MalScore
100/100
MalFamily
Ispy

Tilatii111_signed.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 26/66 Related 2805
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 1267.05 KB (1297456 bytes)
Compile time: 2017-06-25 07:13:48
MD5: f9f74f590dca8b2970d55e694f142ee1
SHA1: 61f29656b285727ea3b157a5b83472a11e121ee4
SHA256: 63e04cea063d47824e73bedd87afc147873dcababb20cf930414d688dbf02c6c
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 4 import resource relocation security
First submission: 2018-04-07 19:24:15
Last submission: 2018-04-07 19:24:15
Filename detected: - Tilatii111_signed.exe (1)
URL file hosting
hXXp://sarana-sukses.com/today/Tilatii111_signed.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-04-05 20:46:12 [26/66] VirusTotal
PE Sections 2 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0xc0324 787456 272766f24c10716527f7c440ae7ae367 06ced6a803237857247a8dfc5f5211613a2e07c9
.rsrc 0xc4000 0x3e25a 254976 ce786c62747f0cfb0eb2036c7c89d676 877252b9108fdd68c4fc749990d8dd95ce4be16e
.reloc 0x104000 0xc 512 5424a8ed99fdad230f27561589c5705e 69201a03e9c6ef0ae53ccb54a0ad2e4d01e04af6
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x101b74 1128 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x101fdc 146 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_MANIFEST 0x102070 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
No Meta found in this file
XOR
No XOR informations found in this file.
Signature
MD5: 6de22fe301898c69a346600743e7307b
SHA1: b3648052ab170076cff607cd8d4212d87f95c0e6
Block Size: 254000
Virtual Address: 1043456
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Library
mscoree.dll
IP Found
No IP detected
URL(s)
http://s.symcb.com/universal-root.crl0
http://ocsp.verisign.com0
https://www.verisign.com/rpa
https://www.verisign.com/rpa0
http://s1.symcb.com/pca3-g5.crl0
http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
http://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0
https://d.symcb.com/cps0%
http://sv.symcb.com/sv.crl0a
http://s.symcd.com06
http://crl.verisign.com/pca3-g5.crl04
http://www.symauth.com/cps0(
http://ts-ocsp.ws.symantec.com0;
https://d.symcb.com/rpa0@
https://d.symcb.com/rpa0
https://www.verisign.com/cps0
http://sv.symcb.com/sv.crt0
http://crl.thawte.com/ThawteTimestampingCA.crl0
http://sv.symcd.com0&
http://sf.symcb.com/sf.crl0a
http://s2.symcb.com0
http://ocsp.thawte.com0
https://d.symcb.com/rpa0.
http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
http://www.symauth.com/rpa00
http://sf.symcb.com/sf.crt0
http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
http://logo.verisign.com/vslogo.gif04
http://sf.symcd.com0&
http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<
http://ts-ocsp.ws.symantec.com07
a1fd4fdb-2b3b-6919
a1fd4fdb-2b3b-6918
a1fd4fdb-2b3b-6911
a1fd4fdb-2b3b-6910
a1fd4fdb-2b3b-6913
a1fd4fdb-2b3b-6912
a1fd4fdb-2b3b-6915
a1fd4fdb-2b3b-6914
a1fd4fdb-2b3b-6917
a1fd4fdb-2b3b-6916
^7rHZ`&kDkbHfH$vh
"```H
a680dcac-fca3-4da6-a386-d5df7bdcb70d
,U-
#U$U%!&U'U(
IDI_VIRTUALBOX
1U2y3
3959703c-86aa-b1
/!0
a1fd4fdb-2b3b-6920
a1fd4fdb-2b3b-6921
a1fd4fdb-2b3b-6922
U %!U"
a1fd4fdb-2b3b-699
a1fd4fdb-2b3b-698
a1fd4fdb-2b3b-691
a1fd4fdb-2b3b-690
a1fd4fdb-2b3b-693
a1fd4fdb-2b3b-692
a1fd4fdb-2b3b-695
a1fd4fdb-2b3b-694
a1fd4fdb-2b3b-697
a1fd4fdb-2b3b-696
*U+
D;"Dw
=s`\0
set_GenerationEnvironment
_LDi
4TUj
H{S$ O2
&1x:
">mV~
3A:A
;;2=;.
-SeS
DZ'u
U)xfy 6&
?&Pg
PNG
`c|9
dXr>Jk_
@9$,
/H{=
>e}=v6P
\wE/
z5>9
}pElc
jP>k
69T3;\
9M-`
&`BXX $
]!LJ
!,5f
6l
http://www.symauth.com/cps0(
ToStringWithCulture
n%4tb 5G
ResolveEventHandler
=$/
za'~*
UUAk
J8XY6\
pl)w
`, X"
s%#g
:> Ocj
$uGr
A; ;N|
>Hbq
fv7L
k+<>
a3!H
&[8N
_E)
vJFm?n
tYHV
$RC&
+=uJ
3M1r
pm=I
BL n
,N1Cx
4Vv8
5cX[
nb[3
, |xg
g1 )
'$vh
6RQI?
C}.t
*jSaj
$4O<
)pku
:T(g
G`Ul
[j^#x
> a7
n^iq
MK80
k}pL
I7A*
,etdH
HN6/
P +|
f(X##
%'3#w
k\6:
yoDC
p %&
W,}p
bHzo_
w #g|<
*]la
R1UiR
i(8r$
[F5 %,
hA&C=
mu_P*[
tCh4;
Rf<!
6rf:&h
^Y3#
~nJj
`O()
$z0\
*T/:5zBq
9pxM3
3-tD+
H#IBg
Kb ?
_(+8
O<w,
J0f&
$oa;$
kAT/mf
`{vG)
oIDAThC
.http://crl.thawte.com/ThawteTimestampingCA.crl0
?"s7
*uxQk
FY 8
76xgj
F5_$lj
&Wwp&
75gO
f`*!
6`&&#EK
|2Z0D
[0G2
i h|
c8[gH
gij\
EnableVisualStyles
Px9A
`Z
p` |*
fT'dE
=~_g
(fSi`:|
3fg?
esaqp
4Lb1
b3rpr*
SO?VU
http://s1.symcb.com/pca3-g5.crl0
$Ho@I
kF6i
ABAX
Q>`
;0wx
Rc (D
`) W
RU7/
z}ni
S&p-
09p7
2j79
_|mT
T+G4/
!t^U
7h?hg
C>"R
a]2X
X3Y
>%M>
O~[E'
5<}u
+}e
/cO wJx
W||U
roV&
j<*Z
mZ q
Wc gR
^g-#
LR$t\
!+t@I[
0Hhz<
!W|Q%
m,ub
Nyu]
v(\ T
W?E)B
@@[U
Mdqn
dxQ@
,e>\`
R1>
100208000000Z
hm:@
-)j1
9=K1
xH1 &
^oHn
,?%d
{ H3
$Z{o
\gPYa
F| #r
0@j :-
*sKhy;E
LvCUj
]p:C
3m9
>$$P
} E:
BYBwA
i]Y
mInI
`80#
{3zo2NJ
q&<0
S+c75!
EIOr
K<Wo.
ITYG}
@.j"
? t]3d
o'n[
[C
2,;[hLG
>Ym
tMJl
\uF,
xse4
b {*
~a,8&
/[}E=
R@{!*
O@qa_
n.!`
PCs :8=
SrHg
tju[
message
VeLk!
q<*[
AC5^_&
System.Text
+_UP
0BcA
Dhttp://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0
dGfL
0[uF
k(Y`
pNC]C
lw@E*
!T'E
Q^v_
GFe\
}GZK
"8?~
HSYt
lIzJ
P+[
db[
:&c)xH
1pfO
(-=n
Char
)WnYm}
4mfo
9MCI>
Ef9;
2PQ7
>R-P
UC~ N\
$X)\
@%i@z
2`<1H
Z ]+
-:.eL
L-,)` \
vMqO#
l|:dm
9--'N
fQ1/
| HU
x(q}
H$3?
I8 g>4
OjF
721o
0|.a,Ul
:kE`
l{hE
[lpd
XU3h
dRG2
btB.
n0fYL
r][f
G#C
\'(cX
FDdN
~.D<!C
g|x~
E)_B
<CXe
]V$L
Z)0h h
8|9W
-toD
3AJa
[ Y2"
kdOyk
kRXjb
69=Zu
YSd=
EvxIF
H[2
H_Zb?
QjYE
cdD
%y{R
,[k
1";\m
{UH.
5;BrZl!
Qm|=
C8::
]kd{
HgaL
.text
:t ;
on!~
JEoA
G,ja
z$V;
:mmG(
GetObject
YjJ f
)oC/G
q Ma
pc_,
*fgv
\4A5cg
>Vm
&!zu
PDWD<
32c\<
`\g$
d W`
c 9D
e<vH
pqi9
AQ?{
W,;"
5(&$
cu&8
La .
Peg!
D0Vd0U
<O2d1
1ba#-&
` ,`(?
*/y&
161214000000Z
4.f{;
?"5<
[F\N
X~I
;smG_
[F\F
oV1.
CQ.pP
5 Zz
n!%;N
bW){*
{r+mu
l+6'/7A
n! 0
; Mf
>k+H
KcW6*
l.rB
u@$
9tm~
sayE
pn!g=p
kRQ#8
~G ]
/?Nb
9vHh
W//D
Yw?b{
oSi$
Me(t
wo]v
4Vcoq
6gnZ
WV`O
75!v
;j0d
S8^%
yEU
aTgL
$6cL
tgg {
jKn"g[G
{*hy
DuA5RG
(x4!+
zWz,
$n\W
,2eO
2dm3$A
nD%)*
%zkzs
jf0J
#A-
:e/E
O8XY
Rnf|
IFormatProvider
~Z R=
3rrBI
8Pl
6>M;K E?
B4h>
79z7:g
0-y&
1o\6
XY)D
kg@A
m Rr
z0L
0NkOT
:~P(-
wg]7
i~$&
5q%3W
T,fa
z<{N
~iM(
S;@b
/_Dd
O1^
t'w^T
L]M7
^m@8
}A,
P5A&
_Q+#
,;4S
6~eF
f4N3
BSB&
7+y^l4
{OlYI
,twQ
e}x N
Fyx
TX*3
:Od92^b
=@;v
-#D%y
1'[
PaC&Sf
et9`4
}Pm7
o$ h
@E%:
sFc?
wIm:E
LRVJk
h9dAS
<OC\
RuntimeTextTemplate1Base
Dn6Ir
6a4R
]h!
;Ibt
%A\r
.vKL
<hn]
Xa:?
3 I~
$4;8g0
}F;^wu
j'R~s?
280401235959Z0
J P
OTZ=7z
6^ZH
Qm4I
EoZ!
}Nxq
w`j
]WA
b$qp
=\P$
4"J
XD1I
jl-0_
vq<Q
fRc
`l7`t
y@h!
Bw[
A>5
,Zqf
[%U;
e]~\l@b
Ov<e
u.S^
gsE(
R*u
<*:W
KM?A
C PK
~#~d
Icon
^xo
})w=
]YYIt
Cz;g
mms%
5M"aE$8
@zjY4,
,7z^,
8pl&
W0zh
2AG;c
:3w2
^gv6@
`:I5#bZ
kC$j Tn
_Y)1y
get_Assembly
format
-v;t
iXMZ
J 6)
get_Session
P(FX
| d
>TMhO
7CT0
x_x (
F%q2
z)){
8hSfU
(,i5
RJ:;;
6 <z
"0 0
gg!U
:u*A
\",
._od 5i
Z;"R
2LXB'
7[g0
6Bz,
,-F_
yh@
$O/y
]a>
te ?j
S8^Pd/VZ
r39b
b2*
Vb$u
+yDD
A\tZ2y r
p5L{r
HKd.
sqOv6
RTlM
)8oz
JqZ
DD;
U7s6N
Kan3y
jI![\
t,|b*
y\O}
SO9w
^D'd[
Q)J ])K
/9*V
9VN]
{^I{
&;"D|
g,xg
rT=C}X
'Pe&
CONm
$~w%d hN
&CuT6
v+&"~
kq^h
%ScK
$P6O
9Cm4
6GT%
IHDR
SX]]
fHp ?
.#&
$O 2!~
u>.P
o >Gl
m'?fj
"yU=
<CG@
K>6&
qZ\-
aK_g;o4
*&?
-1hj
49sa
'vSp
'ngS
,&c3
DK i
;BUrn8
Ux62h
e c*
mK~4
bLI^
.E%:1C
$,cm
}T!7
_mhi
__^
=O=r
XlZl/^
A4}wu
3hk"
dO$W\2
Application
Y8P
Z4 1
h$[C
i2.g
D aA)| bb)k1^^
^gF1
bs<U vo
\71Q
h0\{
V?0bl
8eLY:
wy5w==
v~NPe
x'p!h$
:Ef5
K0n[
}.Efm
9e!;F
YzgI
9SLz
P<HT
V%PP
M n`
]Md!
R{"~K
MethodBase
%z;2ea
3cGZ7g?
OuD
[.K
}Ajl
.Mz]
p/,Xn
s*~O
^u5,
so"+bn
>bM5(
1 >5
Z]tWDPF
Yc FL
=M )
S)T<
g 1\
.yds,<
Oz?H
Q1,)e
*8f0
!1YU
hN"v
=&"6
1.g6
BeginInit
y1zW
G@Jqn:
aw\G
FWt!
XV"y
>ZO0
xd %tT
'QN}
ZN4~K$
CEQ2
uLc[V
dXr}N
X"9a
mQor
wn*P$
O~4d?
r`ts
mkE<
IDAThC
l^Hh
!=.Z
nBU
k{:~
n3,V
d0WG
vIn^
-n_%
7PIH
OYyF
PDIx
L4V]&
GObY
+@ E
/l `
;tAb2
6U20{
"R"z
mSc<
=$kX
eGH0Qy
1hWX
+f&[L
uJ[|C
c<ca!
u;/X(*
.!u[
%f/YO
T $SJ
l?q+H
|Qqy^2
Dk^B_
t19>T
dF D/@G
5F%n
R$My[n
/OXS}
2W3p
zcpf
imD o
f"v:
)"kL
<b
ni:&&
C|Iu"
_CorExeMain
^!~m
`Cp
,;% Y6~
5#[E
(AQ]
]\,Ksq
.O167
}Ywk
{0@W
ContainsKey
( []
Sp^
H)kL
Y'Gh
y}(R
X"|^$
5"a6
h- +
/+7s
z@pS
|_TF
gw4'
usI!
*@zO
I#iC
J@.|\w
Eu6J
`.D
&~7Y+
3hST
_Tmq
8 qY
lFg#!
l)"M
@6k8
DTp@
B6}2t
Ox>4
%opn
9>m:
fF23
n<j~qq
)H&c_
SN71
(@X:9[
5 Tp
D&q9
7_?,RlU
PAz)
Gh A-
s/f] 7
%4DT
l^6p
km4t
hC6p
lKER
_-!8
G!2>
e J8Y1\#
8V-r
G?an+
fnu_
[Q_H`
iWh*r
8} g
3F3E
eX;_lM.
