MalScore
100/100
MalFamily
Malicious

cmy.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 16/68 Related 2498
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 606.00 KB (620544 bytes)
Compile time: 2017-05-13 03:09:09
MD5: f78631aca9bd9ab5becfb068ee6825df
SHA1: 3cc7c5dd9d19ce7f74874f49b24c29fe288ae2c8
SHA256: 40bbbba081d50d4f5662b2539d5622dca1bb4bc9e266b1caf7110bc6819aa649
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-02-20 13:21:07
Last submission: 2018-02-20 13:21:07
Filename detected: - cmy.exe (1)
URL file hosting
hXXp://prosciuttiamo.it/ice/cmy.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-02-20 12:01:37 [16/68] VirusTotal
PE Sections 2 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0x636f4 407552 6a313a8e68a64594c7814ddccb9040cd ed1d76cc0c8c0ef23dad4497b6d841db175fa562
.rsrc 0x66000 0x33a58 211968 a04c2d6b753637e5667868815e060f61 42adc9964aacec7b3800176b6ae360c13affa64d
.reloc 0x9a000 0xc 512 c393e9f14191671706babc7606c49f9c 1be70a1f43cef599e08f3c407bab74b8fa5b87e2
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x66130 209740 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x9947c 20 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_VERSION 0x99490 988 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_MANIFEST 0x9986c 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: Copyright \xa9 2018 Ace Hardware Corporation
Assembly Version: 0.0.0.0
InternalName: cmy.exe
FileVersion: 1.3.1.1
CompanyName: Ace Hardware Corporation
Comments: oyonayaweb
ProductName: Accu-Chek Connect diabetes management system
ProductVersion: 1.3.1.1
FileDescription: Accu-Chek Connect diabetes management system
Translation: 0x0000 0x04b0
OriginalFilename: cmy.exe
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Library
mscoree.dll
IP Found
1.3.1.1
URL(s)
No URL found
String too long
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX
Comments
91baf258-1169-fd18
91baf258-1169-fd19
91baf258-1169-fd10
91baf258-1169-fd11
91baf258-1169-fd12
91baf258-1169-fd13
91baf258-1169-fd14
91baf258-1169-fd15
91baf258-1169-fd16
91baf258-1169-fd17
InternalName
91baf258-1169-fd8
91baf258-1169-fd9
91baf258-1169-fd6
91baf258-1169-fd7
91baf258-1169-fd4
91baf258-1169-fd5
91baf258-1169-fd2
91baf258-1169-fd3
91baf258-1169-fd0
91baf258-1169-fd1
Translation
#EOj
LegalCopyright
oyonayaweb
VarFileInfo
1.3.1.1
Copyright
91baf258-1169-fd61
91baf258-1169-fd60
91baf258-1169-fd63
91baf258-1169-fd62
91baf258-1169-fd65
91baf258-1169-fd64
91baf258-1169-fd67
91baf258-1169-fd66
91baf258-1169-fd27
ProductName
2018 Ace Hardware Corporation
ProductVersion
91baf258-1169-fd58
91baf258-1169-fd59
91baf258-1169-fd54
91baf258-1169-fd55
91baf258-1169-fd56
91baf258-1169-fd57
91baf258-1169-fd50
91baf258-1169-fd51
91baf258-1169-fd52
91baf258-1169-fd53
0.0.0.0
Accu-Chek Connect diabetes management system
VS_VERSION_INFO
91baf258-1169-fd43
91baf258-1169-fd42
91baf258-1169-fd41
91baf258-1169-fd40
91baf258-1169-fd47
91baf258-1169-fd46
91baf258-1169-fd45
91baf258-1169-fd44
91baf258-1169-fd49
91baf258-1169-fd48
Assembly Version
CompanyName
dxy
91baf258-1169-fd36
91baf258-1169-fd37
91baf258-1169-fd34
91baf258-1169-fd35
91baf258-1169-fd32
91baf258-1169-fd33
91baf258-1169-fd30
91baf258-1169-fd31
91baf258-1169-fd38
91baf258-1169-fd39
FileDescription
StringFileInfo
FileVersion
3534a822-8052-5b
91baf258-1169-fd25
91baf258-1169-fd24
000004b0
91baf258-1169-fd26
91baf258-1169-fd21
91baf258-1169-fd20
91baf258-1169-fd23
91baf258-1169-fd22
91baf258-1169-fd29
91baf258-1169-fd28
OriginalFilename
cmy.exe
Ace Hardware Corporation
d32I
8b>;vq
vZId
geZ<]
djSB
}Pc@
Mf"&
_fmX
Yj=o
#J\}i
~ C/
Tg7x
iT K
r(A=
F7)
3 S~
[ ?]
<Dl$
beH/Fy
HHt_
]DY~
saD-.V
C$D@B
39+x
Z'mtx
PNG
e]]N:A
RuntimeHelpers
:AOT
3 4
QxR:
j [kI
5k}/J
ZJ,Zd
0W c
I|msD
:e]~ ',
Kk {Q
:mbb
sC 8
W^ "
v,iu
gFo|
iMaf4
y,Rl
y0}u8X
( a?
get_White
NC3F[
"{\(2
7o)DY
u]MH2
;JrS
t77m
@@L,
g do
xDKy
mV;M
TabAlignment
{ }n
E. (
I:{Y
#m'(p6
pSfp
(<s
k3B"
Control
!)rc
)R)yo2Y=
FzJL
#g`,%:
uzsx(
set_SizeMode
Y~Hb
k / @%(
Y? dEp
&N}u
_u:%
eX<)1
4r%g
*m}g
HdpW0U
E$L
6&Pc
3LOwN
|A1'
t[Hk
H$-7N
%NX
c^=q
K_9s
nNLL3=1|
N_DU
H&:F
(<:
o6>r
a-EO$ S
g2_S
k_ =
pj4F
BRpn
p 1;
V([:
"6fT
Oue9,
%LN%
(/ws:UW
4,s{
Z5 s
H%Xt5
RJzp
uR1I
Nu"1A
[HC4>
+mgI
I> G
\R'3
C.Zy
M ?}
.~-:
_Qa#/
E<v
OdSpM
N_8_J
7c"-"J
ET<W3
^YU`G
Assembly
Dg%yc%
X?v`
/F:MI"b
H\# /
sZ "\
System
4C328BECF729897AC2F385EEC7A4AC09D7AF383F
(=7P/
lgK
A7,S
p{x'
_} I
7'\
eW9U
/Y0.*T
!+zo
yy ;
PQmM
"k?cP
cYAglU9>`#
8po\i
q9251
QWX$
Ta(w
WdYB\
tN
M*j<
W/J:
R"1@
):UBI|
0$_j
oj"*
~6U;
--XB 3i!J{+T
ex8)q
W^L.
T&PM
G@!B9
Uh-
a.OJ
^}r+
4U>@w
2qN
\4g77_
BDOa
?M0l
cui bD
F%E%
Zz}%
/b#e
3dY
Q^n.
OZ,X
fZpT
!(c
(v&>A
8Czb
UgT" S:K
!~^Q
matemdeea
1-h"
}IDAThC
H.^m%X
E2OSm
get_Height
'zYB
s{M*
F]>!
2L5:4g
matemdeea.ControlFolder
P|g2D
@.zO
Cz'[
Ta0p
TYiY
;_RvU
Z`yp
E79sR^
xfIB
sYz~
T&<
y\YD
1.K.
.MRyITN e
fJ7a
atwI#
ix~]
YN03
W'X=
:DW!*49
}ARS
1.:(a
=-> f
E`Fi
Iy^!
o$?F
-Wwi
o`h[
MOB9
h$=*
Q&6T
^s-Y
6f=v
=1n&
FVo-
fI,v
K"S,
kC K
Math
,lF ~
7Y[g
*Ds
WWeM
|rDt
Uy m
rjX4
<cMi
QY +
R8;@
btZ%2
ZY0
#w[|
"mp
}M F
4"<*8
kpgqC
Er{b
#r`;>
{ #g
{-Yu
kGu7
PIT8
<`@9
@Q&r)
yQRBC
`"<:
S: S
dnli
n%dk
!D7b|
8BiW
&kq}
y'zY<A
;JPfN
_}UA
.c] #
`<q7
D8|y
@FGIy
M.e"#aTt
R/iC
?LR
v%J-s
F3qC
{S_3
^szC/
9^W7
5E '
h9A/
v2.0.50727
gE+'\5e
sm!d
)?n v
OF,w
bmOSKX
Hp*D
#L&'
]c 4<
XSx$
PEEq
sDOp
<2oomT
L>2UX
jQZW!1na
Qf'l
C<krX/O
{}s+f\
xci <
uKF]
AppDomain
01wq8_L
NE31
PU()
N.+sD
4|O\
,TI3[
?kTG
?o|=6
2a.>
ONo;
TaRKl
p`Mf
!g 5I
/9Cz
K1fb
u[S|
h5 nR
hb i
|y9w
a1bb8ecf-63e5-c0.Resources.resources
QniU
set_Alignment
GPT'
SetBoundsCore
M{8v'
OooI
r 8r
T:[%
MdM?T^
PaintEventArgs
MhO\
d%)-
aV*P)
A=Ld
KY +
fk?JXn@Z $
#OtP
<1*^Q
D'VI
AIJ"
W;%uq
0Uo/g
~6*|
AQhM
.:=+W
\^Gh{
9My|
OO~#
^t~6g
,D &IO
(HfE.
s3H#
kmE
,D+-,~S
7O7D
s8Y U
