TplH
IEND
E ]0
8%.pxwoU
z#F a
!:_jo4p
0bu]
@<z_
d !q
Ss3=
mw Z
TK5
,fv.e
l^Kt
,RUp&
9rA
=U|5
s8V%lggD
`I{l#p
{ZDk
C$[V
s<-C
m5/g
6_Ky
"rNE
v}hM
f) |?
)Yz;N
!h&C3x
t'Gv
8D\)t
J_&'N
^E/F
8jSn
zH zaixj
8y7j *
xLoV
M=L$-
{2O
pY/-
1wP5
/p(x
QA8l
]> e=
/*Tj
PR)l!
L8u".
yEx;
j\uz
6^Vf)
o ~
|[84
mzD-
FY<b
_j6rvw#
&)bL
-*)
(I`k
_:G%
)z?>o
[R>4<
08g&
sb 5
3JOiV4?
dv_@Z
Q80.K^
}2)|
>SoO
TW^T
" k6z
M 6X
vFCIY
5p%[>
Zjb6nDb
+_t37A
:NCR,
T8xO+i
\KQz
=P>9
}9.W
K!Jq
.5Qd
._P/
k5,r
}?aH
"yq#
O|%-
sa@
/]z(
c!p|}
h _z
nNJ
&2C5
~ :c
T\Kb
k0-s,]
o/6
4 V:
WC%/w>K
485g,.Vp
jWVF
V" E
)eRV
>DXn
$B4;T
|g)Y
viNX
*E.L
r%O}
aT}
3s&/
Aug
2jSd+
4H7HK
>v4(.
fpVg
6i{!
9GIIb
i04U
OT}4
nkEu#
N/2-
KaEFo,
#Blob
TextBounds
!-VJ
{+%E
/4(-
)"!i
h7pW
(IV>S
Fz g@
)]LTed
5HUkKF
X*D-
0X $
]f r<
9S#0
.%,*H
t}^
yRi-
[{(_
31&9O/
2.K0
b|RO
>9h~3
,lF ~
"KKC
4N00
.,)2
fg1F
.{*%S
|!Q\-
>[zh
%c)|Eu
3UNT
wByO
$[bYoV
? )t
RMx+
3,dQP
!T9&
!=I
iik*
TB 4
/0F }
rOqVw
G?cn
]Y5f
w@q|v
Rg*s.
+2]qv
Piqo
<+t>
]"D'l+e;
4%+tB
, _A)
'Ki
HB4g
SF \y [
a"Qc
^Fo'
^a!'
g}sUm
@Qu/c/
5fza
VI.p
?nk+
!QD
5-l1
{OX~
p} p
Fn8;9
|.K;v
+GV e
RA{
8|v<
zqi)
'@X<
m8xc1
ST[D=
44qm
l} L{
F'"8
@.)[
9,&d
5v3&
t e
[;Q>
wF6g
!-RbO*YA
(-Hq
{C4c
s sb
b qX
{Dj_
WgX{
'PP?
@ -a
/C ?
)3n-
^ I#]
tw7(
1%no
set_SizeMode
Hovering
iIvw
8AUZ
[Infae
5XB4/ #
GCT)
%3nvimv
O57HF
2oTf+5
J; |
E<y$SI^
_z+>
E&I1
[vj=
>:Wg
AG,
Ae_d
r{ub
o5U
zBq<
QGbS
3 -
<yLw
qW-.K1
yy1M+Z
4D;O%M6{
b*%?
RaY4^
$k{M3
Font
j4a
}DG
_w>
NM\m
{:3q
Oiy
2\@|v
4(Kl6
5xs"84
knYt
>lQ0
~ K
p*mB
BDNL
:z(i
>~qD
q8>*
Kke"K
{UYB
*#f|P
RbBW[
utSn
`yHJQ
d0?1PL=
B%py.
&T P
Ee:+
hgq%
de
E"5k w
~g3o
Ls[2
1.m'
, X6
>F)[
)yGu
4gv"
p*Fb?}x
1 `x
x?Yd
=-mW
yvFL
}Vc
"K7y
1 8
e^E-W
>@FJ
j&=Qfe
!k)_
ic>-
gBP%'
e p
=jC(
B'oC
nj6R
`TPu
/KC }
eZR@h
>0%Ts
;S$^wt
";]G
U_wbn
f+Zh
vpYi
25Q
7\m
St+D
fg8f:
` [A
npQV
ButtonBase
p_ZH)