5."0+
d.' O
n_4$J
-])_6
M;3:{
ikXh
Ix6l&W
4[Y9
$#2C
}M$Qu ZY<CHVB
JvPSK0m
uSg~eDZcH
)<-z2
~ &.
9D?:
)H4
\bsa|L^
LmG
0pb3
ymbg
Y[mT
'SkzHo
http://s.symcd.com06
84Oj
SlmE]
Z*(@5!r
Se|O$
dR}T
|J/|
r$is
A}R~@
*$-?
bB'p
9#6Y
"D|)qUU
&vG?
-Vuo)
E%4E
kyX4
T=}X
*_+.
0]-)
i6!"
_mf15
ZXv9 N#mH
Pay
z3]!
~5Ij
ZZ4yn
oE'u
w,YS
Hy6(
]Au6
; d $#
*X@H
Byte
0|!AF i
0BBx
A$3w
hQ co
3:$G
u|:Z
sU{>D
<K-
S(5;
C{c5
~HZx>
1!$#
t,Q5
Otez
WOzrj
{=F#=
%QG
$ha"T
Ku}hD
~!(+
^KD&
vXA
cvR
PtA)
,eG
tW.j
GenerationEnvironment
DOxB
]ZOk
_9U5
+LPz
0w8
X7-j
Q\*i0
;3fB
m>wy
B}SH
w0h/
r92[
>w%0
KtR0
atqwq
Rfgj~
omy?a
klX`
S8YU.
BK0z
B?^
bVp'
524k V/H
sAm);6
4a;g_
mxX5]
aH 0
get_Count
hG y
`/l[A4
Format
\MY:!$
&}N[<
%Microsoft.VisualStudio.TextTemplating
Z(%4
j.Y
A}z:)$
E6vh
{u6?J
Thawte1
f~wX"
A~3^
$S?D
At3Sq
T1GF?
6<,o
A:_ Ui
pl{
7Zdpm
dY<K ]
LV>bP
X2U+
ei7rb
Qn 8
fk]n
y`mR
Ue_i
9Q|:|}f
^!]A
`UnT
%(6 o
t.5V?
TDG@
Lda
6(gc
ICustomAttributeProvider
5,iDn
]WjUY
YE;(
bW,4|
NYv.
<IGef
{|/Tm1
Tu&^
J/P~
<XfXK
rT410yP
(jy_
t3 p
\{bp
H",8
HK%k
Y2wo
f* 9
s:bH
h$8.RT
7 P
w_7
C@*q
R=6*
E3uf^x
=\I-k
*}t0{yl
'?cz
deX5
O/>xN
SFOZk
p;BO
xj.8
%*,(
hwhL
M>zvb)
>FH{
nR9ET&
-^/8
U_Wr
rk-
GetData
_*\s
cbo))x
Qgi0$9
{+?p
Y"a&}P3
bE{M^
F Bw
v2 (i
j <b
yZ<5
k%av2 wn
P=[NT
}UD&
)0'0%
)terGj
SettingsBase
z"dM3
IGf@
eZf\d
W[Z8Q|_
^ 3J:kzZ
~yg&
:"O,
FZ@$
:3=V
ihO
9A}y
6 L}
g.'\
)"Vpo
M6IH
UP&Sop
p91d
MP 6
4e'h
?6\?
(6qY
{&GO
b7S
tk=^
Jm{^~
jOGYzm
c>N2
C*c~=
Km#
XqqT
aruv
4<sKw
?Dj0_1
H~2F _)/~
O$%}?
r*Dd
UEPoK
m,vV/
P@Yi
9.BX
[#jO
6 ;n
ueRe
hdZ/
{CZY;
37Vn\
dS.s
nhUlJ
#4HJ
+%9l
CcjRK
L8Q3F
ST$0
lE.)Xn
F/X)
v<1p#
Jr3xW
9eY:
Lp@l
am7>
l^}@
a '2
fy!TK
jRkGJN
s9s
`TN
k[GU
nbQO&L*
8J&mG
[p7q
h%m/O(
+s-qI
E|N#z
d!P,
F 5z
zN1l
_LU d
k;?/p
|Zh@
sD<2?
(+Vo
4YJa
8^T2=l
Uf@%$
]Oy<%;|
h `
UB9P
KJI$
aI)8
Array
N`5>
(!x^
oCMpKN
#=ls
4LCV
{6TK
jqHf
$y!3
c>a )
*Ani
A-U]
a0t>
Q#bN3
D@^O
E 3#i
l= Gnj
i-LX>
eU,,
h>QP
n]'R
xAA[
y)/
o+-
TOVKeQ$ K
O}Ut
K^x7
wmI\v
z8,J
{\pk
:(w[
i9qX
/a#k
a EP
D:8m
R 8Hb
hf@``il
p]@^
RJ4]c`(
$t7J
6V(C
?^bP
sn"(
hLHX
#EJU
x%;-
Z);P
6 ~'9AoAd
EGry
39x
aa#"
Ojz" @%q
C%FW
K^-D@
Lc]C
d`uk
bl)>
System.Drawing
\t *
OH?"_
xH6 p
a#*
z[bB
dA0t
/(B
( y
<+K#a
<xv{
?32G
P]j+[H
lO3&
]1
^S&}~y
"j +
>XFG
O IA
__c:HH
X;,u
Z=z]
Mj?=
gI&L
M 0n
http://sv.symcb.com/sv.crl0a
-jyF
5S. |
D(Sl
r'41
$V|p
YG{Z
sY W%
#Otz
;hA2L
RuntimeCompatibilityAttribute
STGV
*W#-y
8JRL
x@3
!4-k
'a xJ
+?Q_
t-iZ
OXI7
;?pc
w!* %q
f4%S
^o8!
?.xtUpU
kcDXI
YC%1o
^3;?
aXsHS
E&d{7
J_AZ5a
c!w"
R+Z)
<@W
U\<4
VDOB
f[ 9_
<kkl7
L*II
set_Text
{xS<
aY@,
_+r2
=)%U
dheS
[81(
{>F'r5
+8w1'
D*38B
luf#
n ;w
vg 2
:4zf
Size
tD.Wj
i+tE}7
http://ocsp.verisign.com0
/q>&l
A;F
e!v]
A+i
I##u
s+_
673t
\@W\
dA[
88SMNT>
1"CG
{ QB
5~pA$
5E{#Z;m
gO \
^6,<v
;7`R
09Qx
C3mI
M,"H
IContainer
rIDAThC
Clear
"/D(K
Lg(O\\
- Ld
f7Z"
c'sn
I]0MI* d
x|":
Q&6{C
i/b9
Vh |
\&E@
Wy;pb
<y&6
SIC
JX d
w+):
xVF
G9] z
xlBn
X&b>
&/r/
4JRJ
T-><\
,)=aa
`!(`!
-pJB
3z|F
gA829w
)_S`
qQu|
|U(F
*Tr
; Y
>,hU
uJ#g
#Blob
2NY@
z Y H&
m Yj"%<
'!k]
MKi
E; B
_p8vr
c_|YV
.i.J
zk+Ff
Z)9~n
S`}B
5/` w
ResourceManager
K5+h
>z28
GetExecutingAssembly
0~"y_`
u(K
`y/]
$Qt;
'ZI0
Ft_'\
tAS6
m?*0%S
A]Ny
v 36'
~\J$
SHFy
A5FDaoiFC
h\:U
Csm
XFO0
&&jX
s +!b
9> P|
c)Jz
jzBxU
A#:{ks
r9U'
~ px[
~QvN
h,|u
p3Zn
E<!T
} Osi$vV
r(,<
hgJ=
.>S?
>cRH
J:rT
zesy
\"=?
JWg}
0e/G
RD G
z==p
.` H
6<"1
)4it3
%\w/
O9N0
@zkkB
/7OH
v2LB
B30wx
v,#bDu
(3(
:hbc
@Sc0
qOBx
<jpE
nHWb6
.9j
Sbv}T
DEcX
bLE:
Ne(a^
71 8
Fl#3
N bl
\zU{-
VeriSignMPKI-2-80
[afN
&]O0
2 ,36X
UaT~
p" {
S1 o
[}XB7
:O{~
PP>-
{+=(
vC<!
bM2A qh
+&N-,
c.`Y
qi
Ez <
fOSc
ZV.;
b0\S
Q| `
9sf{l L
}H&M
Iv.m[
8$NZ
^FM)'$
qi-
ZoV`
[X7-
SlD[
i#}t
rsi
Close
tQMoNN
Mwv|
16oz
ky'V
>Tg>*
tIDAThC
|>ww/)
Oracle Corporation0
\nQ4 e
7+$z
xXZO
+BdT
u\!d
xL9K]fG*
9$)xr.
/x<I
K))W,
9Gwl
Read
^DAI
50301
>V*`
,vb7
hx$|tJ
5}q2
#T0d
ucm7
]Iq.Q-V
?O&xLp8
C:d3
CaxWA
!b\
p{Hi^
wb0CM
acsN
y="r
0Vc
zg8Uj
jXhk
FT_X
U_^gv
32]6
"_]w
C\2q/
Z{b:P
J'a4
6z%,
dx U
oZ4e
yE9i
2IUb
M OlX
_}WZL Y~
L-Zz
yvp0
1H H
weXI
Ek2X
VR#Nk_Y
BR,G"
j6S*
-b*%+
3{<d8
Bc M4Id
za2G{
r1<?K
2HZg
mLb
s |<
G@q_
99e',
1"Yg!l/
BuP>
PjNG
uD }lY
|6Jh
# N+
1_aE
~8XW{_
7xRY
f`KAs
.;gN
i^xw*
q|"%a
grh,
LO"
, YKF
$\QMB]O
j^~v
ControlCollection
M+kD
c=3X
`x'<
G'_
r@~
|v6j
UPdw
K`TH
h|X2
nJiq
fL8(]
T/Ou
7F F
&nlNBv
z9/[K
X3"e5
0( D
+5NbS
=@"<
tnQ2x
0PJ.
C5]J
RuntimeTypeHandle
m'
xCRF
I HI
b,Vb
H!\[@
4.F K+
^ `(
3e/P?u
q>+<%
{1 Z
mB*d
mG;c
"yMP
yBGk
}y0h
BEmF|MsT c
V3o
*|J
iYSF` A
ODKcm
}y W
*Xkv
A]kj
T*6g
BZEw
- Nl
C0NG5
!}dw
~;d{
9 :9/
SuU`M
4u!
t/!'}
AE5`e
iq0"\
sZ'C<
SE"9)cEc
;:QK<
wV+Q9
<f0tz5
*LO&.
ea5=H
za1?
@[1
bL{{X9
`;H{
1DLR&
B9^p:
P(/;
#| ?}
wj@"
@@)j
3& -vA
Mo(
-2_Z
6H8M
|mPc)
e'](
KU}
NZw}n
F*R\
n3Li>O
%@vM
/KA)
u'G(fg
G) U@
XF5^
TrW 5
G< o
}nI
http://ts-ocsp.ws.symantec.com0;
51.8$
'r?5
^x;0
n?9
8b
WT ES))>
D"X
<Ip-
Q{.&
[j]D
ZjtJ
[h
xTH>
]Kc0
KP5%
&fH
l8zx
fVa{
ZnE>l
<3';LwNi5
hK !N
+>a' -
]G}{
!,u&
Tj5jC
!This program cannot be run in DOS mode. $
(~^7L
T3j
0sW#{
h U.~R
wf2Ee
g|>>
xgFa;U
@3Z[
JrGGh
l; <F
^*RI
Dispose
dGL8j
\i`S
b4>3G
3<Rg
4L"e
=uu2
kd n ;
_W7"
tv}R
4 FF
2i|&
*p8iz
M W#e
k)1mU
+?nS*
K%&\[
xvqJx <
.8^Z<
JuW|'R
K>t6
4:nO1,
"=%*-g
,
?C3g
.9EnH
LQ4To
*ic"c
LE])X
hHu1\8
Bcx-c
DbEv
P3i 4]
uXg6
8>a@
b$
fB2P
3E(ghf
d6vX
}GM,
VmgF
b~wp(
.V'"
_p n
9C+>
4\mG
BV)
F=~YC
X
9gu='
xWvIEBQ
uA{y3s
IkQV
-Vk"
0 Ue
Inbw
urR'
{'Cl
6DqL7
"m?(iZfVl
c}?d
r[.5
P}]sSM
1B'K
_:NZp
Zg1l
t3D\(
$!)hy
AmlK
Odyb
ep)%-
O"M!
Kn .
CT=k
I+j>
|J#Z
G0; 7
O:_E
ONTem
=p;k
XmBcp3
3hrD
6lLDY[
VMfW
9!:^t.?
'Symantec Time Stamping Services CA - G2
zy3X
wnl!
O K
km3
Zk]G
#R=w
62a[,
X {3
f#Rj
@h7AU
ETuvLj
c,9>
&ZAv
[e>E1
TxWMp
woiNR]
>/6hr$
/R{]CJ
ru.v
VTNIj
\6)
nNR3
@X.w:
JQ83
C#mI
m3SS
sSB^,
`s#2o.
BI*-
T;Sk
X-)(
D(MpF
R?4
?qq1h
hhAo;"
VSa!
4AAq
LH=b
R 2
&Y 8
{Y2C
EditorBrowsableState
Z&g .
8-c^
j>H>
_pn@P
W,(*T
& 1
oFeZ
TL&H
K*Bi5
iY_ZDr
{,$.
YFv*SaH
tuoF
5_p"
D@}z!
Oh )}P
'kU!
DockStyle
j|#f
3M-NvlBk
0#Q
"c1f
hqh?m
TiX+
#SNxtTnD
93<?
t {Ee
Z?Mu
,&mI
](;^
s'V3
">Px
Tz|8\#
W7lj
^Gv!93
c,Fz
pe/rsBi
nn'[
%'-T f
bI*Y
u_,\"
nf =_
/!S
HJ cK
>2P'
get_GenerationEnvironment
H}?iN
Kv`)
u;Yc=
,: D
@5Rpm
HNyg
A2y-)
ts!
Ug*A*
xVCj)d
gZ:{
oQ 3
@!"7
^WS-&jdZj
Ncj]
Ffgjs
StringComparison
n,?J
}r a
Vyv?
J([[
4 GDg
eK$d
X<CbC
s/8fA
$EE j
t7Lb
MemoryStream
28<a
D<dP
~? :S
&4fR
7k5R
M6U:
4o)l<
S\z+
64 #Gz
l@t8
x(1@
@Z&`U
A]zn`
K{6p
h~n
s[Fm]
ry<w
mIfE
%M_I
DccPc
ahM<
jGQW
L/>nl
Ua%KU
qYd^
IS/5
aE\r
[ RX
SeZWv
RY3{
SCE $
h&xG(
C<tJ
7Ad
JFbl
1([-
MXu -)
^(+_Fc
[G(U
{!YZ
3pm-
Y\D+
s@.[
iI {{
u$D3t
_77g
eF|V
EckX2
oh Tg
8]R
|?41#
`!F]2D
AiLT
JiG9
.f^W25y=
u3kh
fgCcd
V R
K>Dh
>M>$4
Y0%W
eeQZ
o\DU
'Iomt~
SQEJ
6x~.
http://ts-ocsp.ws.symantec.com07
,AXPB
~ XFuU.