W:oZ
/fg_
Me+)
Me+(
/j%?D
eB&Vh
UdPFe
kYq/1<y1
' Sc
J6 J"
!05T
cNww
j"Y11
) 64Jn?Q$l
.BO[uRZe
Fou;
o{f#'
;.jZ
<y0)=
wsi8
\ap{Y
v,]T
#Me!?
f-Rh
vV$F]qwJ(XA
8fFD
k-jkc
%%7HZ
%p g
O5NmQW6
~W#c
67*v
m#sW
$sP.
I_{1
esHLu
P]uF
|>eyH
)ZS85qS
gD-jM-2+
get_TabPages
dCd%
r}v[
Me+]
4H1|
2RiK
j_qo
!o!0
LS~wS
\qHT
o#6V
H #
dFTP
K` n"
2-Cb
+l7+E
mh#|
I 1
7TOCu
; K3
(\`M(f
SW+n]
oqg x^
u r5
]sfe
@a<N
9kh
5g k
BtC\h
{+q>
oA0p
ZxZ%
vTJ6
KKDP(
jbp$
$-)w
h-j4+
rr<b#
'>U
T?+4o
h;;-Zi
OIsO
_XHI
f0RPZ
* 1l
4DU T5F
u<SiG-
0I4'
a"#%
Pz[{
4>iK
u3Uqz)
[.d>.My
g/}S|
Obd7
&<UP
LHB46
3M];&
'W%a
$6Fuq
(_f
g;P7
/~cb
SR{X
* iL<
m54
System.Text
NHBHt
m7|z
"B*m
{ M
zfK 0
L;Ky
gYsw?
nF'm
92iY5X
[*fM^
h,g{
),GQH
] 8+
_pAa
8tgQ
j+r<
ZqX&
@T0*
%))HH#H
M>Ia
+vBe
D4C%q
_c H
PUzFs
yG[l
n!61
9qUJ?.
1\aPX
zbf&
>Q)Z
Yi)T
a(\T
p&}p
S;) %|
A h1
7YR z0
vXr~
D.n3
mfC
.j*
GNut>
?%[=_
[]tt
$c|#
GpF]H
6aQp
[ |fb
bZ(o
PyXM
w=Q
~PY2
uYd
x*}+O.H
Fu\=cfR
zdgVL<
T [i
zTB
p\K"DM
String
v4_A
w#%+Y
_tx[
dJ=B]#
9yuU
j]`D
3eh
by?g\
oO)VJ
) >&"
FStE
4~[9Ii
11@SM=
~N/u
'a6s
&dQ`$
QW
Gb,m
Wjh;d
%&@%
]5{b
<nq
D:'8
:.H0
{vSZ+
pdOGXW
_5vV
BAVt
*s|#6
--iz
LPBn
oC*{
a^{a
37G
MI=e
V[&F
d_d~=3
Pw 1cyF
W 0R
:5zG
[ Y2
V\ O
s_wd
`iX n
hQ@$
eA$6b
@fc5)c
*"Gk
J%65
Xz O
iU0Lx
pQCY
qPB;
JlGin
"?Ay
s1hd;
tO\N
d482
/<}_
c1Q'
t&6[xl
Z<ujdk
M-_l
zieK9
*@J0
\~a(
K4EX
GHCL
%)R<
ti 1U
set_ItemSize
-B$x
~SH7q
QQLH
vx ~=
Ii{@
5<J)
=uLL
(by6
"{xMM
iT<~
7 Yw
Ik>-{
-n8I\CM
S" 0.
WrapNonExceptionThrows
8g0~o
graphics
?Eb /
eV26\
cw6V
}u ^Y
ws'2
<c}Vi
aJsA
.text
6n cm
ZY0
Pcg|
q,^
X>fJ5ZwB
_+[0q
Zkl
/LJx
qjj/
J H
2d[I
T0-X
vg'O
YZk6$)
?_.~)\V
>B<
ifLo
32+%K
qZDp
Mo!Z
u_!G)
7cHH
gX(J
2l9Zr
bMC4
u;q[
X1:~
2%eW
mI:|m
!$1/
<^|u 4
2o\r
Wl_|
textFormatFlags
N5 U
k,1g
lTqvB
+7dO
Yg3ku
RDc%w
]vq>'
IWin32Window
System.Reflection
B%+Z
`OSO^
(<:5%
uV6+
@jX
>l)/
r-/b
p5pB(
Vt-X
!SKF
$;g9&
J}a+
:}Vi2
:b"
6M"
&L6^
%=KYR
{f$f
t#GA
QjfG+eLm
;T `.
|gHP
Ve'z
}Fcx
-O^\
67~o"
Y&fk
4fQt
yy''
7.]a
ayvsGoS
##dk
s46!
LHC46
;d~DH
get_RightToLeft
Z1]@Gej
yt+u#
RiRZ
%47~fq
D6~85
rqqYc{
oP
6SSi
&gi-8
;Zg1
K!$]
/0F }
8 <
8ec T
\w _
m5if
_06k
i _
KT*e
#rb z
>9'o)f;
Y~MPu
7aH
\?0EB
Ann8
^'v'c
fmga
-{72
6jKLu-
^a0a
wt?R>
7m v
zKyAW
g:}(
~=GiG
4K*i
ResolveEventArgs
K%V;?
(9tF
z\ %{
lX7l
`.rsrc
E$['
{?s\rR
w,*e
SuppressIldasmAttribute
xYgm
Z^
QrY}
6| <
S =8
!mqh
>F)[
Wn< N
r`/-Z
5wAn
c%A@
pGuB
~ =zL
c'nz`
ZC?D
J3sb6
r Bk
B`k \
!-Rb
G\=f
m_hC}
:yf?
93 Y
[|,@
y blL
r"5"
teXF
5Lqr-ld
[rGP
V(KD
4mCWY
hp}m3
&g>%
F .~m
>RTkG<
'NLNw7
Mhj7
MQ g``_8
Cb-69
,(Sj
"0l)
m$RVES
wfCG
[rG|
3_c#
IbAL0-N/
5eXBR
2(2J%
[X d
d3a:5`
uec#
""73I
l^Kt
^.,T
#i((UN
#Ecu
-x #
7[R<N
"^kE
Vp >7
W&HzP
Y=le
fcZt
QIYC
AGt,G
g L[0
Y2`a=
=U,
%&YOK
oq3h
_c
(F;ZP
%FGHi4
56r"O
K2z /
ByUI1
w$[%
LdQ]
e4D\
BP[r
3zq_
_ZEA
'm6H
3ax79
Rl!q
izWB
*VU<
Ua3DD
W`i(
5Wv1
(iez
jZ!>QI
s'Z
?~_]
X8#CM
^I6h
W 4A
%\ae
J*#3
|[id
EG4m
l*Mbo
l*=y
D$j<s
#P~/
a6<`
#Au]1tD-
s-dw
U=7H'
?y :s]
B}%8
*uP z
hijj
rC t
Edt<
& B1
AMw9
-wpWA-
2vcmst
vAzg1(
g4 U
#] 2
)DD&
3 1|F
\b_h
xo+y3S
g*`L
*1Vu
11
-^G#
4-+BFaX
riEqx
c e>3G
!7dE
jfy\
qZ16B0
tPWR
8c*l
-?F[
J!//X
j<&]
e)p8
f[`VL
m8uA
j3%,e
Hh+*
0fbp#QO
k`Nx
TjYp
kDYC`
=~;(u
H@x?!
a_eN
bvFhy
>rk\
}}(^\
kH$sA
M3E^
E~FI
"fswb
F7]~I
K bX
0r6B
q\;1
#m+%
A6Z2
G \}
%FyQ;
#8%{
v/o9._
9YU
KW~[
8/2t
&WI0
uxvc0'(
BX3u
ufc
r:wQ
9LY2
ZGp
R3oM
I y9
e)]XK
$U$?!
YH>b
OnMouseMove
#Q+c
0X $
ir'h
| '<
p4,U
C=`P
MIMr
qu".K3
HLYM
get_Assembly
\cC*
+t*1
"Q$F!
d[?d
zU
3_K\
Ya)p
2pn#
GHPg
System.Windows.Forms
yN<
4N$V%
(#Jw
j-UQ'q
C2:d
=1i
?0 2%
9/'*
$#sS
e>Wo
{Zy "
q"k`
x1w}
6I3w0fhA'#
ZT=y(
'b6~~5
T7P$
bQ)v
{)<3^
Invoke
F"VN
D7l,~%P
c6K;n
]:Lx
Hpu=
W"CZ+S,
&-?B
jY&\
X<*D
&< m8
IV&"
/qsWG#
IHDR
k[+C
Ax}k
J FD
MXxg
DD@fNe}V
{<5Z
6EFAC0EE8C248566D5441213E5936E72128EE1FF
w_8r
2 /cp
]b\:
.C*Z;_
LNWC
M#- 4
.OYx
`Y>M
0?.m
|z<G
N33cO
Console
%kSo
1J,>b
(Ko'
. 2x
BgRl3
Ss%d5_DHv&
L`y,Q
=5CE
Pg}A
.("{8
tm%u
Vr26
b&>rH
^lwm
w+&3ye
Ci(}=
?sE} x
&H%y
{ eS
_9ih~y
WzxN
(!-l
O[%3
&*8O
}Vc
<Oi
JS'u
T2"u
Kz5yAV
.3Rh
\oEw
b[E.
pz%d
sS5Aw
jSZf
3,\7O/
@^>!
0OdF
VDa,
NniW
5,
D6~
wwVQ
z~d;
1OK\
U\~TC
JPi'G
}K-q
Graphics
Z g0g30~^
&*8v
u]:?
matemdeea.exe
!9?F
~LWx
.T GA
1}bj
v]2~
8onm
.|!T
7+-{
)x Sg
KB=./
#5n
3| r
leh
uMRBw
;"^.6
&*8w
P;%l
|3$1
KUw#
4'!Z[N
yE271
|`e%
&*8x
#^5H
Size
`j7z
m/#I
b N:
BGKi
OverRect
+`K_O
{<BW
)C% >(A
ICKr
VH0wr
|;M%
<'gJ
)/t_
[a2t
T ?p_
c;kd
D>14T/
w;gI;
SN&F
WmYxwx
?&C?
EventArgs
zyDd
W`z*
@\*l
SR<zv
_ y;N
/ h2
5We*
(w}.
LabelEditEventArgs
z7/ZRMM
K Y/
{G[*
pv)|c
-L]+
|x,1uH
z6o~C
CK\c
.w1Y
fpS<
jM6e
"=fz
oI7r<
'bq)
7,5<
Me k\
-8y}
m v7
x`W`
[6JA
zmfc{
Y#CpjG
u3 46
M-Ae
VUnaa
0Z| [ gz
(2ju>
)r{cM
}OI3
@`Jchx
X"~@
%0k#
X"~B
3k, d
(^CQO
pRCA
ABdI|
M=J^
u'mD
Hovering
;"0p
9>`s\
gctr
m~/_
[N
d"YC
RsWi
tP.
v0~}
-i?C&
uv]'
System.Collections
+l6~
V|S
"teL
Qz<G
$A2&}!
Qa3p
/oS&
|*RW
&45p
\?f
GCLSk
@:R1
uIBL
VY8t
HB>Y
(=1.6
9_~2
q@1/TD
+VUf
%'RI
Om
mPV0
bkC,
\71c
Fg<q
ouYG'
"LH9
-L:u
JCaBU
D!B)
"${
!KPY \
&uO]t
7j,/
5>zlY
6x+02
.%vUD
`~O=
D}D1
width
u4SG;L
4BfC
[M Z
NBnO
IHr1ts
mscoree.dll
]\qrx
i8f2D
N}`U
;" Xb
+$J2
CE8aX
F2]8
qHha
dr7
-++.FB
PX.1
X]@G!f
m8^<QB
l] Mb)[
k.K;
{|8z
_DD6A
S|<
!-TZ
FmJ<
]/zF
H\qxB
6g|5OwIG/}
f*GR
PNw
3,r#
0ap|
oLw=58
b+J)
X$NLAN
zYRxb
R@C5o
!H8@
EWLEd
hlI#
h`\"v;
J ~}
rYSC
zXY
Vv9_>L
get_ShowKeyboardCues
M8Zcc
'(o
BTV7#l
]Y5f
IVt2+P
Pv*&
P^)!
a\ ^
[$1tmQu
Au2e
@;Z>j
0E#C
\Tg%
I[i)
N9"
9uSG
OY[L
6YqZ
\awm%
]A Q<
zYN\}
Q7V &
UQ/#_Q
7)/T
V<g{
mUB=
NI@y)
JpvE
%sA{e
x|^
Q-cKT
}Rl~
oBva
`eY3
l?6
*h >49M;
edD_
L y 4
p$E3
!w#uT?
\2+
CY0J_
S.Jo
a;U"X R
Kq^
K[jjyl
-]`B
ALme\h)h
?l&t
s["
>)mn
HV! _
HL#C
~VUx
wMe)
;|*}
+H <G
Uu [
#2,#
HYO[
9M45<
aRQ~
txnh
'2q
8UkvO
8bj)/rw)j
1eZ1
Jg"u W
1-o
=H{eS
klYj
Z#'BV
fgh{
j\Vv
|W0p
6 /8g)
UZ<}7
7ah6
6bOk
tIww
63zYD
2mTl
nwN~
n7uK
JEa^
CEon
+ p$_
; kE
&\Fo
"'a2
AEHY
4~JT
0b7r
HltX,
get_Width
tw] O
Hkc')N
axpSBo
)wm)@
prm,R
:_ap
H(Z>
o2]