_Kw7
N;eME
Ge=)
F(8v
QiKz
v2!D
Jj1
zg%_IA
P0`zA
jpG1pI
46*`
G|*L
AksY
=ju_
}^z9
e<\~
IEnumerable`1
@/&)9
PPqr
y`t<
ZPdt
Y>|a
lX'{.
LHR56
uU.$wDQ.>5
X ,
TabAlignment
45$WD]
v1qK
md8/
!LE'"
"W$N
}s6p
"rHF
8J-
bVK5
87!i"
H;%@K
sFE^d
~=?<
]* 2*
VOi/-
Btt
.~2!/
Ar4C
5vN
gaxk
U6iZ
vV Bb
L?8O,
IZ %j
92Qr
R];
>a0]
|}h^l
,3Fqa@
URr%
bwJzC
OtpAT
o:E&
Md+)
*<hJ
^YNT
LY)X
%>U1\
Me*
NxK1]
~DRw
,cb8
G] g
[\< n
CO= < < < < < < < < < < < < < < <
V6q<!
-[\h,
T ^$
Z^hBB
F7?ZJ@
N6aT
ToArray
%Co|,
`"SZ
bL'$*
E
< 0u
z*uH
:_K2Yr
^a0a
C*+i
a^#\",
@6q
b5|c
,BYKv
N.rm
c\kOH
AssemblyTrademarkAttribute
;:0^
@PC+k
&gkB
2!S3
MF*fo
R#=}
ec#Q
dUO(
ng/>
VSTr
h<e{
[mZp
G`r_uf
z,ZR
,^1 .
hXP[
$4w*
go,
41tJ
~PwkXF
~ZSY
oND{>
ControlEventArgs
AAv
Zo^l
z,K;[
2g9[
7+ N
OhF;
tz&<C
hUK}hG
bb9G
:tP5
/x V)
N(r>M
r3b>
gd&333
q4cNP
1mFC
w k
8{ #5
-[Im]
3LK/
iMAh~
&#}+
e>@f6v8
^0i*s
-xr](
GI<
JxaB
+-tU
u*b1
=2RJ JYGM
2;wQ
i3u}N/-
6Y!
7 iy
YYcw
E)K =
FK=Ks
*<3K
[Xu=X
w-!<
h&e~
System.Collections.Generic
sI~k
HoH}s
e$RD
T1Q-'
=#81L $K
/0F }
Cd(Y
@aK^
M\;!
)u75
Qok<R +
bpPw83A!
l;$L|
bM74
l}sR%
o5%/
|IDAThC
5e8+e.
JXts\
System.Windows.Forms
63TG
z ,8
F*JR
;\yB
e-yat
SK$-
-y /f
,m2t
{yq;
u' f
l,]'v=k
8{r2
:[J^j
4dva&N
"o/gd
-/ F
0oo
WriteLine
j` _
.K6A
System.Drawing.Bitmap
(X]o
{e"p]u
j^0+
n{-wB
]pOg}
7OQ/L0ql}(&&Q
LHlg{
+om?<I.
X8_'>
-5e]/
{E6YW
R+MV
V^R|
#&w8
3G4`
SetStyle
LBjd6
ij6:
!l7
<$[3
c</S5%
0<4-
k4T |
AA116D4CEEC324F997842E90883AC815F1858929
c'yB
%bk
@uV?
}KNO
iDmp
ZY0
I#;5
]&,5
x`c~c
x?Bf09U=
."`:q
<}O
=QDp
Z)qU
~h[Q
2]yp>
33`K
\.7Y
rYo{
V))e
,tg
Av>nCv
ox4 (z
>(^b
g yW'x
.>j$A;lpC
! lF
rau6R
Z5{ ON
2018
], 5<
?ov)
EI72<
rDkjh
kD/r
5M
q,}=q
*B"3
}@ v
` 3
UxOs
{>cT
<)S4
R 2N;
eL
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven02_64 Seven02_64 VirtualBox 2018-02-20 13:17:33 2018-02-20 13:20:23 170