>B$j`X
KR3S&g
bgz)
VAy\
y"y@|
8C
o%E=H
5 .:|
=e@G6r
H
Ql6%
K1t(
I "\Vr
V7RE
~{ D
u(8y
Pdg~
^ ~Z
AU3
sCOTQ
B6n\ B4
'/)#3
eB(3
Jy8H~
ubhb
R'T_F
`w3_K
*49N
0M:A
- F$
sM)
3E f2
>.<#k
^/Ve/2
wQ&R
y=h)
]~cX
XI1D
`K !$|
0Hm
1A=<
$NUR
sHNQ
`> ?pD
-1O&
cE)68OE
T.qm
:X9?
FyTH
&lVx,
q*]nzH@
OKaN
MG<("r
http://sf.symcd.com0&
H>i$lg
xY5I
Ot~,w{
mg/o
,pc~
!8-<
tvP5
B*4i`
2qMY
D>YelJ
vd G
8f;+
x1U~I
b sW4
^0($
^}r9b
I$u4
[~T%
FC%)
{36%
kIrO
1b 4
wv#q
^. p^J
''/D
@Ab)
*h v
\>n+L
Btz)[
8+31
IsNullOrEmpty
Egu}
;t$d
qGW
,T8.
G$q=#
MQ_
A55|
Kl>p
.)YT
zN!3g!
4FK
P.|Ut
83Ysf!0
|mTU
La PK
JW/O
V-+.
dChn
(\%=
+##a)
9vpV
t2oO8d
_o$9
c>aZ
v-9e
Sgk%
{ *(|t
64`[
+?Ur
#fKp&".M
7G6X8vb
+http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
|_RJ
I/+-
D8"3
D@!s
75t_
DPV y
:b::p@
%RI!
#(2v
~ ;a6<
B^fE < > e
7 ;
w:g
zW3V"
<rH8
Zo$e
F]Psv
4}cR
[mLl
"B1W
?#)pS9
L*8{
d+Jtr
`3hz
847Ox
01~E!
lk>[Z
D=G<
d%Pu#
'pG U
:$v
OqHC`
ho.$
rE>3
CUrq
HHH3&
,]T7
!iktHr
;d'<
Oi)Y
q+}c%
OS'hM
1*ej
CsN@%
d){>
%29F
STTLVV
W(MZFH IyD
:70;
.ZZD
U;6'DO
u${<gNi{
System.Configuration
EMtM
T TG
8FrO
h1wg
L ;y
nXr:
G_,$
)g_]
&+mJgO*P
]Bx`%
Tcd.
Lh,5F
'QoL9"
~N s'N
)f2f
Xor;
Ke?D
,+Sy;rMS
q8f+
G`Kd
WGRe
!j?J
F7rM,
WnaL
F*l$
e<{?s
jK"^
ThBK
US1-
R:~}
~=EMI>7
P+nD
"xVa
7O@|
|5-J
C% k
cE8v
B-@O
R7jFS&+]
v& $n
*I),
!lXN
wP~cX
<t3C
fXVc
2Q)OT
\6peT
!K@
LtFg,
r v@
"HQ<
,{?h
9|HO)X7
U| ;
jSAy:
DM&9x
g4V^5^E9
%~fId
8wKj0O
%zXz+
)*a&
o G
6oIW
z"}.
%+C
.6_"
#<NRnh
l/ac
%`5lE
%,aS
w??'
O;3T
K`i>U
OCjS
McfB
+1@2I
uH$&
+K::q
oI9\
Un3N
viz
&w$K
B )a
D hK
z As6
-8K1
0uShB
>s]#K
6[f}
u>'W
L&C*
lL-9
'ay
Z.lE
<{%o~<
_/}(
j!_-
#N!i5+
9:xS
s)n
5] "
mWBh
/otI
[ $}
vju;[u
khoK_
)n7vo<)y
%E0-
@s&r!
{H i
tJ8z
v_}VL
~i \
Qp[
ej"|)
2]el
$+O
MwOR
?1d)
P3i\E
0[`2
r>%L
aX%E
Mr7YkP
Y<v9B
n.R
|NNt
`ug]
i^
PCaz
_iY2
P^i3
:(o
@ E\
. (V
N2 8=C
D ?T
(rsm
Yyq!
`jVm
>{ Tj
hSi+
q'OG
v GL
0#(}
Frn.
&}ni5/v
<s3~
zz~K
C2X3
(bKF
\.4v/A
74Vx
R.i
H]-M
1iV[i7
^#e
~V{f|
"wJs
TC-8v
4Tl5
get_Length
1.0.0.0
0kma/qU
pf$$
_IM$
>8Hf
`oq,
0i\?
Nqywc.
SY36
Ff4g^
5Y$a
QrrBtn{
rrO}
S:H*$
2UUp
Y/5)
z+-XP^
m?'`+
#(B+
SizeF
8@<g
Rt9
tEi:=Y)"
{*w=
t[,rB
AfH
qOc=
+hRb
)_@
=2V~
fQl</
*Qa6
Qg)#AM
)Fi
3130
G Wg
J% h
ESh;
zkBq
q; a'
3hs
X Xx
_R;=*
^H|I
xGje
koOr
7('0M
P[<
<*.fq
I&pJ
>Iu"
|-#0@P
"sp z
*7TI
[&de
Vh[P
Tb <J
_U<
e`\ SN}
W\'k
b(vg
>W8XW
XK)e
<_co_
uo*c
orE
k]"3
q@Q$
foFn
PR}Q_
x_-L"
wiUI
8Sho
8,BL
vs5M
Aq$u
<@(s
rQ";m
F `
JJh2q
8r{-
==g"'
"R
nlT4
N(<,
U-64^
KCRg=
xL@J
\NK| 'Q
#FqR
@_},q
&s`|
=T%"D
cU p4
[G]N
)uH9
qC%e
SkBy
N.oBl
Psdd
&>+Y
?fUp@
Z>&u
8%Ysk
8aOnE
z?lK=
Q9s}
GaTI
"pK_
@ jlW
<[FU
hZxH
)Z@Z
iN;!
F*dpn
8;~?
jtt"
4x
G` $
>S\-
8 &w<
9s]d
6?@aQ1O>
2#\K
Yz7|
'ZH/W
Hzvi
QzWV
\ 1u/
&Irq
-FS
p?\6
97`Q
|`1(
Vl5t
qc{2kp;
%=[T
@s4g
[n$?W?F
24u
@$@]k
2*Ri
}oTs
>F)[E
'\{W&
.'a~H
|P^x
<P0W"
$g"+t_
Birz
JA s
<Ss <
TD-1
Rs&z;
s-oc
J 1#
qG{:
!T :
IdXb
duq~y
; XG
ZY0
W\B
k2k)m
ZY0
ZY0
W9l6g
WOAO)
.BH/
psiY
0XKb
ru(AR[
:nL)D
)Rq3
#g\
3UMS
3+Cq
jnqTs
O]V^ ~
}AxT
+.>k
Jum;
&&ahx
%:w{(
( *#
[hF =
W"80G
K @m
Xm5bd3
e&0bz
zCAO
?b\X
"`"Z;
{Ebn
Is8`
Point
uU>>7
j1@/
1l{g
l"E)S
LE%e
mX;p!
` =
}jwaE
}KKQ
VA3%
II|
u:zgHU
[z!0
GO`T
L-1[
jA( G
SY)-|x
f9v$
FM3!
Sv>N
]V) +
:tNy
2 I^
h+{@
8q*l
H|j]
L}xQ
/s<X
: 8'
eS%"
jjtC
-v"v
z !'h
"isF:$
Lr"O
add_FormClosing
ZX!@
V[^'e
]([H97
:K4zR
&=|21
rTaAa
6l0Nx:
vl
iot
4Yjq]8OR
UN2"
Symantec Corporation100.
$7I\ Q'
/>a{
xWLZ
3` -
Pf$&
2]>P4
0s9c
j jh
Y]H
D< J
P.NX
kXw
a,v9L~
m4M~
E]&MU
Vzs9
Z%Hr
[lJG;
>LIu
qq~>
8lf
6-ls
ubo0d
:2ypZ
+zmO
xP3)
%9O#
gxE
~`gy
DoqD
GjVI
rKP[
o5+n
DtW L
Nz"k
."IhJ,
,vKL
smLPE
r tL
pxutna
OpYD
[(F5A
A6)N
Rex2
5+A '
wP[?
|O.
%%SX
_Q=s
IzQo
w$4_
9dHA0
[5Y:.
/< C]}0F
mF/Hf
EndsWith
y(dyMkc
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
$5S\
Cr%*
&2_
[0Y0W0U
|p V
Y5m@
z;T0S
0V+6 |
J/f* '
s5\Bq
}9MZ
System.Drawing.Bitmap
+;'@q
GKSE,
`&D3
H?qE(
?v9'p
{DUc
mNh!
YN
ZczgJ
W bU
#M9<l/
OS=[
]g7c0
\J$jg
/http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
B#-!
;g K
Y 8^
"?ZFh
p41&
@. 4
0?y|
YA?AJ%
YKmk
^u(F
]KW#
,g)y
Kj3?/
x$&
K}tW
'N;o
B1}v
dcjj
%*YD
-ViO
&a`
J !D
r^,
s\2 ~ACC
o}/Z
EJCwi
H~}s
IyPF
8 BAv
lco]~7
Ov{XQ
R5W{.
EW\E]
SYMp
i@4=
Slo
AKWS
OLjE<u/
M"Z;
SVBj
rF<A/
[SZ[
?M ]
C_"0
=0jl
YQ+{zc<S
fy}
dI_M
K=Aqt
PBhX?
!12PL
:UBVv
'_-"
IDisposable
x'=f<
z~\#
A't&
k+h(
$y}m
t)-d 1[
2zt`"
1nrTl
NO~
6D^>
8yx'
sr0|
Of;O
* RI
_ KmG
,pzg
%{fX
8\jW
#~:%
/[^N
Symantec Trust Network1(0&
[42s
"^fK
L7Ir
U*!1l
`A
6jat2
VQ \M
r" [
jA:a
u+Gg
W;)
Z I
R=-vZk G
BHO5X
K)HrU
7|xJ
di4,
i%%'
4]M
'P|ZJ
.I
A_)'*4G
V0k7j
U u$Q
6k{S
'}Pd
68Wv
Q*/W
z%R`
G$
&YYM
kUvz,
<< ~
MT"~
L3fNZE
/a 8&
$/}}0k
s\n
Ye_!
2y~C0'
5stu
6`{Q
mX)(s
d4}v
f_F Y
e7-HF
K}~/O
#GUID
pCR{
W|M"J
9:Y{
i*kJ
# "}<
)-%=
~fE\
RO:_
I`ki>
Zj5/$
7jP"
-Y$cZ
#S{5
u3wJ
XTBZ
ZKxM
WdHe
0$qxY
.C3L{
6K 1
kY;M16D
rBaz
I~HJ
{LxU
mA/N
'Ib$I
" ^M
*Y 81
lIf|yB:
v'6c
? A-&
@Vn<wW
F+9(
"_%gB)
hS%v
g :P
2f,qn
=p("]
OH b]
&y_tB
K YPp
Z D26
7yG+G
TyrI
4>}.
hqtbM
'@Q
G8J-l
\#[o
RAH!>q
T/V H
K,pY
3)q}
+3.~}
#$ c
HitP
JqD
U%~-VB
.+IP
Zf!d
:.{[
q['Pm
Warning
7Ze;
BH<9
3g|W
S!"=kb
F"SK
^-$
e2xE
L+>?
rx"Cd
99;I\
%8i.
5M#a
<G=t
;#D
7JiE
>m]c
!8Qu
-4|6ov{
~Cm#
I8UL
:pHL
sR7E%
1myL
>D$?
vnVwj
V=Gx
s?`d
@_a'
ToArray
Ul*70
m*=
1TAZ
4deee
D_:e
"SEZ^
Replace
|9
QCPA
,D)&[5}T
$_C=
F64p
p.DD
480k
zXN=
hv)s
ZpwQ&
4|9 B
Qk~n
/;m~RM
tOigK
m3 (
mxgxj
Utk.[
j%"Y
m<;F
.q:(
i:~pK
~(!e
d_aI
56zo
9|<} {
$}GVr)
.;a{=
i#V wj
8i@:
110222192517Z
"T{ku
Y1|_7]
e 6
,Qto
e0F^
0u Sg
!QzO
"pNub
$)Zi
\D|[GE
`EX+z
RZ=V
wOK&2
X?eZ
F891
XHyEm
]>'v
uIDAThC
~-SrAR
oK0
#)#nz
msL_
}6SX
P4m(
1 0
STO/
Nj'E
|(g21
PlnQ
Hzz*
H3mLc
anre.{W
mRQ+d
!Uf
Bv.9
6E3 w
O$9)
CLI|M
8 jl3
3D1Ex
;7h0
;UCT
` E
8YF4A
iFa`
p;1?
^9[ x
8;!1C
[SG(
?VqT
| ;||k
R~r
gtLS
)C\#
t1q3
C,>"v
YaFo
z3>;
)U 6_
#H1S
A1vl
ti58\
~@I6tI_
&mX!A
GbU*$
S _G
aOR&0O
z*!b
z_f9
3Q$MM
i_%]q
d' b
Pah#{
GU O
^j/J
`l:O||
x6Gyz
>U/h
Q2a-]
LosN
- `z
Ti
T#Cr
enz8
Vwf (
yU!
b sA%Q
X.,
0s;f
/DA\
ydK!
m)>& y
uuvF
Ov(
XpHC
snl
U1?P
s*Ok
wYs~
-xb*
*hU7
T2O`i}
OA1&W
ZpJ[%1
Vxy
3LG0
.)Z"
^/`K35
5Rl y
X.,]
6 :e
[E-D%
WH!c A
AutoScaleMode
RN w
-wf>
~M:6]
rLx|
-o j
Q$ L='
<vh $
28~1
ZE3
$c-)
}fTl`
Substring
F3"o
#l\ftH
=6kK
\nntze~
l$l`
.`}{R
4#q$
V&[d
:'- D
@BTqX
ZG +
-]eU
t1p2
=;*7b@
b 1h
t8?c
X7pF9
EL,
WDOw
' Zx
6o:"
/tMA
k:JYKg
#$5L
#g?z
/z_h
vc[_
Fz}+/D&
]+GKuG
1QZY
U7\
`-~_
`z>
bV/j
:1X7y
s OE
>VH@
7;6|6
i->R
NMLL
R2zC
05MH
(%gy
EmT"
:QnO
ib9h
KBJX
L8^`
$ON
Sb1q
ht!) :
d, e
BM\t
\T&M5
,1rn0
,j.;
N 1Y
N(J6
n83b{
OWWN
B $f
)Zp:*
+WZe
A -u
,N<jPl 6
d7go
D=rZ
} Q{*
sc9i@
w Z
rAD
Q9-&|
2>x2
^ 0K
oM)6
/[+2sf0:
k*kA5
x\~r
x87G
XEgK
GzQL
}'0c
mnIy
r gY[
tL?cJ^
~EAK
aZ|}
&|h&X
>jTk%)
bi#/
AssemblyCompanyAttribute
&Fbz
vX $
]$2R
DJTX<4&)L
]7 !