_=UY0OT
jtU@#cG
GK;
[yt
h&\/
v%7#H=
0 RF:Lm
$^9x
p N]?
gW^
e%P?N
P^m/
rB/K
:i?C
EKOKI
D]O o
Yl/
GMIC
!'_7i
L;99=
uHm&
Bkz:
1 Zr
>OBd
#2V\
HzHA
`[*6b
_6Th
+uEeZ
lM?~
O hTu
HV u
%W)[Z+
u5*$
S0j3t'
1\T1
e q
8)fK
u>D-A0V
s@~9
t2#D
b"Zb
MM*]
t((>
g^jT
k/@cS
Ql7~,
. 4{@
h@6.
RuntimeCompatibilityAttribute
I-Tsd
item
im9&
=7Y#
$R'
WbY:
PaU
GTH)#;
6`K
HXvc
U) Fe
set_BackColor
Bf.T
E ]0
(C":
>;3a_
@k;t.wh'#
X`Fu
@Cpc
x24$
;BM7
ovB
6B2#
5`o&
A/rs
x)33;
!-RbO*YA
`A5 7
mK`d!
&IJmO
P5km
.;9-\
%m%L
mQ 3-
gDUkJA
9mT@N
tO+U
Qr_8
^&Q_ZSJ
= V"
\u'd
1Ep?
d _TS
RV?i
D:mX
7EKv
dT'
)e%L
=r+g
System.Core
+pPw
{@NL
4OAtR:C
o_&I$
i9~v%YU
yD; =
W,]7
=7B$
j/b3
Ow{m
$LiwG
>"Qp
"M1GH
c6]N
"%d[
Py8O
=TJ#
]Vc)
w^m/
~,a#
IC>q
height
1MVy
A</=
]wfJw
t -b
?1$%
/^wL
zQ|$
o--F
*? WG
Znh
ET +
wPSjj-
2daN(
(o49
|a9+
MK/aU
",Vb<
w $|
iu I
%Vi+|
@#\D
^Q{l
LHD?
G|V}W
ee6V
g+[&K*
NB@5u
T1:w%@M
|S j`{.
Xd .
3JWp,nh9
2+du
fCU&f
N;C^
+yy;
Jp0d7p
Q)F y
T5}&
luv:
0)wB
AssemblyCompanyAttribute
VTL{
qRoW
Ta3p
Dm^:f
/e&1
`\:s
q 4
R.>9
tj'k
atww
fU(u
Bq/}
'S,#?
J5ok+`ax
p1}0
A-M#
{IDAThC
8YIl13
1K;.
|"X>
MethodBase
#Rnn
Ua0p
#Strings
:ivQ
[+zX
/;b;
|Bv]t
'jg+
InitializeArray
697}
=7C$
fjeF
IDeviceContext
)&+w
3@1b
"-O~#0
/hr }
D\T
1Wdl
3* =
]DfS1<U\D
43^tX-
`"B$
4,0<
!8*$oQ}
:af~
System.Linq
]Urb
cJxh
' ~`
lY +
0m_R
Yhv:
GP/{ *
O(s
68Ld
EBI)
}`F%
4(kH
[I)ggm
[JeW
],*Gk
;Y
Z?t B
Char
f@Q"3
SDJBR:d
==%
wcQ4
z4yLg
eAEV
oHr)4
5LpZ
p-GR
1|_;
q]1:G
p(]L
r9i$
]5H@
>H,4W
X]|m8
M6cNxM
),EQ
FJ -t
}2)|
(;|T]i
OrdM3
(i|s
4{T&U
:e U
V7Ib
I?aF
H 4i Z
)Im >q
Eo>au
}me)
+]La
i^{W
GuidAttribute
Vs1~
qbk_
XP\g
C W_
LM8z
w^-h
~8E 4
7y$k
%h l
&ph'
wkN-
'F~ ?O
Rectangle
0e<>
{kTF
#$.QUTz
;`1
!MNX
6Y 8Y
9AH
H#zF
3pMk
Z;gz
]T.'
AssemblyCopyrightAttribute
_r?v
kj+|
Lc _
@tBB
.v3L*8
>_'>
#9jIF#,
NB)f
reoN
=]#9
`4S-Qr
Zg4GW
eG|Jh+5
hAZ<bY2R
Rz'e
AA116D4CEEC324F997842E90883AC815F1858929
[Q4}}
Q-+b
bM74
TM'3yS+j&Z
Fk:y
u0 ? e
sm8R
--;0
HbZ$
@l%X
/AU,G(
\Dhg
h5Pe
bT7b
sY+7.$
<?w X;I
{vb+
| Pq
6WL1
N3VlV~
`~I3
t F
t;% H<
SxAA
FL_LX
)3P e
G]6eP
HK%
51B3
3DNR
l0cg
q!81k
xl`
98-<T[
JHB+:?
_':[
mpG5K4
>@08
Xsfp
)Rd0
}Tc1
AN(Q
,7jo
\_j}L
m{r7!(1
sFVU*
:3,M,{
U"V1
OnCreateControl
]f r<
SV =
7 kb
U3B
IKCc
,U"/D
gQNpOkb
#v}xv~
z4!X>
,F+m
x)Ne
@b('
z?`
IOU@^A/
cTe|
#.3%{3
9Dc
iT0g
a"}&&E
DnLBg
{= #+
`9a`
iLgY
bQd}"
YV|`
NTKB0/
ksN.
.|#<
:z0=
~:D`
v N
,muI
eFI
V-0^
I^c}
UT #:
W"wv
.nR@
!1rWmup'
\Y&>
'/]o=
ZJ .
!wBbj\
dOR#@
= cS
kI}*
V
GW e
}wP<
`Wj"
Nlsj
ZDzg
CY1U
5=d
gHB5
Flj6O
"@|j
b>L#R
NHB46
'kh-
>..-
Izc$
k>2Y
"[36^5
3<kN
QM\Q
->_p
textBounds
Kt=>a*~
VPIR
dFQ
I[1&
"+__
/z K
Ue(C
h#Y E
AK2
{e#a
lS/bl
39D$
yguI
6\{'m
1.K1
%+ `ua^
DTv
;P(VKH
cNWg
XR]R
y'W<
Enumerable
Xh~W
Cf/(
C YP,
AssemblyTitleAttribute
+V0
c-2r@
r5{]T
z*QA
5ra\
Va0p
K|YR
<3b8
sD9ru
G(H
Nh+lCO
Xt7P
L/y|Rr
&)3}
i:V[
UnLpr
4y`f;c]
Yb1eR
F!I%
?g-d
H `^=
$G#3g%
B7kO\
S 7S
Z *"S
c "X
>v U
rS|%
-}7[
> CN
2DN2B
ioW{
^O s
Fky3
[ Y2
"~}R
|u`
QMe+)
X+}os
6w']
NRZJB
5d Nb
%]tP2
Gz
QDqf=NZ
]( 4<
q7#s
85
Gc.@
I:~p
O0h
82z$(
0ct$
_)uu3
|&={!
"E\)
0pXvq
TPmO
"kHKl
2xv1(.e
*9Hd
LHB44
get_CurrentDomain
Data
:?A/
], 4<
yZXVb
/&M$
67{M
oH?to
UA1p
u<Q$
get_FullName
EMHl
G#9Z
F"c
K>\G*
{{#g
,K H<
WkRZ
'1<C
\Rt>ogM
m=q$w
v1CM}
LI0z
s {{
CA/D
RVsm
i;3&
J}<
i(aj
BoundsSpecified
LMo7N
uDJE
r@$m4
8D
,D3r
pHYs
*'%?
Xi@_
p3n$
W6*+
Z-j],Bf
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPADP
get_SelectedIndex
Md+)
&f2Q
>)YD
MR5C2
LLJO
get_Message
)g]=r
mw
t%a]
;$fF
* Q]
0lx-
97Sj6
66<5J
_Z=-
Y2R;
BGvN
Pph+
aF ,
JM^*
`RNP
S,Rb
1KK1
bX6E
MK~
fEor
Wpi:
j,9B
0b8+J
sOn^r)b
$h!m
K u7
ToString
G]=Y
!"JHJl
;r},
;'7}\Khuw
c#Hp
T w
USg`w]
>n[
D%v^
+b [
m>6qSe
T 8U[1
Tor!
TTvI_R
#j>~d!z
R=^Ut
)1*3
{ge:
7#S
DEuC
Z~Z*V
rvm3
w()g3
_L'D
tT8m,
]O31|
-+Kt
-06!W
M{XF_d1
#m}
m|/ZX
Y\*)
J?DCaEs
'l<E
T~'B
b}mSYd
>u LKC
iy$
dq9C4
E\_EK
f2MM
<^n/5
[64s
#' @
w^c]3
#p u"
ZZM-
\WbCG>
2[~{i
r :
EOeU
rPbw2
hkqY
:KC)E
d]X-
W<=ZD
,=*Q$
%OEDH
@.reloc
{U (
/porv
* ~t
ea?o
x|=R
z5!P
'&AZEP
AssemblyProductAttribute
7`xfR
]U8A+
44.&
5?Nh$
v(*
UV4
c8 +
tv<
.ViN#1
g4bW
/ r
q'v
TabSizeMode
@[KDn
B%i0
Z<FN
Y*$N
0vn,
\jq[
47G)
)=Jnu
W^H
!v:P]
IkqB.
1n>
QbT2
WL>
1=Db
T\Kb
2 3|
O"nB
$4vF
0Y 8&
mj4
%>=6
? Rc
W20t
AKN|
TK<6l
VX)n
Trm`
6?XK
e"?+C
QDe"
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX
p!g =
""qY
f%2?b
,P:<
S%/[
$mOO
tOPO
=Ef%
TvMgl
R~f@
l<*5
tbF
|DP?
TB 4
xz1,
#</a
c ea
215+FQ
/8F l
c68o
|}`M4
.ctor
dHIw
~^ s
K<,7
CYaZsP
*fN{
(rv.
g|? 5
c uZ
ID/
3nRy
5iL
;W }~
"Z'.
JL$%`
~wwG=
q{?O
)3!!~y
)^IVI
Tv*9
CjBa
+~ 1F
euv
;]gJ
J|'.
get_Location
FO(_Su
pHN;
TGs f
0h(8
Q(Gy
_>&
S0nn
C[&B
k}*NR6
,34 q
kAmCC
bGQ,
Y 8|
D<r<J
vi\8
rrVn
yKC(
{!yX
3Bjm]
cj:v8&f
add_AssemblyResolve
|Q RU
50H`J^
-laBqM
On\k
MeD^u
V^ WL
Em C
3lb%
C w{
pNGWP
-|By
|KMH
.hoB
E F&
;# Z
TextBounds
k=H
!?:(
{q#
"'g@
dK6R>
s_"?
HL9&
IDAThC
T.I
xv9
Dn i
MTu6
gIOf(v
>cXx'R
S`}m|
1SK_
j O3
1Z]k
DYXO
a$@;
v|:%
?)`S
@aC"
xD83Zl
%} y
)HvHWFg
Wl7w
)|]d==$
TabControl
(;Q
] c?
c>d;]
u/~_
70kc
V<;D
H!Ov(
Bv5
5BVShW
Re+#
U[g
o Y}R
O8I;
~9X)
Yg1^
D%Q[
v,Sws
2 0 R-
r-$u?
'P;]
*HTB[Q
=T>
99$Z
/37
X% hJ`
"m .
48_T?E
TN D
}$`?
QO-bY(
$2iC
i"rY
QzvA`
M'G)
?{R2j
>`z <
; 2/
0l]|
I@9x
FaA;[pc
2I?UT
qY|6?
-hE"
#nzD
H;~N
T5 ;
A5nu#
jR%{x/
RZqC
Zd7q
5. U
Rp6#s
ptwI
,.I<
2CWc
3EAJ
Invalidate
o 1_I
(+i63
&v s
u/ i
mP(d
ACnf
_.$*
lnB[
set_OverIndex
V6Q_
KZ*(
& 1{ )']^
.d\e
RI J
1 q
fGL l
Om3Lt~
| Dj3
b{gn
z?F<W
)@|_
'D{A
AMe+)
bM1k
\.H6
e;,uK
o <4m
TOw-!9
@1 O
L`\z%q
gmm,
OXR*
\X p
CJ*]I
+@ E
kA~9^
^@`
cY^,C
8. U
2.K0
1{Q'
k>b>5
zdEO
@^kL
iC:~
GM@F
RsS'Y
zwfs
F mQ
-Zy~u-
c{#\
)A,fI
{=D;9
M+U~,
&\I1
R8tn
e; OP
l+<w[
t`l?
C5'gk
Y1h#
ugvOL
0HT'
vk{]
#\3:
*CsSc
u]7*
pmeT6y
F1VF
"<J
xdih
e.o,y
"n 2
h^6?j
Foy-
cC k
() 3
[@Zo
1#*;
_'X
b9|m(!
9y8`
X9jRpN
w_O}
(+48
`'gJ
bQ+
e^E-W
`^"l
fhU7
aZR
i!L
Qc:Cu
Tbk+
Fh|ti
~)cg
8s<m
1<c3
,u%~5k
/|=?
R43aHE'FX}
J{;5s
fGwh
c0X(<