8 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven02_64 Seven02_64 VirtualBox 2018-02-20 13:17:33 2018-02-20 13:20:23 170

10 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\dedoc.exe.config
C:\Users\Seven01\AppData\Local\Temp\dedoc.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\dedoc.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Users\Seven01\AppData\Local\Temp\dedoc.config
C:\Users\Seven01\AppData\Local\Temp\dedoc.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol21.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.INI
C:\Windows\Globalization\it-it.nlp
C:\Users\Seven01\AppData\Local\Temp\dedoc.exe:Zone.Identifier
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Users\Seven01\AppData\Local\Temp\it-IT\matemdeea.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\matemdeea.resources\matemdeea.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\matemdeea.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\matemdeea.resources\matemdeea.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it.nlp
C:\Users\Seven01\AppData\Local\Temp\it\matemdeea.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\matemdeea.resources\matemdeea.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\matemdeea.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\matemdeea.resources\matemdeea.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Local\Temp\shell32.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe
\??\MountPointManager
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2328.6041046
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2328.6041046
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2328.6041093
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe.Local\
C:\Users\Seven01\AppData\Roaming
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows
C:\Users\Seven01\AppData\Roaming\Microsoft
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.INI
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\matemdeea.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\matemdeea.resources\matemdeea.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\matemdeea.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\matemdeea.resources\matemdeea.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\matemdeea.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\matemdeea.resources\matemdeea.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\matemdeea.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\matemdeea.resources\matemdeea.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\shell32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2628.6044937
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2628.6044937
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2628.6044937

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\dedoc.exe.config
C:\Users\Seven01\AppData\Local\Temp\dedoc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol21.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll

Write Files

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe

Delete Files

C:\Users\Seven01\AppData\Local\Temp\dedoc.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2328.6041046
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2328.6041046
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2328.6041093
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe:Zone.Identifier
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2628.6044937
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2628.6044937
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2628.6044937

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dedoc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\410fe546\7307cd04
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index21
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.5.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1e5833dd\40ef5613
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|dedoc.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|dedoc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|dedoc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1e5833dd\10592a67
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Namespaces
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\index
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\index.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|index.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|index.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|index.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index21
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\index
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Write Keys

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\index

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
kernel32.dll.QueryActCtxW
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
kernel32.dll.GetFullPathNameW
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.GetUserDefaultUILanguage
kernel32.dll.DeleteFileW
kernel32.dll.CloseHandle
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
kernel32.dll.GetCurrentProcess
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
kernel32.dll.WerRegisterMemoryBlock
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipGetImageEncodersSize
kernel32.dll.LocalAlloc
gdiplus.dll.GdipGetImageEncoders
kernel32.dll.RtlMoveMemory
kernel32.dll.LocalFree
gdiplus.dll.GdipSaveImageToStream
oleaut32.dll.#8
oleaut32.dll.#9
oleaut32.dll.#10
gdiplus.dll.GdipCreateBitmapFromStream
gdiplus.dll.GdipBitmapLockBits
gdiplus.dll.GdipBitmapUnlockBits
shfolder.dll.SHGetFolderPathW
kernel32.dll.CopyFileW
kernel32.dll.SwitchToThread
shell32.dll.ShellExecuteEx
shell32.dll.ShellExecuteExW
setupapi.dll.CM_Get_Device_Interface_List_Size_ExW
setupapi.dll.CM_Get_Device_Interface_List_ExW
comctl32.dll.#386
ole32.dll.CoUninitialize
ole32.dll.CoRevokeInitializeSpy
comctl32.dll.#388
oleaut32.dll.#500
advapi32.dll.RegSetValueExW
kernel32.dll.DeleteAtom
comctl32.dll.#321
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
advapi32.dll.EventUnregister
gdiplus.dll.GdipDisposeImage
kernel32.dll.GetProcAddress
kernel32.dll.CreateProcessW
ntdll.dll.NtAlertResumeThread
ntdll.dll.NtGetContextThread
ntdll.dll.NtReadVirtualMemory
ntdll.dll.NtSetContextThread
ntdll.dll.NtWriteVirtualMemory
kernel32.dll.VirtualAllocEx
kernel32.dll.VirtualFreeEx
kernel32.dll.VirtualProtectEx
kernel32.dll.Wow64GetThreadContext
kernel32.dll.Wow64SetThreadContext
ntdll.dll.ZwUnmapViewOfSection

Execute Commands

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe 
"C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe"

Started Services

Nothing to display

Created Services

Nothing to display

#infosec #automation

TheSystem Itself @ 2018-02-20 13:18:21

Detected family: #Malicious

TheSystem Itself @ 2018-02-20 13:36:02