Ds!\
Qi^RpS
;l$|0
mV &O
Wv'`
TRcP%
W[_j
*V=.
><)_(
o&8b7(
nFMQ
)8{#
!asp 9
)/-_7
mPTniK
YY;a.
V= c
b5Ld
hfmb
|fEAI
i0g0e
rpa5
B,D&
AppDomain
t I%
HFsa
U3b
1dV
-)O#"
y7S.R
Y;C[
_ !B
BI=
6^vr
4WjW
h'=Q#
f*>
MH-Rn
3R 7$
dTZu@
9DA+
) Kgy?O
%y>
all{gr
8s_4-<
FOi^
* I:
;?mw
{ZAh
'oK;
hA!/
4r:b
tuEC
poq`
]LR`=
oPj5
X!x?j
cH|T
1FYN
4) c
Control
}roN
.}UOTp
H>%p
Z-@x>
0 U6
n-SSS
[.*h
d`7E
8n<-{U
oe&`8vf
k&o
E. .
aO&a
?X}< p
X7@=I
Type
]_VxuI]
1@pESg,
k(&oO
!Ag$
Vt.W],
LA5m
&z_
% 0^Tv
1,v>.
yVVnX
g"^U
l/ET
8<Kc
<.7j
J!_[`:q
fYjK
Tf-6
H {>
7i>o
ZtBb
G_#[)
nt6^
Yp@V
iY
FP>`>:
3tN
xo+?
IKE^5M]
get_ToStringHelper
q8$w
rgxf
=BUbW
PWEwmz{
YDn
6U2D)
)/V1/
vH8b
q8$]
1|JCp
X{Nw3uV
4.D"6f
P f![V
eL7JR+
7kh
TwD'
v Wk
k_ad
{n.I
imY@
eV%Y>
%Nc?
Z "
~bj =f
;,PH\ 5
B!sm7
lYUC
) LG
#$Pj
Z0X0V
~@@ W
`6d5
~zl^
List`1
B$Vv
BLCp
W_%n"
z&x?Ho ,*
]_Zr
6%U5
(FF@-
& a4
o37U
O?E$
0 C(63
\p"m
YaKib
_PQ8
1S[t
YL?r
ENpT
`}~u
v}=(
b(Wc
oz -
DwGIV
( &>
mU.B
f(r
4K8h
%LeB
DPH;
9NzU
?| |d,
%4Y&
e*g Vo
e[Y]
PRnGO8
/:_g
VnN
Y|D5
Ry@P
Y42~
X(SX^
KtuS]2
Yo>qq
pYHZj*
Esb16
Durbanville1
wWc
,1q<
dA.
nEZV
)-^d
n ?
L9[CK
ka5C
7%?-
5ow3
?BB.z
zWt^
n6mF
lf/
~\w(
^rGa-9
. V-
B|:o
VWM
)p]
,M5 &
'q[^
Hq2=
@#&P
`.rsrc
*3o2
!Ua>P
W|4(
9 n/
-;OeF
9S};
Ia/MLv
jzp3
A:a #:+@2ar
WvW&
l/ L
P$QTk
@_[X
G]\?N
ovd/
zcBE-
P%Q#
#;5zD
4vC*
_WBxZ
&4&F
YZp?x
]4o6
U?k'
U8y%
o$Bh|?
5k#^
`MFi'
rYG.
eA 1p
h.{d
{=XD
qY$_
ZGR
set_Size
mQ d
KZ6n
+x7
4]sS;
CIQ:
)w$FIt
z3<Q
vX&J
:F#1
N&<C
Kwxt+
3;!2
}0~-
~3&H_
sI B
dcgS
\D)?
\eAfD
3;!"
Jrp"
3}.9
5\35(
l7E:
|,L7
>^<K4
l rT
s+2ga
wIC H
^@ L
%mOW\e
MDAs
vEOz
6 F%
=;gZ
;CQ/3
;(w)
))b{elo
PictureBoxSizeMode
P^;
k'oWc
xx(k
@$ZL
:?|n
N~qw*$
8NwT9%"
yt<U/
KRmk
[K#4
ho|Q
9"!9A
73O`
23DN
,TSr'4
l>)C
J]V4j
Z\H1
"\X8
wha3
_H ;
=ka&n`
ln lp
px|U>
MjYDI
B \N
)$Lw
)N x
@R V?[M4^
Ie%W
F!4HwX
!JG$
^:xU
4a@G8
<WCQT
Sc!W
t3BguX
(fA4
rN!\
f(E@
1~ER_
s~hb
A:+n
[n#sS
@cZ3
Ko<)
| >6
2^oX
]}#OI
Symantec Trust Network100.
vl[2PYz
(e@
oP1 q
Ya|D
7y4m
VJhE
ba
raix
`aDCsL
gln6
#;ec
&*8D
^Ou vic
Append
T:K.S
?*pG0
X@k#
t$g~{
Vr$Ug;
oS }
TdfQ_
FYi>I{
:MRSyMCOheB7
*Vz&t
E=b`%
j9$e)
C]W4BG
Kb9
M%:9Yjh
% (-
*V4f
Ge(J
:T-
{pW 8
q<c\28
ChC9
LO>~=
"H#
is I"
R\oC
<,
i%~"
B;%R
qT0
6;qw
dEwk
@";#r0
Oc$
$dQ&Rr
d>CG
i<&<
=J #[
mh)%v
6G6k
Vh$#l
D*ZS
Fxi
yZUs_
pA^
8t'4EVL
`q=^Z
m. T
V&mN
@Q&6
;[l<
EC ,P
KR%#
$)?u~
:o.Z
Vh=Q
>v=Q
76na
qcu
Al?bz
%v9w
GEt.
[/r;
mHmX
@4]*T
(*"T
fpid
;Z=KV
3,/,]b#
G6}
\vz$
=s h
W0NfyTn
Cn$ E
'CN?
*m]co
get_Name
#3BQ7=
Mx0G
X AQR4
[j``4
B S*J~
D853
K;mBK
9%lF
k7&[
!KEC9K>
BB.9@H
ZcA,
210222193517Z0
#Strings
y;)m
AF7W
zB+o
Image
I'k2
hpvc
;}]B
WGqP
=qM+4
.Ypk
=U4V5N
<,rS
!C"}
K }"Ohj_
2297_7d
|k%-
VcT44[
rd?
8*n2
{49t
$C E
i%vj?
>*0&
]{w:
FVZX!
0Pj*
'O7}
m*/jz
y+I%
_QaYw&
gJF4
2Evl
GTX+-
hS);
System
jD08yK
^kL,I
+} [U
EventArgs
lw<3
e #1U
ZH@m
'H[!
dGvE
GetType
9#Ru
{G/3)
\BK'E
[H R
:1jY
lZ$A
NG@-
5qjY
)-vf
]k&
s)|f
[ 6!X
t#'N
((*
pcOL
&` x
Pc]*
E$y/_
b2G&
/OFX
.lK{hP
m_lkaE
n#`0
#hQv-
4_$h
uW|Z
MmUUlb
bTaTJu;0
T 2J
=Rh`ZBU
$M.#
, kb
7"!9
}LJ
bJ2*
yIDAThC
u_RP
.RQ
6r2
uW|8
Q+WJ
{~}
_%ze
5*8i
P(:6
ks,6
K5:I
$ patGp
PJT$ s:
#f#J
ga-jf
{P@Q
z# .
mY1(
*;Jt
N<[E,
1RoL_
a8XZ
@B2nT
^Q6
m+o<_r
fVA8z
yp3-
*Q
1Z_(
](r
~t[b2
zV##r
u hU
d43]p
xeOF
P9 PCy
TLcf"%
D\nU
6<==
L-26-
k*g"
rF?n8)|
WqV|ioV
vE?@
w*u>cgQ
^!lL
Jm6j
"8i,<
HgQf
h[rHVT|
VDMD!W
3/\L
u(LN^v
d}]2na
r-6)
PH/UGn
Ca"H
Z*H`
%'*~
U 9
fo%k`
r{5G
& 9(
Ie"Up
hJ'LB
Form
-.mn
8;cc
) Pp
U*svB
## A"@RY-
u%nw
OE7Q
FLWZ
lN3
E%Zkn
_igt
`x&wXH
k>^f
0+C_
->;{
0[ P
0r0^1 0
+'x#
?8p`
LJ$_`
|I k =
;i;~
*}A
GQ'
)o[5h
GQD H
GuidAttribute
!AFP
Q_3V
fvtT
Yh 9I
04t#Q
PjOp\
2Cc#V^
'uIX
w_q
y 5i
5#q]
&4Zw
z 6K
K5DF
V|$L-f
LX}0
720
FVeL
)fOz
Rh z
hgm0=l
KvW
h~ur
]1)S
q(@mJ7
$ef_Sye
:;v
r)t,0 C
h~ul
A!g==L
#http://logo.verisign.com/vslogo.gif04
}R.\w41
A#{vOD
(8!
sb=
$lF.
tJD=Is
>orY
MJg[
+p??U!li
8tvb
1Z-d
hPoL[
%s~<
%Wd57
uS&.
~TQp,
bS0.
]/bX
@zJD2
]=vJ
x6CX
z|;P
h5 0{
Ex`+
,jY\
!LB+shS8Xg
Us}=#a
uqnM
!?r_
ValueType
O*/xl
:T6!
System.CodeDom.Compiler
set_TabStop
yMb*;
#ivn
=% 5
SetCompatibleTextRenderingDefault
,TwTp
ym-$6
)oua
\ZGdn
) S
wwn
y4;1
Ow%
%A1~
,G{
XuO"
oF2-
#e Q
9`0d
nq|;
^Ryq
X;.HZ
2c "
aIM b
201229235959Z0b1 0
RrRx
E#j)
R%4
"Y0R
T3!Ruq
wd-{
*?qv
b3c "
k, 5G
]oI
jZ
?\6__w
FFV Q
?;KVB
Tn;v
'k?]<71&X
pa\s
SFjKL
fM:M
eY_6
3q 4
@"5gw
w#Q
M!Pm
On9
p S3
%rx{
I/@#
nYnHg]: W
Z?I]B
_c-@
tP}
^j>E
|g2H7
(z>g
0 4O
YgEqE1
ct.?
WN?M
ToString
h l?
n` 4.
R3> E
TE)"
6&r23c
{5 <7
dV4l
4x7|
*Hu-
mX?Q
]Po^
G7z}K
nm&{k{
Ak c
K> *2
d s(
.ohQ
&zVo
YT._
)^\6
80~#
jXT8
g/~@$
V8$+M
W?^i3
WMm;
UI{+
Am;Qk
wWN:z
3p0N
KSb0,
->=/'.
9{v'kn
[$FQ
"a#^
Dr|L"G_
2I/M
/lQn
|(Iqz
dN--!
Vl {
krQ5gb
|iKU
GYJD
args
-(g0rv1
uwq$0M fB&
_~e4
WYID
hfal
6$bQ
P|Ug[48
cj"X
MfJA
<0M4?
5.&9\
y8:0qLM~:
$e[,
Q(}5
gJw53
tI$-
iD^P
2$PGt0^ ,
[ Y2
I +:'k
w=K5}
NI}R
vb()BrI
Redmond1
UCPz:|
@f !
$#?*
|g_l
D&mfC
Z#_h
y]#Xr
_'V
z71@
T)M
t,|fz
ROl`
KJ"/p43Ho
fx0{
t^c;5&
zu$f
f>Z:
\<#<Ak OlYT
tN+C
qi>'
kpfx
K 1 A,
q&*F
u@Dk
EsZ6T
;si`
wNJ{*r^n
$P82
mR>(
3H #muI
.ctor
dW=7|
r<?y
u@Dy
Idm
2S")4
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPADT
ZUi.
mscoree.dll
&X2e
&t8|
:W8<
pw6D
21GX
U58}
s/-Jr
DYjTJ
)09
O&wu k0Q
'(Gn
j/3D
VQ1'
5U(^Ol
aO"S
XPDQ
F0./
L7q++
3`n!bbPk
16(en
kC])
PE z
Ag D
g Ty
0H6 nA4
[e!L=%
ly5&n
]5W;0
i k%0
Ntls
y}`m
#^>A
~&*X
\8It
P[![D
@K:&
)(ZV
tKtk
k$K,
3 q
< %
@.reloc
i NF
]<Ub
} =
cELY
=` x
IG\t
|q@%t
lU!Om:
l'wq
Auw h
~!=v
ro|6
*<[A Y
{*@P
`as
Ahf{
bef6
5%=|
%%&o
5`*KJ
*Nh$
WG:
(U%t
$46i
|0/x.
9T\'PA
k~3s
*,z^5
016d
FjB\
<VeriSign Class 3 Public Primary Certification Authority - G50
@_f
H9o=`
1_T0J
rr$,
]B|?
g`5/
xesQ
"]+v
:Q6L,z
qLmk
'Symantec Class 3 SHA256 Code Signing CA0
5P_9I
/`9VG
0?9]
~/OX
b@ ]ll
vjGNj
.J49
:>^R
q_)>
&#6w1/
N)M9
edX`y
,Gie\
t*oW
aTh*
Z}.[
M.Ks
FormatProvider
wnc~|
f"/r4M!
baRG
%+;X%
uTbhZ5
<g=*.
set_TabIndex
;>bI
l<YK(E
{s-a
%^.U
ZJbE#JDNH
( 9!
~-B>
gOyX;
Jjw)hM
=;&"|
j2#.#
NTmh
K15l.
1Iv4cH
u%lF
:9\G
ZG_B
O#8&
,us=
~+8pl
L-w";]uf
&_;P
]U A
1by]
nEhFu
qN6J
4+J !
&! Tp
https://d.symcb.com/rpa0@
,]8-[,Z
YZj*)pL"
T!Ia
<Y)N
to*\
aSLYPRf
:+<Z
5&}K
Qb6/(
2kmue
0V\r_
CV.N7s:!
Xh0"}p
https://d.symcb.com/rpa0.
H^~jS
/FLk_
p:1
s+A'
L_Im`
59,3
]HKt
'] bE
Sf]5/
0}|
9?g|=
Zfwdb
y/8:
mn`j
MY6c
!'_;
6 08
} U
[qI:+
Xfd`
s/,'2
C*fD80w
kd2M
qw gp
\]\0
]0[KnS
*zmO
;*E
1mW%
"aG8<Js{(xC
RI@K
dCcw
waUO
|,}%
PHQg
cxNIt
7*Kx
O@&H/A
7r%nI?