System.ComponentModel
{)gc
+x_f
?4yw
R$/O
UFB&P
>Wm>
QX e,tf
k~O[
X |
o2N#M
2gkE,
CqaQ
x+^N
VQ6y
zy1
QOwX
? \9
o<[M
)E[#
X m
X j
ff[,
X i
hV./o
`[^,
r=\+o
Gf)Gg
S KK/1
';zcV
<79!
t P
60UC
gVc'
M:F+}
AssemblyDescriptionAttribute
cBPC
[ySs
:mjZ
y )d
81)8? S
Y|D
_6dj
/`Nb
zgy'
XJVu
MvM<
dTOb {
!-Sb
QY>L
w,Po96
GL M
X :
M=L$-
e^C{
X &
iG@
^D\2F
q7!-
N`buKP
LC,X
;_*
ds;j
/9$Y
#WD[
I0/iL
SZ#'>
0`oP
0e+#
V%MzU
P?PKzK
[r(/
Z_d(
!r;w
gV]Q
'~`_'1
I9b$
RlLq
hg"P'
fT)m
ControlStyles
39FM
,vxd
p+Pm5
F"a
*,qj$
SP> =O
_@::7
yPG`
&&W
7&wQiz
r,y]T
&LV$+
7G"X
d?|Y
9: B`
%.io
om R
BaseRect
E'Pe
1Z1
m;w4i
h ao
_ w&
}2!D
\)KA
|kU E
d&F%
Y6sc
\El3)
\)~p
OMtK
2dx9
vPr'
- f`#4
lawe
(^<-
1*zq
3M!t+
5 4-
(m1U
3 :j
1.K6
twLM7
[6ao>J']
+q IF{
hJrsY
~6e y
>gXLD!
LvzP:
-5`s
"l#'4DI
VE J-
#AZs|
Mq =s\
cba^
'_Pj*
ziS))
)hbp
nJbfnRm
S{V*,
vHB2'/?
4qF{
L "
8rNo
r)1O
Ri'r|}
Y^:x
2i1
7MJd
w@YQ
>npY
96P*
>%o.
by[
u K4v
tww
< $qZ
TopTabControl
MY +
{9 !
]!3'
dNi8
$\:h
qkyd
KQka
;4&@-
2Ms
bnUC
/<K-
J$)3
)5(~N
|e+(
]g"7
1 Jvh
ezpX
&0]!Y7
K,.4
pY >& {
o70s
iG~t
"-<V
?g^\q
v}q!b
b?d;
u4M`coW
/1nK}
=8/m^
1w>O
B n*
C=#7\WDhn
8}_D
?|fo
6;m
pzt]
tOwg
'iGw
JeOs
|V z
Y 8j
z#;Kt1r*Q
M!:)
Sn"'
J&W.
`R
_nIo
<Module>
N wM_
. ;
Type
d[ >l
Y 8]
D=K$7v
+QE|"@ RM0
Dc9 :
9oyE
Color
#U~n
a*Ek
KQ-*d
4q[g
W YB]
<"x>L
^>In9
N8mi
CE# /
-S*E
/8=b
5~qf7
?`+m4P
5d0p
OP?p
_1Kc
"rm<
ga|H
+0 E
tq?}
_=|S
l!+]
3g[@xo6
BSJB
>TOS
zP>*Ta:
m8Rin
Exception
%o,]
CqNi
kH%VP
s$H{J,
`HY!
Vc!3
y[Z2
'&w2
6f5F(
qjtG`
,_U.?^
Yx"~]
RL L
Io9D
x34Y
qxUK
x?Yd
q&6H
~d|L
B_4|Y
~<~J
uWjg
S=_}
[Bey
=wA>Iy
SeparatorPaintEventArgs
Oqj_
N%
0gE?9!
+ }8
>^a'H
N1QU
!%\<
x%qU
$&4`
P$kN
ii4]
5w]P
tNB<
/0F }
_H2R|
W!NJ
yJ- ^
Xah}
(\JQ
P@[J
%L#*
}B47
^xWd
get_Font
}*a~
J?BP
BtRL}
+AR
a@&6
@$n9
!,z|
ZyVb
FH&=
wnw<]r
b= uq
: %q
H:V]
1b80\
l]uu
r3_*'
PY +
QGX{?G
r|8F
kyM9
E&WS
VQzGx].S
c8GO
g;J}
t" }
2aoF
$R#|&gu(
M<3|
%z.h
2*JH0
X!* [
iXmN
1r%1
DRuvJ_
:xzQ\I
W{Fw
U4 l
_"EK
!'Jx
C}V.H
mscorlib
Jc^p
s^1a
$m_h
L2m2
~; Z|B|
hQTC
m)rR
*2%g
3Gm=I
$yQVV
UIc!
oV[mR
SL}n
inh
zS&y
K_b`
y5vQ
_X$Z
5V#\
\O&'
FTta
VT]/
8tmu
Dk/FF
7[]F6W
mTs`
{)o[
YTs.
SQCT
VwV{
[ 8l
f98(
<]GX
3d
"q1 R
pUzX<
~NIV
qW-.K1
.O^26
~8[a
s
Qcc
{ r/
{e"p]u
@\2#
9+&x@
9dW+
2]|P
B)t+
JR~
?q A
^-^|
+Q=UK+d3
O@MV
h^Uy
1d!G
>L&!g6
1FyU
w7C;{
>a8j
KY 8V
(c%8~
yM>8
'O!3
hLFR
>\vGy
wiIX2T
z! "
<9]* 5u
-ZXM
k]0O
Yr
1!R$
mHc_
{%
{W@I
!=<(
%HP4o#z
4ZFq
*|\3
+O&w
E [22
1h6[
QnIO
mN' BPI%ig
OY:9 W
-'u1l
xl1_9
0l&E
5XCSW
hu2F'
2018
'yEk
')H\P
===#
CanI
4%+tB
e@ZP
Ja2z
1uM6
sGxz
/.,
)HVm
F-rv
DFo!s
mmzmoHwA
h o
+{
LK}2
hp3c
1Sy+'T
#FV12
6cK5
)_*{
System.Runtime.CompilerServices
af:Ff
nJ]<W
d7%o
SEs+
$(xg
hP7`n
cd(~jA
]J2T
/dfR
get_FontHeight
g3->
;iQ
C^t(>
.RC'
|2yJ
c$M x#
FgSx
u^Y Id8x
vPFg
!3?R
o)?+
]<#{-\F
0&8S
QP<d
W5az%
`$t+<E
( L%$
G4n(^@
$4q'
S;pE
eHCB
ZsI%qOQ}
%dEo+
{zI_
A Mt
.C(w
]& 3<
#-"v0g
2f,^
4{BN
N5^}
xm D
n;-hX>
Q<y
2QDAg
T8~'
5 'C
;+pXZ
_ $Sw
Ci@d
\P*w
4_*o
pw {
c0GwI7
a8\+
)Roq
!C?O9
`!7
GQ$+2
Iki
]7 Dk0
_,*>
GetTypeFromHandle
hzm2bd
/R)L
Qy +
b6Bk
`=`E
k%]
\U0:pQ
JF)9
i -7=
fZwI
'-1B
8vS'`D
Fg2VU
Oc%
XuE[K_0
|>0p
n<YI
.h M*i
><j
G~`
-'o;
}"Bh^a
|D_g4
C1]h
MLwM=
6$qA
<iJ"
V`~t
ibu
6m/y
=7l|
:4YY{
m,z
x/b!
W_VJ
Vz[Z
xBim
)[k/
Y 1*
pF^%+"
n i2
se92u
#'gA
B/R-
( Sz
q<xO
`1BB
'2[9
m&)n
:)P[#
qaR^Rv
|47
<f5$\
?sL v
"n7i
|?V\$J
B4F0
.leW(
*P\a
m' a
:k)Q
Nh K
~n0
buGebm0
B7([
:rq
wC v
b )q`
"/'qNTv
'Ik,
`QWd
A*\F
R(2D
Im w
( Z
_ yR
wu*7
6!
piXb
-py30
ehg,>h;`
*FSAw
;j6u
=7C$t
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
Xaue
&{dt2n4
.!j
V-Q[
BeDR
Nag8R%v
rSyu
:q)
`f4c
5TiJ
}J@v
>3+)
E`%&
z x{
Q1X=s
L[ei
/\Zo
N%:z
RA&
oJ df
5PE<R
Y7'$
@p~&Y:+
!This program cannot be run in DOS mode. $
,;ur
#Y)MG
Y$b{
Concat
fRy;
h 3
9OXo
wV] ~I
t8nZB=
^C&X
LLX'
n(>L
iwN;
kPQ
B~:6
<XW+
5?Vh
1*};Jmj
d8vR
kE7<
r-R:
uBh{
O2=
[7SJ
~+,UM
"'mM
P;MM
ho{Zo>
f@Jl
mQpK
x@H8
k291
`(\ )aW
;d7}
vsy9
;0n'
VZpG7
?3HD
95B=
@)q3
e A%"Z
]* 2*
o_t/
M k8
ICloneable
-0DT
dIHo
Bjj`
-{l8
_5$k
Y_p&2
B*dY
|7=X
-u5h
Iz_x
l_^nE
\"38
MACF
~&[z
ovoBY
w{$k
70w
;nN]~
r X8
"'aF
Kb/I.
/ipV
!-VJ
:x7R=
x~`z
[|?Yhg
'r.bP
_>_^.k
9~k<
=}C
c"+ C3
cXNz
t* ^1
1kr\
@'eZ
~n`Kfud
9|rR
0E0FA1A62DEEBB1E981471F7A1F5C112CB0A9C65
6X8s
wPCf
VC?H
'|[P
~NHG
K?JaB
,7G#
+]>/
cy?h
iK '
'\U
khQ[,
hn&|2
@8Wr
W8z?D
s.<E
-Rb
H'1,
d ?.
lFgh
TD6N
vn|
:^u?
+<T <
yt4h
56g@
hg@S
Incarcator
w|3w
\KD\\
JWZj#
THh
5a1D
2#pk
ckNiKt(
],!/
h T
6CAE
py b;.
?^}3!EM
mx :
gzuc
U!|C
MeasureText
zo W
NG(3
5?'
miFj
RuntimeFieldHandle
AQt;2
sI~k
HaNw/
K8pr
Ro[NWI
$s;<
=z.h
3SQe
YU K
}2#D
*Shdn
nLtg
OHF)<J
,(Kz
xva
e92B
J @0
X )n
7"Hw
HVP3
1%no
i]EEhd
3dy@2cM
Lc8b
bjI!
X2n1
J3b:]
SkG?
#B?T
%]*"B*
4i `
aO-Q
#=Sf
gR R f
3 ]+3
g/z Si@
te@1
+?y;
%W%Kh
]%p
OVmo
7(cb
zS37
V+Xvf
(\<y
{^k4
`~MB
7dmX
{'x,
IN*z
?QC @
*8]`
OIfP
eX\c
?O7*
Ck'
t?ne
|0'
D1D}:
.$4*
i !=C
mw,BS[I
&dje
LF3!
5=^@
^ 7L
N/sn
8qR |
b,wnL~
Z& ^
T}f6
-"685
??%qT(]
N+0v
<WZq
k FE
P=fZ
x#[[
4TS&"
!3,=J
82 w
VU)v
7^/)
Wo+q~
0C@6b4
InvalidOperationException
W=E#v
ok?_
s>]6
?r?L
j.0<
KHw3@
{ZDk
#w!0
Ot C
H*dDOp
\X+`
0|H+
27Z}
ZkE
qo :
KI-B
U0%Q
6qH
uj"lN
m^hv
6qcV
^JJ]
|o8Y9o4
~`"
LVhN0
$G''XU
^q,%
UrOr
Hsuu
x(J
Q `J=
9J0
K''*
oA
7VxS
P{e6
yI?y
@f4!
g3 J>
^@?C
Wgl,
RHx>
\v.
T86k
#b"O
5$9%
l\t5
tS.c=
wdQSk
H0f6
+HC[
EditorBrowsableState
G?Rrop
B9/
XZ"l
uRZ%
N\`Pc4
".%/
'F|u
[4}Zm
9WPTI
B XwhS
G!]!
*OrV
:5@%o
W\|h
]Fw$
matemdeea
el[9*"
; Ea
?r7.{
=];=
Y{e#
rT]Mh
^dyw
nXr(
. W}
VC0 Y
0xG g
8TdZ
! xQV
K^ ts
ag{e
B $
5W7G:
>^eP
U1|K
-K%
SnL(L
cp0$
U9 ]
t#Hw8
tVc &
/@Fl}
X?B*
^=s/
31Co
!,#XH
hu}C~
jfAa+
r!w80
%wq*&
#Dvv
^iW
q 1.
brp`,
|Ode@}
FDa
a/a]X
}+I|
WD.+
on&[
/:99
qt4+
'IcG6
OnMouseLeave
<$/a
60hJ
T.\WE
Zz,)
;L'
K Y5
D$t`
w^\)?r
fB/Z&
get_TextBounds
W{ovP
g"t]
Lk(
hSNy)6
%N1b
*$p%Lf
f ut
MethodInfo
,7^}a
z&4+R
FZ\t6Pv5
j"Wl
g+&
-:gP
$e2Z
H$b`
j !
get_EntryPoint
|b$U
vSO}
=a\p
4(Kl6
FHb2
EwN
-=dN
myN.