US;h
LyDo
wCKx
&6<|X
\G"O
'Symantec Class 3 SHA256 Code Signing CA
m!2#0
- v2\r6sR
?K2aP
vi"
L2l'
' N3
`R)a}
=EY)z
Ms!"k
#~/I
"2{
Tx^ H
L4L3;:
POGW
gqqM
9NYb
\_Xn
&xjP
GFj6
])x
<n[1
>;-Ex
3x~B
gRx0
&R&G
z^.%
S g=
gIMiSX
Xac_*i
g $@
o*+p
:VqM
es5z#O
o"K%
o$-Y]{,
W>1<
BOhW
|el'
6aFh
"pG K
c}Xl
$Hn ]
OV 8
sjkm'
PKqP9I
wQ&=
'p <A2'
_!7?t]
XM#bj
I Wej
-<+;z
7@{?o
170428153713Z0/
QeZk
170428153713Z0#
Ox.\"
7xiF<
AT2N
PcO2]
:\$*
/ 0
j*m6
nZO;
!m3ax
`blv
7`[~%k
9z Zw
r?reK#AJ3RV
YPLF
F$]n
TPk
wizD
y1=&g
;Y >
$+_2c
+o '
8;@K
0pO,
[B7G
]a $
l =d
kL ]c
,j{L,
TcY4
FR[m
&.7
Gwb>
'g%.w
n~u(r
HE}`
E/B=4
gwh
1 w ^6
:.%<}uD a
L'Pj%h
CgXt>
"3Le=n
K>
?,:"
6|V:a
Y 8<
Y 80
EN_-e
@#V\E9
_x})
@(HW
>C2ab
uL5M
zpzz
.
_XYE`
VE^g 5
&@zt>
U`SO
~3[k
qJz6G
TGA
2?x;
Jo9
m|B'
$~ F
$qf*
.\ [
bi9z
Y 8s
Y 8w
Y 8u
\b;h:
H'(^s\R
W;|D
,YI
9^Qy
Y 8b
IRN B
xiR)
\s2CH=n
+ "#$
~9q=_
uDx1+?
MgcC-@6 v$
cf@/
5DF8C
m97U`
$:. 9
Y 8B
do^8
%?c#4
b. ~
$XzvO
W.<c3
XL0`
yx52
get_Evidence
l{`.I{
In6
gu5y
lz5J
IvR}
'3[eY
/t-&l>
Z BSm
D@kS
xx @
&] {Z
DJc/
CV4Sb
M}IS
0j^W
7Ax|
44gQ
XC]F@
zuP47
?t2lX
=OT+
"p {
I]e>
^wp$^s
d+Q4
07 `:
8zn%
(1Mh
HD$ '
gAMA
^f(m
BZV|
$"(@
%c[)%K
VkNQ
^;C(
{]|(c
<S7L
v|mq
*MCm=
Xtp)k
ekSE
'|Oe
!!JF
'DSu
Ct G5
Voh#
^2G&S
|l4]
a &x
W~x=dZ
'(7S
b,6i?/ p
|ZO
J9PF?
?qoa
`Y]!
JiKF
q/O;Q
D!bFOgPz
PQm:
)t~d
)\Xp;
;IK*S
" :p
Deze
"J :
}=6@
?[[&
hRvN
tp->9
\& %
<u7a
D[5i
@S<u
%( q
rV(r
/O;bj
IhQD
\ qm
-["7O@
H1_,
K0I0
j8'E
jxCV
him<
WBMj
R$,!
6Uu[
R*x
.)w*
[RP f
22Z
K3E'
ok(t
Ju9
o_JH
~[zN L
T6~"
bj:%4
2018
!di?
&qPX
&^ 0
~!HQ
AG6UU
k.t T
bx[A
Z'1r
ICLG
9Z&\@v
lZT I
C,!yS
>Lz=
BB5_
GW?X
<Zg:
:,iw
FR4?y
7mTb
)Y|C%
PuHY
M .?
C9:q
SC -
TL7
,QBXp;6,
ww"k
k8%
:+o}
%q_^
~pXM
m1 \
n$90
xP{
H*w0
S X&$
?T$
lkIH
m@C1ci
m1 ?
#2Za
-DOS
8'Z
*7:k
5Xw/
s<$
~-L
S#r(D`
Y'.b
+*n [F
;{i@w+
8-=4
8T Z
$h
:4 $
|8o
J:}G
C-- Hv
CbAJh
j j >
AM-.
-p=S|;
{@!Jm
cqi&
4 Wo
. 9C
-kU3
T=Or
+C]_
\1y;e
U$
(2f<
IA lf
F d
u`\J)
;i?9
IvDeX
3|5P
zc!M
{OieN
cowL
Tr[?
M6q
6lHW
oNnF
@2][
>%06
g>hR[
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
CyVQ
/%`@
z?o_
^ xtzjx
Mje)+
cb[u
u!3rV
[Fhj
]UJ
Stream
5VU@
:.KJ
7 ?b
B.;c
z^mx$e
B^kwf
p^QK
i.UFm
/'DiQ
`y?Z
KC2.7
onMm
]mY&K
xv I
zp_B
a+'2
#KZW#
p|rt
1uCC
VE F
3fB7 [
uw(K(
38}8
LPyM
f']ugt
IJwca
3D%9
Pzk=N
%6!H
xR?D
8)@br
B+S
2ab48/
/VeriSign Universal Root Certification Authority0
P kTC
`S[}
0R0&
F<&)C
&+i+a
_>f,
MtxA
?L~BcK
3{:_
O.P^
Ov}T
\kl`
?#ea
[f.,S
< `]
"$I7
<1^jn
;N1K)
0(e@
Redwood Shores1
JYR
zO;>
?{~4
b,DYY%
# 8>i3
qh8"
$)uk
3=bl
aTVX
H?>d
G $d
fC7 l
N^t2
#Lw^
Ch:U
URsd5
<0w.
(C\_
(pYa<
)Vl&
90o
*>#]e&`
;FRJ
~ `:
2 3 \m
C" i
&lDi
7 z.n
G)6<C=
~\:b
7Z?Pk Fe
Lm&4
LMQr
l>#j
'f[Fwc?
+59{].
~%++
m\ 7Cd
r[tj'
c]^|u
[^NL
{Rpl
?j.
set_SizeMode
7 "'+
lzs8
\bg/W
WaTx
)Z\{J
zYd9
K#|?6
=K l
{qQp
^Cre
9LQ#
Z,?C
&yZ{
Symantec SHA256 TimeStamping CA
ySY
5ONOz
dH(8
! /#SD
BO_,
z% Z
,\_Z?
q@;,
fuyq
o_[p
c',`
W?^-
Tav]
JvTR;
FT^sD
%::N
IDictionary`2
Dq 0W
I~DOc
Tt4
e<mN%R
0&\.
>NM
vx5a
o8*'s
L5(F"
zh_I
U~+.k
?&EWj
6#oG1
7 x z
}_H%
deNH
Y9-p}
6) V_&}W
pF$75
3.km
q 4|
,=B7
#QZ6o
fZK|
DRCgL
<b 9lF
,?J
x*PP
U. {
OBCVrL
Pl`\
D*EjA\
n^8(
{<b;
tQEG
Gad)a
fU V
);vfFjCI
Le+D]
tZsJ
5t( a
{J)x
3'u\
^+ho7ciN
{U$&
U5Q6
k0i0*
?@|>^o
};0t
wkfl
l? ~
g}d{'
fI#\
t8O(R
<gS:R
$ 1
P@K4
z-I!
UVOz_
k! U!
!a2
h ]V
O{v,
%q2[V
MCc/|
QMfU
d%7F
kL=B
Hl;f
Rl]p
FA {Bb
m Fs`
T[S^Rdc
aog.)
xrAu
$jT#
g49
x3J%
=upD
[<~
%aBY
g ye
p(Gd
RwL
25`.
gMV%
{n*kZ
[OIK
uZ+R
g+OEP
IDAT;
6+3m~
qt2~C
@]|@N
g"q
ld I
W,{f
xp0=
Vi ~8G
?Z c M{sw2
mp@3
L<qv
yuDB
IDATg
ZB1@\
!z@N
1EkX
`U <-K
xKZq
R:'`
<RMI
<x8b
(%e?
>[My
FhBT
#He6
(NARgl/qB~
IDATx
j\|
,q[
@($]
YhM'
_fT;
AALZX
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
2DPf/
o9/:~h8
S^M
@mc#7
V"GBq=Ge
#aV>
!4sDa\
MF {
SN{3
"RTr
aDg}z
sPHiM
S%ll
]] 8*
TR9 1
?k.b
^i='
^@sb
k+C&
U@tI
W`bt
K1m%
EM5fYp
? p:
]6f+
cx9
[)zP
]7Q\,"
I]~Z@,
h#tf[!
>< ~
v&xA<
-9iCV
SjCF*X
A@F+m9~+
ckojL
Ivn.BI
8B"H.
f $g0f
K_JO1=
(;.;/
y!CfS
v KU}
g1)<
{4~D
8S,E~??
>ysd
e:'Q<N
|~%Q]
_n;z
S 3C
\a}4
|l i
A+SW
Y,mV
15.0.0.0
c|:g#
*|IZ%
:oTU ]
Q:k`w
a#<U
B6 6
$M}fV
9uG?
a2nQ'
HY*K$
4(4`!K
AEC~
;G F
<5}Gw
vl>~
tA.$
0P/E
D^ ~
"L;~m
bB.V
b| T
do({
(J#>
z0i&
Gr0=Qw
x H#
|<m1
zS@
|dqi
q(x SV
OjE;u e,
4JQEb
X? p;{uQt
A""1
PJl&\s
{kjckQ
1J=w3$
dOZU
t3+e&!
VpX8
j3*4
P& $(
(Q:\
jv d
KRRU
)L\
+bZQ.@
NvBn
R9^4
M_X_s
ya|
Z.2\
f#l(
^HEi
R/ )
EXJU
~}`d
2r6q9
x{8B
?e *
5K 4
15<+H
Pkna3
o@N]
7~v&D
\qyGTE
0$>7
%^Sa~
M<_J
P `e
T3[8
KGI"'f,
o,>"
TU5U
iL9u
+!7i
!+ X
%.pO
9
oJl]
`IdJ
oh 8n
[&OC
z@k)!
?;g[\
1tX
`r@
,g}|i
D4gf
Tg>Fu
iPN{
k M G
i8ON
h.~zj
pJsR
l,kqt
npO:
Cn9e
;cg(9
_DK+*
F@~oMbz
f| E
N c
J,|L$
KB;Xtw[
. L2
hY.e
wOv{si
!Ii99
'r'[
*a-_
0wbN
%| $1]
!'@0(
3130
4N vQ
jZO6
x]S6l
<8bPc
Jbz T
Kg (
P;uta@
:2Q;*
_*U.
qn?l
Oq:d
#eyEv
"YT
z$e~
tI;E
4*Kq
5\](
YppU
0Ge
()? 1
nKh4
IkI,
g| '
oWw
a4,/4)j8
h>QY_o
l4vS
O8S0
4x@W^nO
b*ru
S()>
jj?f
EZSn\V
h*'@
<R=Q
vy v
J9q3
[A|^
mOSE
v| C
)m Z
3D#S
[ r`
+aN@
a<ac
>09f
<7qc
SmmT
;/`:
HkcL
B|6wH2
n]1
.)e_aX
?gX6
1 `c%
C 1R/1
{P0F
pCcH
K6
L}.3P
}R8#?
jWmui
bK1]3
k'8T
>~KA
?W=]f
9xj@
\ )vC
JYCj:
g>qF
k7fg
Xi ;
jxb'
xq_
tzq{
JR:
O$%u
=>6?\_
:SFQ
Oyw"
- ;{
s,>*
!hIk
E LM{Y
q0d|
4s|Rf
Mdzw
Z/bl
dnQm
FfR"2
t%im}#me.
AdWGT
9$@u
qv \ Jq
IN6#l
o{z">
_=]8
h1 M
set_Name
cKr(
8D33
.?Be
'-~7s5q3<mL[
%_O@AR.
)4 /E
bd)>
xR\CZ
>{tuT
pn !n
+X>x
Y+1zx
-%H#
=G`H
L:8H
?jJ
&pt
RJOB2
Kvd
Default
nbl&
wes(,v&+
kl2#F
Xh=(
m[HcFQ
K s0
dHVj#sy
w:/vi?-
C$ld
x-W_x"3
-}E4@uP~
k&Lb
q !
nd@6.
s_r3
7oI
guqu
5~GK
W:a$p
\9Co
Zfe9
6AyB
;7^Z
5}h/
UCoh
P+D{
t4rX
|qdA
g~9"~
sp|{
}I!Z
.O GOx
OrlRkj
J'lH
I6H]
-/j@<
T*3P
Remove
lU6'
Pny7uy
g{X|
FLX&U
4F&F
40Yh
vc$M
v,@D
/)>
z+(_[
ComVisibleAttribute
k1k-L3u
b5F=
(A`#
>5tF
M5>Q
+3[,
NE~
:GdO
qk},
M@
TJE]$
/5g2
9?vD
H}K7
[*( +^
O_:|
0/TlBAi
kH_%
I Sh
1AeM
Z*+d
Nz
PD;n Fp
HVIh
-Zrl
%xE|3
1f|#
V' X
bTkb
{LsIX
Bp ,
'DLA
?6G/
~(0M
ZV0h[
?X9 5@
> lX
n2m;p
BBYI
$eMp
PDuJo
X)q(33U
n mL
,$D#
q0C|
MH`"
LWQT
+S$x
cVU
w1q3?ld
Z.W.
,\pAF
Fh%E=
System.Security.Policy
lTx
+B6@
a t
Y)[h
[C6X
/Vm.
zGR W s
RwgH\s
+mu54Qa2mUH
(*q;
,Y M
{vFS
(%Um
wc)D
dB"H
m\ y
r;#Y'
tYsO
UT8: )
T*DU
jPVU
G kQ
pg|o~
l2e_
AVp,k
pJlr
?=-*v
{1?z
.n<
mG d
!1#en
(M5
yRcu
A#PSa9
v|Wx5
set_Session
-@O{
h<Fc
kblv
` 1uB
\?{:y
i5p8
MT^]
u#pLdd
Oracle Corporation1
?pu<
kCgt
(!9(b8,(
;M4Q
=&O*
]'S& %
L<wB
on(<
6j 7<
5S,{
https://d.symcb.com/rpa0
v*B#h
*vBa
8L{,
=./F
H[!N
O_)*
}d *
0k])
PD}*g
:I6q
Hf 4
}N~.