ba5S
M7gjS
>Vw"
ssb+
'!/ynL=y
$0870237a-59f0-44a9-96d7-a91462e1182a
TcZ-~;
`,OE
bfKkZ
Nji=
S9 d
!D F
k8<`c
>0%hv<l
fg5Q
NY5
08g&
9D:n
UIeJM&
dA7F
lq,tQ
~ K
-;C6
}2%dC
+4 E
pZd0
T cZ
DHG47
L =t
bM$t
rHi=
3V gFH
w f;}
Cttk
LHB4(
xMf9
CqOZ&-
\rz7
.XDWj
tZ&
OnControlAdded
D|Z*
9`4
jcQe
K<3V
-9K
e<E"h{q
1p@`n
t/]b0
ZZ|9
z-GlJ-B
W6<
c,\=
7Ss3
'.ioQ
YQ-k
#t:e+
+g&q
%4k`
d-Pq
r {Cb
FE!\
(81/!
l(:zFE
l\/e
JJ 9P
RU9J}
(f2
46*`
k&8z
:2Y5`~\
ta"Gq
57%V
n|\e
Pm {,d5
g,DN
14 X
A2+p
\y6
Sj_
_[5.8
hr+5
TNv8b
)-o)iLU5(
Z9 ?
r{A#
9|o
Iv;Lte
kIAhzG
:-cl
w&P5
<6Y
IEND
cOL:8
'Nj:{W
`q m
bV6v*K
=WY+
%'FY
MM?n:5H
/5F(}
Q80.K^
AAgRC0
O'h{^
.(3i
jy}
uX@0
# S}P
!"z.]
g? X>
}%1u
o.b?
q,FTv
,`=/L
M<gC
H}L
#G7R
s|\?
12$u
;==i
=CYZ
7LhyxG
&+s
:NR?
oZ'<6
x`c~c
U:d6
^0 &
-Kmg~m
N8iv
}h,n
6L1O
hum,xw
R( p]
j9ae
NM5.
^Rg >?u
NP<d
Kmj)
W[pr
l15ks
_",}
DXQ:%
]ng,
X^JR
^W]z
Y) f4
3 4q
e<\~
a7pXi
f]k/
'#Y
JcDX
995C7
L9q1
5iMER;
G\o}
dN{
z MJ
i 8{/
b&]"
oc|@
#nB40^
:}q
s ~a]
]#*R
Ab4H7Jw
M7NH
)DR>
Q!=KuXT
RF$!
)[IE
~fU\Z(
#f(?MaY
TnJk%
G=F
,BYKv
dWPqs
h5?N
_g@E
QYfK
,Cf }
StringBuilder
Q (
>~X
#x_L
OHpt0
!n0N
oPG
Append
+@Z]
b^<+
IoK.,U
TabPageCollection
k!el
BIm
8x+Ck
h~X&A
jP+=
'CjA
? c9}
IConvertible
}20Y
)ibZ
NZe~
O(ms
g&'b
~TQ>
+o$_AW9
Vdn~
:~w>
7Ttp{
)CGQ
v#L^
r5i|
6bq*
`p*
!bGV%]l
\8s
dp" il
iD>w{
#yFv|
,Z?.@
u",E%~
3$|-
]S K
.I
&*!Ad
ONUW
&&f6|
Ht<@.
^ 0
q#Xed
q}jt.
>e /
Qwqj
3,dQP
(.^
){ G
zjL"=
"+R"R
g{NX
I@=0
4HHwwHww
BY8NC
w!G;C]2z
:1-
Jg-J
1:7op;r
\ PV
ZVX<
Q<{t
1*<
v,]U
!E`l
kZKw
'^D2
ox%_SX
\V(u
D^fH
^j!]
{^ 7
]^ B<
AssemblyFileVersionAttribute
61ZS
95b(
[D4`
a~B4$O
,i.x
]q!^YJ
55ui
B)nA6
G8|9
.@H
ii=}4h
67Ww'
/AE7
2Cuk< G
l26E<
1.K"
~Vq
**C7
ofF7
~M94
dqoTm=a%^
Obm
K"jq
/^[?
OU>Y
juTz
zWq1
|.K;v
O$~N
=3;G
ItemWidth
#g(*
WVbi
L3Ji
o6,t
*{?8
]e}TJ
=o c
{2/F
>dmM
3 B,
iH1H
,M)g
uz5,9+8p
XYsI)
L26J
1{z{
UND;
Jl&>
a5'k
CIq
?hZ+
S/Zb{
"'/V
OnPaint
'j%k
711+
0bd
,g" %>
Wo(
1(ag
L]!T
%[j)
b,>t
"qp
u.}ep>/j?
+#g(4DkbQ{r
buY2
0*yV
IJL>
Xm3;-?
, 7I
RL*Q!}g{
T/H
)7 ,
M=f_
h
eaQ<E
<q1{
hL5T
,[EL%
KR}dul
V~
OUfLw;
vI|@
q;F
n+~%
/0F }
*!21
g\\K
,L>
o'-
h;yT
rhm,
M=*I
bD}W@8
O3w
#J1F
Me0*
0"f!~E
mIg-
>?Bn
)r]ua
<M~l
*N;!
%k/7
Byte
EG1-=
QC32
FXgN
#$P[
"5R rq3d+
n,M\
qM3X
"cQ2
v)}~
`m+P
UWp-
n@=Y
scp`
LTZpy
Nqm
r5B>
P)Q5
bd/~
nF= T
J:S/
$EzF
1'.Z
]JSA
1r*U
c:mC|R
a 8
N\-d
MHi 6
\5qEL
DdST
~QgJ?
KExk
@EdQ
,xfG
A[7n
O\@z~g
"jb6[F
g6_xw
of_L+'
_ :D
r?)P
,RyZ
-oc R`)
b2u:
8%U5
_CorExeMain
Y bh
U .zS
sz?(
J)E;
/39=
1D0j
_Pa%
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
1\tjNz
\-:
kG;B
WwU2
%kR/X
cZ7
=|E-
G.zX
Ai`W
7SBn
_@3I
<gpAE
h--T.
7Iz.
J@0B
r] Q
!Cp'
]A/M
w&4e
jpG1pI
^MVX
>J6[$
jgk+
ntH8
(YC{
~%
x39]
L\s7
Heva
ry2h
_yd-Z
V+",[
rHjF
~;kn
9 |1
nEow/B
c0&r
rMH=
UBim
9c[x
w"[.x05
{S"Jg.
}-Fd
u48{
Wa|:b
=rw!3c|
8U.q
uXa'
&w6 .l
ToArray
,cb8
F(u9+
cG"t
}TR"T`3v
}3cR
a#hw
]f 5'
g4
get_Control
)8J]
Qj4Kv
e&&g
Uy-?
N:bD
a K\
Bu Z[
u`l7
:#%))
L|-0
8Af6
V!GB;
LayoutSettings
,81c
.t`x
J6uj
9XdEN
]_^ e#
= W~R
1M6CRT
vR>8
81B X{
get_Hovering
./),
^M.9
\HMr
i:>
PUj4
p5UoF
JL}g
`6!I&
okA@
/K[d
YOaD
|QI~
bS|K*
Dv<3\
&b|^`
$.Ru
ks;<L>
!9.^
,7>%
EL/|
3jLB*
=/S4
|iH87
)H)O
jWuq
Load
Tg!v
Uq:-4
?9n/m
Es 5"
T08
J }U
>XI[R
TH&E
4Zvr/
System.Drawing
}U5l
%kK
wDC/P
*@$<
Q~!l
V\}+
Y\#
y;4v
JSK})c
;#r%
l Z=a
A)PE+
,8?Z8
=\J`
Y86vs
*V#i%
*
P|m
_,u
h @
+G[Wn
X )4
%+a<e
L 4
M%?Ks
+c)0
44*2a
PlZu
,h0C
A9?bbo
,WS%
/\s5
&kl&#l
hndS
RKo#
eD1H
[= Kaj
,j ej
}Wc!
pgf`
.3*Vn$,
\?*+T
Lu2O
w._5$/
;QmU
L/q5=
H"8>
YCST#
0i$v
RYpDa
Fin2d7h
H)9E
{Mr\
<M\'
<T *
S_7
O:+A)
vsd{pS
lX'{.
\{xV
u'LJH'
1/DD
,65~
W!_)O
_uM
^UJ&
h!S
E,ZD
i?]N
<PrivateImplementationDetails>
)[Je
$3deAf
~nT 8
Y^bDY
goa^0
P9;
xW
9:xJ
qIMWv3
?NzN
4`HYw
@2 v
K9n/mR
3"c
1\PI k9.
qNFr
vqVQW
]z&f
e1w9
?_kj
Wg[$}
*e0p
Lq+t
%B{`
t{6c
\IPtqf
7Nl[
#QrS
v>,6
=d4^d K
dCb{p,
4&Tt
\`|{
Tkp:
[j>'9
C:F #
Bf !
f T9
W]o$P
D7&
Object
TpI
*%uX
(SU
h~YD
p',m
j3'w
pT[[B
bQ&{
wQN#M
o4 +6
26&o
yn&
>'*
3E~F
;RNL
!@%97g
ComVisibleAttribute
H9i \
p K@
HR(c
{>J{)
,,U"
1V2Z
XOOD
/_` }
6,Z6g
?q!
]& E
/ 0l
5* d
%gd f
"'e@
_I<i'
-j n
!S: mF
=r-A.
n_6
iv".<P@
=7O$
''/Hn
%&AD~
CtcS.
1,Xz
$eiz
)m'B
.d$`./qf
1qa:
hY?~
qCKPW5
Uot
q'T1
wbXV
}#A
M>o_
qy P
KjLs
B_Lj
^q [
h 7D
+U&5
h }|I
2ex
/0F ]
gXPs6
M,%'
2Ba@H
H )T12
]. U9
v IX
I^g3
AssemblyConfigurationAttribute
)1HVGf
h e7G
^Lhy
.M5q
~({:/x
&`3$
s +EQ
a 3
}JxWJ
et#-R
"II,
fudQ
isW>Z
)<Sg
@_v-
%U^7
A_|{
_ aE`}
nFA[
|Y`y
3?UB
2.L.
Oi]O
}J[y
m1oH
Og)4
"m! }
rQ/U
O+e44
1/rS
!3#K
,uD
Eq_
>x~f
<X+E
9"\\
Sfj/
wP0
S"dK
x$%V
!LiV>$(
Iy@`
Gh
#Ct8o
)QW&
Jj n
D`d{&x
MarshalByRefObject
'UD[^T6
V5Eow(
lpQ@
5$vu
RZ4S/G
JwAsu
75NB
!)Rc
UaRf
jE.u
RightToLeft
<ArG;
PLu~C
sRGB
cRsw
2J,
ywrN
vWMK
cUD.
0W /
X}s<
gc|C
tL%d
rpcsl@
@VQY;a
IComparable
}bZl
{x4[2 ]
E"5k w
HXUt(
e(u)
CreateInstanceAndUnwrap
uPc*h
^p L
V&kXv
CompilationRelaxationsAttribute
oNM58
SgRK
jXpZ
T?v#
#Blob
a.#n>
2jHMu%s
QRR'
EM1r
.* !
V&<R
fR`c
<&p{
w[ pQ
m7fI
~!%Sys
amR_
TK~WP
$PuP
Hg#)
rcBCA
RrU<<U
1`TY
]$IH
^s/5#
$=76
)2[;
/:nI}
5 '
:&,69
Contains
3N<+
Q7}}
Z0Q~
1/K1
)VP&o]
h75u
T"4A
@.Fq
=W['
}VP
|[0p
3R7Yj*7m
g5*b
-|Y%
^IA6
g"q2T
}8cs
(R`>I
'm1
KR"N
;Cj
-O(2
!0JL
_w>
o&dB
1.0.0.0
9s'1#
$}NGi)o
-,22
O Y
h+Y
ViIEjB
?\3A
v E>
7 Ba
`k`6"
4$)>
y*qh
CSF#
Q+ q
90mO
+0F ]'
h?6K,Y
TY% =
RV\4
SetStyle
iTnA
Me )
-F]R
4Y @
usogy
win\L
6~Df
YSa|
cPD4x8<
(}CsDS
yM"-
q_h9
Cdsfssrd
;Kc?
!'g@
/ <]D
&xP|d
0ssO
get_X
TTNz*
,Xxh
UPv)
g7 l6
e Oak
2[se
Kh.k
)99!
?>]K
l(Pn
?U8
.hM=
gvdDv
t`y|++3
-V00
n5]d
{W >
set_Width
_}bt
m<~/
); |&) Y
i$
7q]*W
=; C
k)C
=%k
yL
&i]v
/ R}
MS|q
Q3 78
9~?
12QpR|
MR;8tE
<' =X
U<'4
tm<`]2q
%f\N
Ug%E
get_Graphics
`N5Z
ZUas
.cctor
p*6p
FtU[
M,M'
CkJ,
syAPB
8HuJ
RuntimeTypeHandle
j mF
TU{0
c;=]
Xzy0
` l?
ValueType
3vQ.
iZAk]
B5QU
set_X
c4CX*
a3Tm
EDp1
J1OH
.fvw
kOE//
^*{hs
>Me+)
,C;
Wti zbT7
(m\;
E_h[
}%cH
YX'1
LVRU
Kz m*
n2UP
EbZgF tzH
C01/
-N'a
'vc
[Ve=