;qQ5
5p`F
9]t
rG:AI
Xy]a
p?Aq
whJ-i
ldUH
Su7ia
5zvW
A~d J
Mmc|z
g6=IHO+j
3Tx8
4CGn
teKB
7"jCsz
IE<e2
eMI
T`:rh
f^x
w?b/ Fd
vOId
x- I
x8-;
OYh.\
SuppressIldasmAttribute
]VOx
9)~
>L:J#
qszD
|xa
M}/TI
.$R`E[
farH
Ct6:
LAV^
C,$|
Y/')+qH
)r@,
! kn.
:W?K
j$2#)=
3^-m
W S np(
u'/]
]fK]
]zvk-_
iQ 6
EU*s
| BXv
+HD&@K
hCM~+
?VNM
$$zd
atix
VnsU
p}e_
B~ iz
|GBl)W
KO#I
d NO
F- 0
,^$tN
J zN
.,a!
,ueZs
vdvM
"$[d|
]rwm
L3G0b$
|_j&
AF@M
r.=[
</}
9\~|
A_K3
6}/"
Svn|e `y
{*-O
q+=V(|
Z")#i
?E?Ig
U? c
C&JY
C3,
-&%A
gMYd7>
0y0K4
rA>-D?<
glYe
R~n~
qypt
s2KEJ
!y@'
Cg9%
+ D8:3O
)U]B
t[L?_
Copyright
rv^w
WIu@
\pAL
koW@
daPU
b`X$R
Mv]a
={,9
]o+/
:FPG
\ teh
i~ah
UCtc
SOc/
`Yi,
M?vM
hBpT6&
?c'K
I<UY
WT~b
-G&
qb7w
-w=E
lq)m
*K/X
set_Item
[sl
AWvi{M
&2@
'h%K
?&!H
G"/D
*eYxE
p.|e
QIEf
O@")
`{x[
I`!NR
743
{OYF:
z}[ rP |
E+cU
K]c:F
U5W
).MZ
K;~/1
\n8J
~@xK
"[$FHW
a"nS
F|n|
Ed9t
b6qc
{tC<
+2&6A
q6J5m
8Rf{
^ `c{2
57(^
Vtt7t
EToK
mCa<
|}fs
|ZQV
fsc
rp%I
#z2i
k "
?<t0
CN`KP~(H
DwJa
#http://crl.verisign.com/pca3-g5.crl04
M_iQ
|]g
0o%l
2,nn
FJQ"
X8' W"
lBCL
p`A&@
Hd'F
TdYJ
BoG3
--3%
8w!~:
]eJY
#YWK[
difKE
N/{%
s9H wd
tAOZ
Enter
vIDAThC
,dS
(Symantec SHA256 TimeStamping Signer - G2
%\4"
Nj1SvW;
I\Ru
h8W&
ex..
B&vh
SY 8I
?i #
!3^;
DhG3
swcG
(}fC
Y|-^
IDAT
1FA;
'6r}
ES9J
*Plg\
2>}JD
yRm{
Oj`;>a
N{I9
,g0WNMZ
y+61
{r;,2
|V_u
xxG:
7V|
H?UE
l}v
.+xr
EFAn
6hS?&
;Vrz$
bvg,
,+3Hv
38]P
\vnO^
4oB+9t
P|7E
eLO-!
mndgrhsz.exe
dGeh
eWLj
tX($
X?ef
#)L1
L'"ZA
"Y/K
Z>{_
4B
s1k$
]lf8-
8We_
uC" 0N
!$ 0
(2Zg
qtv9
9"hk
eYm@
$Q4g
vA]Y
{_8R
$a$Gh
nc u g
]E+B5 V
k}Od
MtwmH
r^YQnS
-~Cp.
{f?C
\[@e.J@
oO'S
sT$/
Bys2{
Cf'B
e EfW
2B}}
E"\r0W
^Kfy
r~a*
g\l#f
%^GfzP1
C{>h
59!d
GqA^
WBT#
>tvv
([PF
:blv
TM1I
8X?l
4',<
@b0u
yh2-r
wl=hJ
y] ~
5eLY
bW6U
&x\@
Mlz3
\h\("
\WwRq
k:I>
*?!v
!]M &*
~/dM
i2eg
cT$
DJe?
jnS
Dn:2
AssemblyProductAttribute
8aj=
JZ3R
]v"9w>
JP9I
Ne{~
<Module>
)71E
aT18
#P1A
tKvp8
3YGX
ZRs;
]+ 0
b6L}S
:E~h
%Ue0
HMY+
s!GS07~
0NKS
O`3Q
;Z*^2
A0x&F~:
xZ\*
)71
#%HmM
Bamy
[ yy
0"d+
] Br
[OfBg
4MCQ
hz_f5
QP7 f
G_L#
$XBx6
.TA/2XMsl
Ja
H{*l6
&b94
<fRL
1KQ(
#M=SM
r|2N
bX.W
+ )'
,bbF
U/O
a@Pf
U_ =
lNPR
F&L^r
@"kw pO6
{#$q
64UD
+U<L
td U
`Hp+
rBrS|E
s Ekq]o
'O`z
]ElS
& `l
! bl
vpKZ
`1i
!4$I
/9]6
j$ &9
8 IC
jJ3r
wi1SA
+xzr
S* rGK
Symantec Trust Network110/
9NS
\yyg
q7nw]w
set_Image
AX1<p
x[S){y
f;{$a
kQTE
7;>G
VyGU
9?U
bWQw
_ehs
[.VTe
hkTR|m{p
hP''
)!Xy
>yw>
|&{
}m% 5Oh
gJ8G
WW/_
fjD2
Pz=`M
-NF5m
F*&8
g__p
?x11Z;
-0+0)
|P.'
~X?)
m3%>]
gDd]
m&~.'H
=juI
{sX.
GeneratedCodeAttribute
OW Zm
b$r!
<Ps#
@E]I
cz`~Z
?r{k;<5
! %J
u>me
<9fP
rx.*
ao@&
he.
H.o#]
fOxm
#y x<g
PushIndent
yn`=P
~^))
snpN
;X>{<
<I1?
)2>;_I
} F&q
yS2@%w&
#1v
C!fi
&fEWb|
bV m
#AZ0|
V{HpW
qUbzzu
ydWK:8
0Z,Y+
7,N~
oEE,_D
9086
CxE\P
:KNt
R}mt
EpRQ
qO[s
tufpl
:Ix>
I_H1LM
.pD~ x
E
4z54
^QdD|7
t*>A
WK#7
vFm.
RWz
set_Icon
System.ComponentModel
ZdB
r'bF>`W
i4 Pg
Thawte Timestamping CA0
:+@q.
]l2
K`| OY
[)aG0&
CzmI
eji
eVu b
aL @*
N=|@
?s/V
f \EL@!$
bllMp
DU4U
}EID
)54o
j}d
lwnX
p@As@@Q
S}E5
S|0y>S
zt<;I
s]W[
ti8$
4dBV%
-e|[&
~-b
*E#1t
\?W~W
)ZQ~
Hm_Ez
t%Da
System.Windows.Forms
D~~ !
`m#M{
(HU
D1m4/
bBTi
!X486<
B_U:30
#R%(
]1m3)|
,E'}
G9BNLV
6l6T
JLkI
Q&L}
>7%0E
?d6
[s[C3
{ {7
F^"8
]V"^8,y
f=9G
hWn,!J
57_;
(0g4U
", ?
({v7
v ~y+
soq(
R /
39\/
p <)Pm
}-!o
-da6
#?X$
|@E>
sAJ5
{gEW<
'L"
"?n(
e\NQq
hEEh-
UpV9
j ?
;>2
i;M`
A#0c
.BKt{
6$QW
`Z0:
#"!u
rirEU
/(N
;gF%
<z[x
eA7A
`_`f
TgoZn
2KaMd@
( ee
121018000000Z
$,lQ
nKIH
NC%
B S:
_Z"fV
Hyh{v
4#g*
k{`qP&
UoqU
PU? D
H%/<
n @v7Wa}
(tF[K
add_ResourceResolve
<PrivateImplementationDetails>
e{'l|"b7
Ax9 F
4nt
;A!n 64
) pb
b\s~g
jtR;
k"LL
<T7*
N\.
6,CP
lGs*L%8~
f}E"
Xw)L
Mt6V
TY~`w
i&7a
AssemblyTitleAttribute
oWxjW
}1tlT
AQX-
9Ut
O;6
+g9v
As+a
gHIh
$S']
:0pnca
Ffc[
~.ei
T :L
*QS q,
?dy8
,"9 '|
:!zo
&^7C2
u`c%ud
M-Wi(
T/#7
AQ!9p
O?9l
]" |
DA9:n
<B77
System.Security
rfuF
:a_C
WbB5
`h~Q&$8a'I@
W$^,L
pZ'u
mndgrhsz
?&W*
B C2
sS^X
(kU*
*8s 4j
O=H^
l2!>
,lNS
U|"h
12[~C?
pL/
W2ha
$C*W$
7F~
K n~
(OF~
U'67v
ZopD
S5j+f
EQj<
hk 1
y=4
p/eb
([ hv
o,>zw
-z)`
%w8 |=
,Zma
j\Fs8
Z.[|
xi1?
eo::
7^{~
v68Yi
@9X5o
L.BF
*#^H
hJZ@ uJ
ap&y
i{=7b
(G0V?
R=-S
irN~}
(Y 8#
s}3(
qH7l6"G
OA'T
>"hcS
-2Q)=&
LJ=\
soR*
J}_OL/-
<5ue
5v#
?b+o
]B:A
GN1i
hR{D
%tD(
]"um
cZuX
W$z+
L<wf
IiH>
9Tiij
HL5y
vzkL7h
'o]T
wu<2zE.
B8<&
mYux
J?JL
:3U6
D>bn
_N%j
I\
T4Nm~!
3xPH
sO9u
&J@<
E6w=y
NR\;y
>.HsC
bg;"
VA=`Mb
k6Oj
kN!3
?y+'-
kF1H
QrkYRhW
/ AQ
]MSovLw{
?G0s
RZ(> Z
||HV"m0
X3z 5'
2GDQ
'w7
*i7ep/C
5)R)
bLgp
4T-|,
!$+?
/ou_2
:f0 BA?
+jS{
Tcr;M
#@h/
+ TI
R- O
p*b\Y
5?^1~
d#.h
d8"%z%9S
Nn6oc
` hV
E"NM
cbD[
#R7~
A|+5
~v9g
W2RH
m`&?
ub<zh
E"B5
'FVV
t P?=^}
tm9LT
fav!
:Ge
}VQt3
sF`b
&#S0
iI WB
iUj3
&qh>
@(5 63;
IYN
x.Y
zZ#b
_zs9+
A/Sg
nX9|Qaz
N#9I
_%V#
+sD@
&,](
@'%I
)b8(i
;$jz
0;? "
[ b o
_1S,w
LSa6a
vk@^
fycrT
WY
Kb X
^Tfq
@M6c
r#Pq
IX o
2Y= $f
rdvy
J |`
4~);
6D^ 7K8
mK647
=)Rn
bDWn
j.!
~v*Q
,<ak
]G:J-H
t#F4
0#3pl
bp&l
Qa}`
ceMy
xlM8zf
'JKcK
&Mk-e@z
mQM?
L'{
st;4
^HOr
BvB ,
lqd.
?.V,
6PmY!
/5X%
9,b[K
w43p
nHm>
6}+X
{ XLmk 4
#Ki%,[
/6T Uo
L{1D
exb6
5BbS
TD?Q
http://ocsp.thawte.com0
+A E
tQod%
8zK&
)3DF
as
hyB]
B0Gzf
S~`D
{o5)
CompilerErrorCollection
NGb]a|=H
Gh>?
GS &
v4_8
wIDAThC
,hR7
2Terms of use at https://www.verisign.com/rpa (c)101.0,
?u[y
-R@G
.c ~
IkB;a]R
<j M
~]<1*A
160112000000Z
QL_/&$
S~~GV
R+-b
AMa 2
He;Iwta$
[|??i
}+S*)
rv"T
\% E:G
/@]1
)tDgq
-_dp
lztWT
`I7I
ofUS.E
l?fPe
0&KO
)-J/
wT:
k,",;
*=${
M,g/
fR92U
V!-Ub5
|%!
on;BZ
_d7T
_]$ytF
Gnv(
` Z
<r|]
jOC
e;kO
lhpKW
j1d<)
@3#w
ne)v
:+.V:
NL7m
7H/m
6M-:w
/~zp
- ul
5CB9E
`m5K
a8+0yE
VeriSign, Inc.1
Ea>Z
#%lN
Z"FV
gWeX
5Y?T
||?)
JOMgxK
Zw.U
%r(. f_
#A<L3<
@xdrn
B10Q
7%7.!
W3iQ
izaZ
K~[/
c'N1i
Dy$
56?uQ
K>bx
l(b
,E%5
]YC;
QN4a
F~g
G%(e
Y&f)
?<%'
C5sB
)+`*\
a[%:
*mme
mBWR
a<l
image/gif0!0
xAao
p>!#r
;nwR
8K8\
2:RSY
:M9
i\)]
5|/ (HIt
?'Ol
-4z4V
n,i]
rQ[
[M3~
=1L}$
L E&$
Asxk
HAA5
? F#5
.fO7
zW;d&
rDh?
j]5=B
0^1 0
9/4[
h=v
9UTB0+
0e9
V *a
a&FZ
{sq*
>nNZ
Ho?cK
>)Y{Y
[[[ G
HG L
+9.
?u{EW
3u'
.6770
*: p
D3=g
Y U
R-? j
%+U \p
H%-$
q3 +
J: V
+`mMSF
7B!L
^".H
<R|XA;
(()0
y. e?
)%G
saB BBvGp
' v
@:\-~
Y <}
/Q~u
!f'l
@6`U*
6n?N
v<UR>
KrZJ
k@`}
_@f#
(Gp#
90Ewe
i@s@
uA0q
Mx@
A~Sa
Kez ?1
c5c)@}
49 u
/VZO:2
Xt|F
]{#S
HG
DLb}
a:G
q/{M
N 9]I]
dl r
d!H$
`BuS
KiK
(R0x@
vguP
w'%T
xm!Y< Uf
$oJ1
A!XC
j,Yw
t!CW
&;FB
>hx<
&"nI
qAN6
A(Tf
2(K
i]I~Xirg
56e.
HtC4
4Ut#
t{@l7
]L a
tMOm`
_eT_
@uet;
J^={P)
m|L
r[!I
4Oz3
-Je"
'%Kw
F3Fl
rf%[t
#fy6
c"1e
e0c0a
SC;Wb
UF>+
<Pj4
Invoke
+<9I
:'Fz
System.IO
L# #V
WrapNonExceptionThrows
vRO7
&x.*V
$n! %|
b\J;
Y@ t
= .@|
AutoSizeMode
5/>3
Pt#6
O]wm
Errors
2uDD
aS @-
c83U
2&*-_
*jG#*
g4Ac
<Iu`
XM0F
3.s"
get_InvariantCulture
s}w\K3
(%$.MW
@1 w
Q\*aWl
l;!}
RuntimeFieldHandle
y( v
g3>s
HxPq%b
J&SL
8+:'
Qk c
>fuX
&*8T
OB.o
L1&L
q;=N
IM93
tC |
&*8]
F &z
W!;M
_ 8zi
4#D?
&*8A
Z/(=Cif
awnK
WT]T
&*8I
&*8t
-5@$
u_m
&*8r
&*8|
&*8}
&*8x
&*8d
&*8f
; AEYNT
*\?:
&*8c
V((M<
qA!~
nA%InY
&*8i
&*8j
4 M
6:OW
r4$~a
MAT?
$oio
mMOiX
uLZwK
Ew8 ~
fQH?
@m|_ @e
RuntimeTextTemplate1
O6,W
Sq,t
!!),K
BfY@
*Q4g
p5 N@
6'!i>@3
y+W~
R7T Pj
_d*@
h.Nh
=a9|
PJAmv
c"1+
DJ~ ll_
j0Z :P
Dictionary`2
g5[t
\oWT
`= _6
T*N
L[^@
6Y[U
4| /G
J]:H
"6 Y?
|*D9.
?I4,V|
v38m
Eb i
Pd'UB
IF[s$i
/j9.
|dy
r`+9;
9^jB
!0_|Tf
}nA7"{R
]< E
U}`W
C.hv
(>G\
rzjHQ
G`"1z
'8W:
Qq34
{]KV
"YhN^S
o"t\
s(L-
Y_fg[]
G* h
}m$
rSHo
-6 0
=.{n>
]NB]
$H5
'Fp!=
\rw
q6 t&
2ya
?''p
KU8d
c(i<h^Y
]X)E
Kjb]
oMIN(
-c~Q
JXU|Z+
6 ,C
_%H>
4W[l^
*"w
6'k
< sl
jRK-{}@B
U?4?J
.*5R
HGb^
^gbW
:V`q
:(.(?
CXKQ
=SK@
-g|$
4vo
\J@|
4DW
>{B|
FgQR
b82e6d01-dd88-be.Resources.resources
4 E"
'Fy
bfnY0
:c(R
P92K5 ;
$0"0
,5uo
zNSy
gx k
wn&?T+q
1" 4
k~R'
3eT>o
}-jJ ?3
$x Z~
Am<S
Yx]?
}7Jk.
Xc TAK
m jd
u}DT
?(bl
yj!%
.TuA
re~z
n1Ue
{$F[4$
J`0)/
1QWd
vahs
$aj
r4?T
i~#yz=T
1 0
JK*k
b07x
set_Location
#2D\
tQ }
0;F8o
}nD
xg6$j
baFJ
[vrm
z+^J
|U~-
;9 vg>
=zQ G
5P84c
hLP5.Z
t' Qy
Bkzg
qJt
fYQl
$m]I V
kDX_
2u_){
\SrP
7$f<g
#4V+
tPnw
bj T
30/%
2qWP
1P_u
+VX@p
FZo`I
http://sv.symcd.com0&
.B!f
aA7{
%BqW;Jg
=Gv`
@cOo
;.Lx
kD<g
#{T=
! %}U
CurrentIndent
xZZ$4<N
Washington1
uEE@u
K:pJ
v[it#6#8
l -s[ng
CU|B
%&;
ZVpj
_<NI
,o,veU/
Q0og
C *e
NESK
=@<
VR8];hV @[
CWyd
FHP;O#
CG0)
~):`
,h^W
sDt
[W9|
;n :
l;5
zQcU6w
)=$LqJx
/4 c
u;#;
J"DS
#M$U
eE$)z
7|av
oR U
J@ 4B
G :1z
Z;s/
L^E]
5x&$
r;k
Hgy b
Session
$baKN
6xJxo
p7\=U
M;Z,l
JBa'
O^t~
Y +
j#{E
yKL0^
O =W
kNg!3
c*k.
CIa5
9FmUW
VB#1Mm
Xu/}F
|Go8
LH6
55<"
jLA"
=="T
JD x8b
Zx+2
ParamArrayAttribute
G6p6MZ
K2s)
p{E?
Z%^F O
fgeB
/3|>L
F 2#
[rdVT\
X(YA)
q3DZt
0vEu
ip,v
:Y +
pZkC
T_N(
<i 3n6
A` 1f~_
Symantec Corporation1402
rlW3-
hgl6
&qX@=H
eC 0a
s p6
kpvMEp{/fp
?l^#E
hPM ^Q
E Ra
xc{G*
z:kw
1U>A}
89XQ
~w1|
k$/hF
3`lN hU|D
%V.[9
(7OfF
UCW*
SwYT8R
NA"a
)l X
Fd8^
^@d/
JYM5$f
}' v
ns<[
(A+0
bmT~E
^I^&yc
3!h#
'9}
(P,S
a{ $
63?9b
x f+D
VC|
Sq\<
?me%
t&o
xz_D
(w#b
@'DD?
w&dc
M\^K
-$B.L
^ glo
lC+
'U l:i
"LmCz
.@ [
d~uM]
p#^D
a`te
wp t
VR W
hY~z
AJL~M0e
'CE,a
/d\
zI@W)
gku!_b
g\~}
Ww7P
E)$|
~o65
98t\
TnFV
M .Ax}
=aGv
U*0AM
Bi G
bei<
K&G-
I2T-
`,PT8
XEek
{u4d
;fGAj
'v.F]
iC3^
%x:Zd8
KuV5
5`C]
a?CxmF
< N
B<sO
)ep]
2[a<
iPuu
}t8%
x2 z
H )} D`
I4y0
MwgEW
k'h^
%7bl
5l&z0
(3oI
tj 7&0
g U
_9Y2
s{n%A
] `V
'b6U[
4EBb
DxTb
ZS
iX^HV1@
hml)
0N~%
d-z?
n0L0
G@,.
Gk#38
+Y~4(d
[6(
1thrK
&`'`N5 A
{<2g+L
-bc5
zbT1
15&<c
L%pu
qx{~!smr}
~2}G
#E]Vk_
iYCE
,B=x
?6O<
R[Gs
E~m*
7nFR
TX\{V
add_Load
'O`Y#;
l] b!
1n v
n?R)
"1;R
n8l8
w2c"
6_4U
Sxc=
]) O
4|1r
jQ`=
x^>;,
?!l? "R
I7Nq
sO=V
1IET
+Z``/
u- .Z
y/*
_0]0[
q7[Z
n lM
6+md
XD2 `
d3)LC
S0)U 5
YU5@
k fG
W^?C
WrDdd#Y
" 1=
C@)s>
R(Pj /O
EnF|
E>+FV
z{bL
H[Ru
_l;:I;
get_FormatProvider
<uC
gp$n
8G
PyN`pf
-;5h
R}hYr
XCuFl3
pgS^
X$j8V
,j 0S
^KKd
Y+Am
h )K
+M E
xClS
h,_c
qdP
L!;K_
1 -1
Y! @
z]AP
;LU|
bB ?
}N*e
3 *\
disposing
" %
l~%T
vBO{
A\ @
HN/
zvz -
mKd8
16|N8n
S}]3
\ u7
,Z{~^
%0wn
u&gu
_Y&-
{M,6g
W `#JR
%0w`
[cR)
JQ^>
[1SD
d*iB{
'{Vt9
%rs.D
3UE>!
"ehS!
"Ur0
YW=ig
MGL:
x|!h
58\<
tN~Y
%Bi!T>
fmgNP\
M?v=~m
PC0
#j?Zn
N9v=
y&s 0
5)7MW
.gCR
#w\M
{u)v
o4KD
-Z| E
Nkd8A
10z[
.B~Q
&V2$
Yz<2
4dvb
-\X^
E\xC
$ZcA
.PoP
s7C f:
k]}G
v;|hsy',MNc
~27?vG}
8"6"
NzP@
:KHY
jgkKoa
WGIY
EN3n
k- `
\8(~
2OC{i
ZW<)
v/u{
)?\~
UZ"/
{ I>
5.o~
`P{
hMJ^v
dK`n
F @|
""*yK
qlGt
0w1 0
J n8,
@AK;
+HsV
}& l%h
pHN"
+HsI
{$ *
D @0
za
4=)bJ
]&5J
B)^4_
QZ6_,
c7Dh
U|BhCH
fk\F
3if.
QPe9Y
A4,M
3>ZLe
)0p+X
UJXG
{j$C
o[T]
jaDS
Q'#D
RsY$
qX(1
G*U?`
3R|lF
SO$QC
Y 87
K0q
$P1=
5)3M
^X^7
f|45
]<Gn6
Kvgj
+O;Dk
W`:]n
}800
eFfBj.&
A\E_
ry#[
+ojr\`
UjB-
#q(8;
t!15
Assembly
B]?+
v>nF
D6ks
E To
?Z2m
hk'`
o'k?
yl(:
6[8o<;3
VmOO
T,|G+=6
C~w!
%+Lb6
R_Y{
$|Ko
j]/
OD\s
m4359
D?%{{e
IrKw
q;;U
$,b+/{
KWx'
Z WY~H
Zr3~
b1cF
V&VCs
?0AP
o|-H
E^.d
&,rD
`,LE
kkT:
zu9}
xR\\
!2HIDP
set_AutoScaleMode
E9pd
yq=D
cH_
&%z{
-N f5
?zhn
k[r H
}3M
YeDI
V H
X"4p
@x|S
g r:
mls
<!cd
g r,
J8#J
Ua4 p
>4<LK
z*@h@
yg+XI
gpIhzt
zp<a
-;R*
20170428153713Z0
Lnl bCL
4zE8)@
* H<E.A
ICQh
\Lu\
%T,c
~aer}
sE4
Is '
u[N+7*
$eX0
NQYFS~H
M Y
<&KlR
"6lX
;"kx
CXQEb
&<If4L>F
P.iE
z0vV
KdO|)
xm`S
gsoGJ
D=uXBp.
`E P
]*~C!
G?hN
6Fm3
Rc00'
TS3E
0O\{
[=*0+
Gm*"
S5&PE
[Z6J
k!.X
IkHrX"
)>W@U
Wwn"
"b%^K%
YLTyQj
Y& *v
fs2,n
" ga
p 6*
ub0
bFr:
2R=t
Xe G
?Pg
80604
lNdf
+<I&/
DzGrj
I{Ge
Y0WH
#>a(
GS~I
K[!,-
pb; '
cabl
!xDs
5pWA
bN%
1{/zj
SPlJ?
bd}m
y.d %
tV!RU
'}FA
0Sl:r #
("$hf
8F'!
?D^x
J kwO
~|=8
626>
}b{a
$7>%
%]HC!
eDK!
~|Mj
Y%:&Z
"W*o
OZ*+
K~!5
+Z:
LqhK
@ sp
DinRUp
D?B Z
$@V
_zWl
Wh 2,
=r*5\
sP.[5"
& u
s U2
?5q_K
l*FE
{J"s|
NN7vX
aB=7
0C h
v,#i
a;EQ
]&P~
[+(|z
2#94
aa}?
)/9E
tDZUt
!NWm
EzALzt
+zc i
jA 0
N|C.&
6Ud!
Knzh
n4F2=
(L\q
'nsd=M
\C[e
Bza
;y6 V
o+L^k
kCQ
u"!KS
$ 'd ,V
M1}(
dm^3{
[VZ>
f%1A
9f`fx{
[<7t
T{"D
7CNz4
j<B9s
3U/S'2
4jul
wR*(e
Y_t,
,_*U ,uWl
N0L0J
RY>i
Thawte Certification1
-UB_
enF@
v~ _
<MUGUq
o-C
7%qO
C O p
%2Vk&
,j Z
le2Q
}l z
QiU~
X5@^Y
[kgV
$0J$
~dn%
>[xA5
?WT;
8|np
@.{3
>})q
>/A]r;
9Mc?
y3+.{
oj^X@
,)z+
v \t!
rxx5
07\)zF
A`7_o
`Jbv
u=V/TZ
9Q7Wx
#y.9
t N{
n Zq
kR~9
~J <
http://sf.symcb.com/sf.crt0
YksWDl
H%f
7]Q+>)|
Vd7H
8UitI
|@X@
qr{f
e[8e
$d`~
jkT*
<BA0
SLS!B?
Y GM
B\=1(V
!/ ,
SuspendLayout
q\Sz
Rw j"
kOlJ
3hsI
w{5g
Fi0ZcN
Tk<\
)N[|
dv=szg1
6dy}
n;,B
! PS0
%K[H
)r\c-
GetMethod
$2Vc.We
Li+6
G~)+
\| J
Y5wl
/k]Z_
>ggSl
KN3X
I:r\
ZdN8
N@%;
WRopY^whU
170102000000Z
1KhaFIO_
U\g/
`044/
BnwqBR
_x>4ru
wx..,e
}fn;V
[ !1
N@_J
>G&d
NAxY
,L"v
h3RAP
_;Z"
!I;T
J/Uv
A`WK`=
<?Lf
{Y1x
B "PN
%Z2aZ
m`JI
\}7T
Z6hq
^m-+
@fMG
G2RJ
=wfkr
/f2Z
http://sf.symcb.com/sf.crl0a
Fr#G
S\eJ;X
wE;G
:Qq;
JMt=
jw6Zz
|<dF?
^HI
^ m%
ooL
=ADA
K()*
/C8H
aH%S
|]rc
-W&F
/W2t
w^2E
KTHJ
=v`
%:I)
-HbN=
vF2
4b2k
6W1QN
&Z@0
URfz
[F~+
Yv&ZN
0Tluct
Xb p
G~)PN4
BA '
Ck]!
y ` a
W:F&>
{-_%
AssemblyDescriptionAttribute
>a7sB
%~Wo
K"hj
[ 6d
+0$0
Xh,s
&0Ws'=
h8$$*
x\ *Cw
Ayg3]
agZyU
*#{b
/j^t
E qi.y
Y<_
h\@,
{5SC#^
+(^_
Fysh.W3
4lhZ
M>dq
xk4J
v sDE
S;n<
<r&+"
?`"X
;vle
] M;X
#M /
l>mEF9
n9_L
X!jzcp
uhw!b
Gh )Qr
Ls`w
p%p&
b pGP
6CV$Eo
=R@0
0\gs
Ddz
YM>A
TransformText
vMAW
qO/[5
rhF!Wo
'5?*
g,))
4:T.
P:o
7UzM@
I!M3j
\2d01
D;nt
|?=:
:12-
: M)QL
d(#YUFYs
System.IO.Compression
AiTB
eM`o
s2Is/
XG6&
g?1I7
*r}0
.LV
Fep ]
&2wg
TpX u
>Oe~
~c
R J&
=4p
XKF2
# Qw
8<p
6 1i
~aht
(L9
~/wm
+&tu
L62{
~w=?
'M|x~
F-4g
s\m=-
D& [
'] b@=?
(CJ6
}#Gq
xeMw
set_ClientSize
X 2j
S}GFe
r#}m}
8)<~Q
pK' m
opbX
Q;*qr,1(>9I}
XU,%T
&OL$J
;_I|
12%"
\F/:
x" R
Sgd(
gtXZi%
UL<W
h*+n
'cIP~A
Gah08
rHr U
:azxoCKq
FV%\]0V
s^+)
|:Hm
uSOW
" = (1>
|A'JKU
w!Rp
Yk' -
^|)mp
7*2QG
0{>`C]
sB@pa
1X~7
sJ*R
~-q(
\?oI?