n+Nh
K */
b679'
VA92L
KwU5It
F=j=DL
Qj4
ZcZg
/1F }
6m+,
RaY4^
ui86
::u
v,e &
"K`u
}sG
&G'*
?R+q
bnvD
K5KfY=
kfh
OR%as!
qO :'
LVC46
sby
],g8|
gb:jX
2i1z
RZ0D
oM["M w
(K(~`
s3zl
Z0CJ
T~fB
ht#x
R0Ms
-3}T
.iYx
=W-]V
-Y 8Z
sI(x
0$n&l
7xfYPMWw
+e)DS
"R6mb
.0JQ
G 0@
^-T,
mP["
31g3
OSBR
get_OverIndex
=6Q7
Sr F.
$T![
x&V5
U2#D
S$gS
{"w&
R0\\.k
OverIndex
eo7m
}Vc!
cfi<x
"EG~
fU z"
ZY0
{)AJc
y1ams
0uVsJHz
a4|T`
"IHR
[w~!P
g*E
Do8k
~` 8E|
84Du
[qL"
zq]_
fb4u,7
,3d\J
z/J9
S6v2
7Yj3
Q6gS
KGdV
17#e11Q
)VO5
)%'g@
F'J
sc}D
O_vLJ)4
d]oqq
<R%
9^P_f
r# <
m ~g
2TlDK
#_q8
, Lp
Sn0:
\qa
ArgumentNullException
e 5n&
_'-p
MF*fQ`
%HDQR
#+I7DJ
Y /V
jX_U
*::w-
v6eW
Y<hz
CEAx
|bW4
DM4}
p:,H
a7yn
brn
Wb0
d*'
Point
kt.Z6
D+?4'*
}T#4
I~--
^t ~
($$f
?6b^
/xL
eNPGj
z)k
=a"p
@}<_
\4>M?
99u1
AtpE
<8wE
m ~.
;J &
0DL8]
;z>1Mg9
g~OY
ow(Y
Z$~U
`"xm
p]pgs
HE+;DZ`o
rQMZ
4xQ
z=fjCl
2U[)C
HS4U(
Kjm~
wG0*5d
l#_<c
tfJ
}z Z2
@>i{
$QTj*
!7CXM
3v 8
win 4
ISerializable
&*Yx
s."pABHe
A- a
VhQ;
u&-jXb
Copyright
Pkxv
6Y!
mf*+
u u%
'9'v
{g~L
B6Hr
U-#D
:5Z.)
V$vJ
OFh.~
LBjd6
8'M"
^/DR
z/|5
My(Y
Hwx7q
Mw~L
;e!']
?%G=g
xal2
4QP3BR
}W;bI
}#Co
"So<3Z
OV ]3
i;}C@
<H^
XP^j2
I6c5
*:umH
(TKI
SBwaJo
y6I|
w<l/h
_Ub
^(*j4
zY@ E
nO %
Q)MlPU
sX3{
h:kr
sBJa
ZDNfq
+ez1
V a|
TWo^Ae
qzD tM
P7`T_*
~_}+L#l
/z4"
Qsa'
A ER
/%R`
q,}=q
Sp? ^u
[/0F }
t&9 v?~-
^qL+
o2^&
b@<
~dRcjX
IUqj-B
Et9
LlaUl
HZ#>
{yR=;
viO+>
Xn)
0:KA
9rjPG
Rb;~$t
ND#!
[aA(
#D
DZL
5"/o
X,kfy
g.o"k
h?91
:5f
9B6O
get_Count
F`:`H($
Iv-K
^:^
qLwwMw
kutH
y.DP
TC;a
S_'C
<gLc
<zYB
XQTI!J~
"jTP%c
My5z6
AssemblyTrademarkAttribute
d #s
T+4$_m
}VW(GQ3p
sx5;'
vMZK
=My6
bHr46
,5.|
53mu>
5zGn
]&31*.
' 4
Mt+$
System.Runtime.Serialization
""D
KYj&
L 7lx
sh/l
j'a@
^cErK[O
&=)<J
( \y
TextRenderer
_OX(X
i-Tb
5^Mn `
nlG=
[R>4<
/j $
'w&I
IEnumerable
8wzX*
7)/V
)(e$
"a_?z07bU
[!}5
dG?}fh
iNA&
r[*Z
~IDAThC
R>vq
_& L
R"'(Y
T+8M
471+
a}Q{v;~
[0?2
e"]o
d (b
xA M
'LNa
}_){
System.Runtime.InteropServices
-B'3
u -g
"q2k>
S2%Z
Sb{Is
qAu
} ~(
1 H!YRC9K
:+|F
get_Text
0rGy
<z#uP
bJY^
hRk].<
]ZEE
23Yu.o
B.Ue
<:/0tn+>
&o$v
specified
P s!
+qE
i{vS
upYF
3fI!
3_ O$7
..K;
%+jvw
PH(;
BH@x
&W4V
!YOc
\E9-
<.~j3rxQs
ijx-
4,p(
9H04S 3
6DY&8
9sz_
/YFy}
G"K^
Uc#D
mStvG
Cbaw
6l;b
r[ I8
}_'@
y SK
\g2
eLt1q5
qa}9*~J
`cG
@R{A
U0k-
"9!5NE
Q 1
~tp[5~
e@sl`
matemdeea.Initializare
iX'h$
NI
M>!T
mc[P
9&~=
Y kW
get_Y
1\=
]* '
E`6u
gs%b
bov
\MUX
s<-C
wfR]
)1`WK
a*9y
1$f9
gC45$H
Jbr
zJx7
w{ Wd
=%;E2
WRUf
^E/F
?;%4
+D>o2
*kX&
vEgKj
e]px
%2|T
21z5
qoD
6T>U
JLE
z#* %
*rbUp
]> e=
[g%w
d\EUR
llz(
_c %.O
XDm8
4[vB
GRz;
i!fO
Ornh
%b$ I
/_ Lj/
0nZK
HIm
qu[B
VHs/H
set_Font
^JLr
,QBmg;
ThXl
X{}<C
Xz?8
[4p
Nl{5
Nq:2
7'~)^]
nhCe
ZK|R
4K`{
!($Y
e{>!
y%Y
Zjb6nDb
}xc8
F6 !
7ag\
u m}
WDP
0'Ba
K *T
ACE+AV55
}?aH
IE7+
'5`M
GscC?
NT4^bW
?W?C5
qIH'
LZ:$RO
ControlEventArgs
qSU
&O$J
Q8DS
!6A o
MZo)GW
}cs
IkkfU
E;g6
485g,.Vp
xIwC+Z=R
igeQ
0X_P
6|lo
\+?H
Y3R9W
\{@.
J.;
"'`@
<)]i"<<f
~q2Z}
Sq*S`^
H4qR
{X z`
Y yz#
^)*G
bOb?
2av>s
v])
]. TQ
W^9 r
M`+
W ;I
|gJGp
9(A~[
,N3/N
vSsQ
Mnid
8 w\'A
SL+'M
\]UT
?#@{
O4Pi
w_@=]
;+Odv
in_#V
m=zs
~nYb
*N<Wz
h'-9w
nX6J
V'do'.\0
];1K
80j5
^S*
TL}
+:FGgX
;++U
xhP(V~
#'g@
&HD^
MN|Bf
\7gTX
e*.N
o].y
.a&]
sOw
value
Fi 30X
Y; /
z#a?
Kv} fy
KwT|
EditorBrowsableAttribute
6F VS
kJ0
i\+!
SNqx
gQ(m
e{+)
-\N\
6's6
z}EDLHH[
fj`6
flb.
z5;
&{$!
MintSeparator
&;4]
;7v>
VI.p
41>7
29Om
DTDjs
nJ6;
{FE]hD
qo0h
n tp"
Cm?^
(C"J8
Hmny7_l
4`C}
;GZtz
=c&f
ao[8g
*4l<
%B[?
W| Gi
F'"8
w`VQ
JTU?} z
62Jn<
@f-
3,\PO6
n v~cRm
<]'"hl1F.
+_`8x
Q}'b
9,TE
9@E4n
WgX{
}bJ]
Y5QG+
K'vf
U(}#
P!/(
ttv|
E9v$
u$4E
lQi'<
Ll0+
5XB4/ #
SioVc
;KEX
i{Fs
^@-
va v
G978
I_WE
VevMb
EcHL
{IH,#71"
!5p59D
4j#&Y
%Wk9
|).Z
EkQBm
LalU
<Q3i
*OI0
`gH,
Font
G/~
xHXIOW
%r[S!
NM\m
cHgM
eW@=
0z^
?3Y ~
W0HQ1m
unSI
mF4o
2$V
Ep'Z
bNw;
S22.
Fi<5
g R8
HoK
ad0r
0k;
t.v
n?@H
LHR56
Ou 2
ScF~
DU*y/
Y4B^
O %5
Oh|6
]@HLVz(
, X6
VWTpK
!*3
?bBh
8}2_
itC=
#YZ.
a=.J<
hu7>
j ka
!u&A#k
rw8*6
L1i=<
"-}V
tMD)
=)]I[
pJ7d
\[J=
+.>!
e p
CS|X
r<l"
f8G,
5Zw(~)
/KC }
l/-(0#
Kmvk
7C?x
,yWy
;8n~
ALlf
\ KhD
.ZEsv'/
[KI5
.=6QE g
R.l),
:x30
#9-z
ButtonBase
VC7G
UkS[
\ER
&52^
F(8v
8n1au
=y4-
n,jx
P0`zA
mv~t
LFgS
>:W~
a/8l
'*hf
zSL
Xam.A
+ g
IEnumerable`1
@/&)9
MouseEventArgs
z~K3
>/ ^
t#^x
?DQF
%COn
wBL:;
I_Gk
k"M'
: u0D
&$'h
I.CS52
Fb7$
cY|V
KxuQ
HJwH8
lj;$>
G WZ\
2b cF
P:|mF
\KA F
Kc`\*
+C$6`
g0)Fh
:@#V
Ry\W0v
#\O_
\CIqO
:oj%2
}R*I1A
L/qD
cLP
> Gj
:VUE
hmX8
(X&r
>a0]
WB0P
wo#='
|SeX<V
y+JrB
qHy9
u*8i
lFRY
R2vJa
FQh
)m wD
x d.
5%#m
X7@<
get_Size
CO= < < < < < < < < < < < < < < <
(_>1
YN3%
u ['
I Aj
bH<?
|\HkVhJ
T8fDw
MEE[\
r%\U
v2!D
|t~Z5
E
g<.=
) 0@
+W2K
I<E=
DUP>
_?1m
label
.b\>]
*>tw
P;S"
S| A8
aM ,
ResolveEventHandler
n&:]UhD
uV?
>8 3w
ff b
hy2-
esnV
kVXn
MF*fo
Vb!8
&M=D
M +;
_h\O
I[hW
%my~`;
G1R9
5Of
AkWL
337R
s]Kt(
Srj5
=| S+
f;sC
n>gq
NSBut
IYos
1[lE
r\^A
M~-Z
0))`
1T$#N
), 2
G>vF
+ sm
/.K;
7QC~
"K7y
q.X
q9I2q
PUK V
z8m=
}Zc!
N0)<}L
4<gbT
JZSll
,A)M
_9ff
2SVp
IJ .
+eXZ
ZQ t
P=w0
Pt~w
x.6a
/JE"3b
qII]
yff}
}t+
*<3K
WY/d
`Mt-J
Nb0P)
System.Collections.Generic
PhbI6
B!h/
6DF71263AFFB3296BA91B14181DAF02693B8F22E
bS~>
op^%
oz+Ic
du?y
yb$'
>R
meK{
u4UZ
_)PD
||b
o!ob
iz^{*
D12O0
3a3(
|IDAThC
blP_
#i -o
yLk*
n8 )
63TG
%@~j
kPg%6
*}$ cj
OIm}
a1dI
TextFormatFlags
pv\%]
X7n|
MzN\X
], 5<
|?V'
get_TextFormatFlags
"(;
E~n8
%Hw 8
& d]Z
)n2}_d
p<G_
}a89
: ;U
0oo
WriteLine
c{N 0
gnQ\
'~/7
:b2
System.Drawing.Bitmap
}b9nm
" P"
GMTU
Nmzi
]pOg}
Umwd
&7HEP
> Qk
.l?K
*,m9
get_ClientRectangle
a6c
2uu`
Array
[;ca
#GUID
Nozb
e8?Q
hH%>
F7 $7
Mrnq|
WN%?,
xSZN
\4+f
zpQ!
gAMA
=]^#
p "GY
4 3`
Me*
."`:q
&JYX
ttw9
0l3x`
Rm}&B;!
@|-=*H
"~UW<
,b1eWkc-'
A|E6
rK=?]
`:1e
M qa
>(^b
GetTabRect
:[Y6
Wj%l
73w}
+{{\
F%!l;
BVkUb
EI72<
d}B40&
yzmmR
]^3H
]0:p'
w1`i
"UvL<
ZW_|]( +
X T
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven02b_64 Seven02b_64 VirtualBox 2018-02-20 13:19:59 2018-02-20 13:22:49 170

8 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven02b_64 Seven02b_64 VirtualBox 2018-02-20 13:19:59 2018-02-20 13:22:49 170

10 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\cmy.exe.config
C:\Users\Seven01\AppData\Local\Temp\cmy.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\cmy.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Users\Seven01\AppData\Local\Temp\cmy.config
C:\Users\Seven01\AppData\Local\Temp\cmy.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.INI
C:\Windows\Globalization\it-it.nlp
C:\Users\Seven01\AppData\Local\Temp\cmy.exe:Zone.Identifier
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Users\Seven01\AppData\Local\Temp\it-IT\matemdeea.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\matemdeea.resources\matemdeea.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\matemdeea.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\matemdeea.resources\matemdeea.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it.nlp
C:\Users\Seven01\AppData\Local\Temp\it\matemdeea.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\matemdeea.resources\matemdeea.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\matemdeea.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\matemdeea.resources\matemdeea.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Local\Temp\shell32.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe
\??\MountPointManager
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2540.19248937
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2540.19248937
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2540.19248984
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe.Local\
C:\Users\Seven01\AppData\Roaming
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows
C:\Users\Seven01\AppData\Roaming\Microsoft
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.INI
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\matemdeea.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\matemdeea.resources\matemdeea.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\matemdeea.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\matemdeea.resources\matemdeea.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\matemdeea.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\matemdeea.resources\matemdeea.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\matemdeea.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\matemdeea.resources\matemdeea.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\shell32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2816.19252968
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2816.19252968
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2816.19252968

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\cmy.exe.config
C:\Users\Seven01\AppData\Local\Temp\cmy.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll

Write Files

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe

Delete Files

C:\Users\Seven01\AppData\Local\Temp\cmy.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2540.19248937
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2540.19248937
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2540.19248984
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe:Zone.Identifier
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2816.19252968
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2816.19252968
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2816.19252968

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmy.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\410fe546\7307cd04
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.5.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1e5833dd\40ef5613
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|cmy.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|cmy.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|cmy.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1e5833dd\10592a67
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Namespaces
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\index
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\index.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|index.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|index.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|index.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\index
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Write Keys

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\index

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
kernel32.dll.QueryActCtxW
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
kernel32.dll.GetFullPathNameW
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.GetUserDefaultUILanguage
kernel32.dll.DeleteFileW
kernel32.dll.CloseHandle
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
kernel32.dll.GetCurrentProcess
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
kernel32.dll.WerRegisterMemoryBlock
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipGetImageEncodersSize
kernel32.dll.LocalAlloc
gdiplus.dll.GdipGetImageEncoders
kernel32.dll.RtlMoveMemory
kernel32.dll.LocalFree
gdiplus.dll.GdipSaveImageToStream
oleaut32.dll.#8
oleaut32.dll.#9
oleaut32.dll.#10
gdiplus.dll.GdipCreateBitmapFromStream
gdiplus.dll.GdipBitmapLockBits
gdiplus.dll.GdipBitmapUnlockBits
shfolder.dll.SHGetFolderPathW
kernel32.dll.CopyFileW
kernel32.dll.SwitchToThread
shell32.dll.ShellExecuteEx
shell32.dll.ShellExecuteExW
setupapi.dll.CM_Get_Device_Interface_List_Size_ExW
setupapi.dll.CM_Get_Device_Interface_List_ExW
comctl32.dll.#386
ole32.dll.CoUninitialize
ole32.dll.CoRevokeInitializeSpy
comctl32.dll.#388
oleaut32.dll.#500
advapi32.dll.RegSetValueExW
kernel32.dll.DeleteAtom
comctl32.dll.#321
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
advapi32.dll.EventUnregister
gdiplus.dll.GdipDisposeImage
kernel32.dll.GetProcAddress
kernel32.dll.CreateProcessW
ntdll.dll.NtAlertResumeThread
ntdll.dll.NtGetContextThread
ntdll.dll.NtReadVirtualMemory
ntdll.dll.NtSetContextThread
ntdll.dll.NtWriteVirtualMemory
kernel32.dll.VirtualAllocEx
kernel32.dll.VirtualFreeEx
kernel32.dll.VirtualProtectEx
kernel32.dll.Wow64GetThreadContext
kernel32.dll.Wow64SetThreadContext
ntdll.dll.ZwUnmapViewOfSection

Execute Commands

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe 
"C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\index.exe"

Started Services

Nothing to display

Created Services

Nothing to display

#infosec #automation

TheSystem Itself @ 2018-02-20 13:21:23

Detected family: #Malicious

TheSystem Itself @ 2018-02-20 13:40:02