!r</
,`}
4+_j
19 <Rtr"@
@+b7T
S*1W$
o3haR
z2{:=
u~,K
E
G :rB
A,f"
wW/}l$
"=?"
^40G
3z-g
010
?IuU
HEIh]uE
6Pbh[
}G9[f
(?0-
gt< g
Izq;
_AppDomain
=S|?
M5"4
~!]/
z] i
j2]=
"U>e
&0I}
W%UOl
PGOf
'Symantec Time Stamping Services CA - G20
dD~f
j )
{ @})
8}kIQ
+3Rb\
gj ;
t:]N8
Y^8'
RV Q#(
` A-X
>eCy>>
2o"~h
oa\Ulq
\6 v
+uC+(
CaqL
[3 \2
qdQW!m$7
:=57
*B 5
8l0-
(,pVvH**B
).g>GL
!GWS
j~w =3
*F(k
|g9k6
m~'a3\L
^^oY
e
[O^
"MT c
=Ke^y
=Xu9
7AHi
,.LF
'2'X
nA]Uq
%Qvg1<
TuK'
>u*,
EWtj
5OI2
AT 7
'5|xQ
Mh*s
y\6Y
d\[@
KA )<^Gz
\I&=
t4)Bz
YI?A
cT' 2
gIA7+!
GR~3
l6mI
,2l/
P>Ph
sSZK
0W^o
MVv3j0
yoq;/
?+oP
W'+r,
,O<K
6E<D
l7{|
nF[X
44W*
C t
>EZhC
W>pC-
b'yC
Qmwh
?m)0O8l
&#@n
nY94
4|Pj`D
kvU'
ISupportInitialize
Eo] 9
H(Q?
3FTf
0AG"
IhT_
GLE:H
!tBS
TrN,
/:;T
7{rp
3ClO
s fs
e( e
vtg&?^B
k>8*?
i6,s
[U$e
p- +
iMrj
D;4FRr
v]FE
q)S
h!qN
Q-un
$Jm;j`
ja]4
L"3S&
A)7#
r _b
-oB )
0voX
iW#|
2_!{
#h<iS
N=K}
=K;?
.}-\=B
\V2<
WuFZ
JGf]
;K[x
;d($
ApGy
E9S}
!ZN(uqSC
ADE2Iej
:eKC
vi+`9N
C xN
ft"R
&t.:
')t~8-
9 ~
9g>S
`VR0"d5^
W wV
>Ujn
Yh*tQ
k C
x<.T
$}7P\&z
e @f
#+ZJH@
1L~T
AY$F
:/@p
LZ;k>
W)f$
G7s<
ICloneable
1`R+
TeA9?
d/C .
j/cL~1yA
8N}p
B\*qmr
6I,}v
OSD,y7m2.
&0$0"
>?\B%
*.=_
_b(xz
ZxFXr
\5dh^
6O0
oHI9
iw,n
)7VIl
<*HK
\Y~Vi
qqsD
Q#+B?
M>bV0u
b(64!I
g h6
200207235959Z0
hTEP
lkY
,5?]
am/j
e<J?
Kdvt
Pi;U
, W Z
F: v
Fm7B~
OS>|
[2U%C
G$nJ
B9~Ro
iQPL
zS2H
+, d
MrJ^
+RKb/X
o[rPL
92yX
k'I8
8(K3-,?
gN2V"h
#% Z?
h_wX
$!'_
&o{K
\sw9^M
^$~.
Q>_D
&eKt2
@'-b
! (u
c3U"
.3<;
1s,%q,
z$YG6[+
pP~
aA1C
d^B<
}-jb
P7 It
J&6
N#L'wI,{pD
n&@I(
#Ai|T
Pm8$
_f*~d
U+?oY
'j{r*
E?-C
jp&lbZ
7[DWq
.pM
5x{'
gWGwG
<~ 7\
AssemblyFileVersionAttribute
H.c*7K
IX/=
&9i0q
Wb9I
.cD@<
Ri !
` N:
y$Ny
H]g$
wYjRR
OIgx
System.Resources
DeU.
K~`
By',
C*z[
w-qH,
hE"
5Y)<\
L83M
J{e'
ZBZ7f
5DHJ
0|cMz6
(U$U
zv"m
ci3
u I4
*`6S
G[{c
\J-bH
7:g[:
TimeStamp-2048-10
EEq/x
f@A%
S2r$T
4/ 4C
]wMk
XBFe
"7uK$
8)^?
1Q~+"
nH=F
39!yC
u@C6x
V:b`1c;
akvd4
Evidence
wGnj
x-%\s?
wp7~p
sIDAThC
" #:
< z>
>b|
xFV
9(o`
SW?wI,
!X*O
gE T
L?g3(
o86
g+#
W~}E
/"])')
YH9;
231209235959Z0
j(1 z
TY]jH
P`2)?mPV
g+#b
L1>n$w"
5+mW
!W"k|
FN&q=
d*`?
gx .JF
Z`-l
"2( e
?/nl
F/e^_
wCP]IJ
4/=
.1zC
jl g_
'+=\
=eb' DFM
)u% NKq
I56Yefu
,Nrs
%TGP
?xO<
,\IEk
;~5y
ndeH
QHg#`
d-a*
jD4A
Ou[q
Xd |
44q~/!j
h{[=
FX(MY
132Ax{z
$i'u p4
uC 7
TZ$Y
g0+!51
6[?[
@x+*
HfmC~
>Kc8
LCR\t"8
cE\~
sF?\
:; -
+ dS
CZ^!#^
.3 ]
HBZ3
R h5
201230235959Z0^1 0
6;e^
6whVm
P%`M
GAVa
eXz
yO6Is
!*zoN=&
mq[.Rx
,``h
' <
1o3 4
ContainerControl
fet@O
6 -eQ
TeOE
V#fA.
8?5\
;n
s4uY
+BYY3
s!J/
E *%
B,n[Mu
3[qy
,QT84
w/+p'(b6W
R0hH
*3y6
A? T
d1&9
T 7gi*
i|yh
nIFkc
x@qut
fIrq
M_ \
P(!IR
s K6
MY\s
{]D
HtK
+{
&hPK
4~8H
yrQS
KXet
]jxdE
mX-IeP
=k~d
_+}=
z ny
o !cc
W)Cv
guX
z(FUW
S<kf1
qd{(?
3NI(N
>2hM
fM*-o*~
u(;(
+Luo T=
|2n
C\,<
4]9h
GYL445
XC}T
&W6J
Bhtuf
*P$G
&%L3wBA
SFSm
{6SB
)|uq
>\U4
2[k=
6hLQDp
?AxVy
;;ilv
B<M_
)JA@T
nBm $
1\'|a
qe=3d
2<dM
I(k
PUd2q
y bl
F\D^
r/?,
DuH;
Embw[
Monitor
q9GN
"YEt
t*{ .
#u,IJ
S2pYU
1/@Cw
]^}ZM
>[]
k'RP
^ n)
h$1R
^}?`
5'DS~
b6?V
t Qg
~ xLZG=
lftu
gO7QA
@JIii
`\Ytd
a%R<b
/n4D
GW@]p
&>pyQ
`s@8
iAL@
O%]h
+K\C.
_g^2
[5@'
_Assembly
$CE@u
{" -
g4p'
1KF X
.B<(
P1|8
][C=Z
O4?!x
D6At
G#JQ
AssemblyConfigurationAttribute
;)*z
.@( l
;rsD
%'KMN
o*x9
@\h_
RBW?
@Q^F
CultureInfo
eD(8
\E+>
NR0|
oi]*_
fv}e
R&[q
*M{{)
7{pF
]jic
y!-c
&fK`
1R)y
0xge]8
|%g0
n j^*
['>y
Y7lw4
\o(_
_0={
j0Jk6W
`J4Z]#
h ,B
fU`79?
ta4(
gq2i^
, IuI=b?
%<cl
Kr9!
06u=
t $
pQww
a$O{
~Q5*
4a)
B<?@_@O
AO2~
!9`Z
I" X
1-=n
v%*y
$Qp*Ty
h[ r
``D;2%!
PPYh
u~j{I
.`t
1(c) 2008 VeriSign, Inc. - For authorized use only1806
TPl~F
$d?#
"-I(
8Gm
t&M z
cbAFm
{PA~
2-_.
[x_'yV
<\'~A
D<Jx
YHI7
wc?8N
"O3%
$b k$
Vd?X~)he
O#@%V
"pAli
Wzxx
nV+1-
&]GP
1_B P#
XPhu
'q *NN
D>bL)
=!)j!
L[u04^*f
><U*
U,q3*b
z]G8
K.rZy
=1h@
CJRZb
Hl 8]\
0Z J
{Ca'c( +gj
DYIm
P#:L
DAk$
8_@m
dHF=
;Vj0
P2 A
Vb>E!$
#2LK
L {o
QTmzm T
VS
uN(x?c
25_J
MI$<
@k@i
! &>
AssemblyCopyrightAttribute
&'}w
California1
yb|J
c~ks
OG>EN
La'y
iHz=r
Jbcu[
PictureBox
.M <
ggu#-
'Kx%,j
/;q
c`P:
G)H9D
x;|Fv
>H9"!
FpL8
z/M3?
45Nh
[(zTNKts
+QaO
!F0
eQkM
G2#=
hTG0
UEo*~
zsEs
>\q
rRC~
=< JjYN
MJ2p\mR
Ql $
qDv Gu
y jFj
Ue{ySk:
t}xk
X]*R
q<M/
jr@5
5 I#{8G
p\iSk
5] k
Jim)
@0an
B/2%
S(f@
dwW*
Mo&_*v
^NS
"^l?c-
O|&7
oPJ^
Z&2K{3)q>
PKPu
}/'h?
I(dX)
]z!
l: x
%:Ev
'nn'
aanY
h}w
8w=<
OLYM
.UQ2/
zmf#
(`f +
B/2j
'd%0
!6Cf
}s)$^
\,om
z?*r
>|i
Tj)z
Zq]%
1zaa
}Ass
?; OY
w,9vr
KE#`
$<-\
@,!bp
qp8"vZ
|)fC
{;M*
P=ggVw
_E$YV
=mm1
0#9:
+!}W$
wsOlu
` (!vi
Microsoft Corporation1)0'
\~34,
{ ?{
"Ri3
>$tW~
a%j_
5Fd=
fKi(!2
"\?!D
.mSKV
2oNW
+B E
p7~C(
-YZL
ArgumentNullException
BHgs
:cRI
dA}
P*cL
'W '
indent
aB$4
yR\-Q{
}ZcX
BG"O
(B X
T}e_
v2.0.50727
DYB]Ln
=Y@X
O6Lx
e.x
&oC w"
*B 1
- l
U\V;[
:GR:D
SgMO
Vj_a
PjKZ
pD`"z]-
@BTd
qOq$}
"*.@
7,ec
%http://s.symcb.com/universal-root.crl0
D}s@
x]1!
b=Ue
DI 9
1} +
!o 5
*Q`x
q3*d
U^9?
JY#x#A
Pf@b
Ybn~
#\;
]YYQ
-)S0&
eK'q
f?:kg
tZDX
BK8PjfT
WRDe
>L<%
>w\R
bj|Y>I
6=q)
.N={
U3g`
R(JE!A
eHkj
ofGg"
9b O
GF+O
3Oc"
h. i
TKr
$$b2Yk
34gCl0
^n/*R
~o&Od
DHx88
CLr!
<2k9
GyJ0
4M??
%jZ-!#
'0 D
II~&S^
@ 1`|
I~8"[)
PWt!
1#M:
+N*;
zuXp*
HT'/'D
1Hcc
63-+
[0/Z
Y-:#
>u~GZ$
4{4R}
U_$1
F -s
V t
1QxVRSMi
} B`&+
lr<
ev.q
I%|
n^aPV
ZA\s
?0bl
BY 8M
"QSR?
q'tqr
PebA
agHlNo4
V RO6
G25,}
AliKp
ryq2
0i}-p
z;\d
) -vb^
?p`\
X:gH@
ygQI
zoRrPTXV=
<i(
#HyP
Ds<(
fW 5
~Xn!8"
w{7r_
Kp\Sl
fz7vweA
~mvBp
m$]r
G<av(
1*?`.R QL\
PN?T \vu
w7Xz,
/http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
[C}aBu!
{q8,
W' 5
.ofxn
u- b
NS0go
CJ'
RtV'
^iHXBT
&))1
Bgk;24
;^>(0
[lAk&`
|Mii
.WY O.
t!t[f=Y
T[J{wF
k2l$F_t3
z|)o
~F,2
zkXAU
s_w +
]*U>NVI
YbIU
R/w9
A_9rdz
cH9@!
x#KW
jwkD
tx(Y
:g.-p`
?}JM
P Za
*fCbS
EpcD=
8_oy
WC8R%
}"?{R
Y!K<
GetManifestResourceNames
6HaW\
d^ PCzs?y
<Vs&
ERW4
\T)L
3%a~r
9u5?&
x 3}3F
W%x
]n#c
|KlaAc
,OY*J
?;A\
Q&#Y
<mKJ
4V,0f
tLwD
Au\Y;
j.0]
QLhY
"HKd
Synchronized
BK`I9
;_nA
Rr0[
:Fh0
I*l4Mi
& bV
Pq8E
n'a;b
9I]E.
{}\V
*>_f
3c4r+f
$_71
l.iA
?8uh
l$9
wg`|
K|^Q
Etaa
l63BU
@E \ 7
z$oH4
~98AWD
=SYQY;
w"J>
^G5F
O!Pr
=/A
i 2F"
P%AO
QE$d
JN=T
(MT\
9Z45
EY*KsD8#,
qBvL
VQYn
]bKn8
)`x
set_AutoSizeMode
mwk<q
mVeX^
rRy"
@HbU
myBp
(pGTu._/y|
=TE*
{xTD
value
w}fFQ
^%P
Symantec Corporation1
{oij
x{4}s
0g~/
C/B+
oyNL
@ {f
:UKh
,R;l
CB(U
W;&[J}
%kPYq
jrE0
ty"<(6
`>>4
: NR
8DwlY2
B~Wi
*E7$
zqeB
EC:.
Bc
7b$#
oWtgh
*MP+
ay;^<
xP4k
JdEe
F;\
T.9>8
yrr*
ClmI
.1P3{
Lg`k
U_}/;
6lsW
Ot9-n
'=}0
Rg
(H /V
VPE{
EndInit
y5n)3
?_L3jK
Yzq
iXshJ
/J3VX
0h9K
r3c^
t=GPN
12LI
M6}/
A3+v
uc,
OxCv
p2n@E
zF]$
e"x=co h
EI06
ApplicationSettingsBase
= :b+
,0)0(0
z L=DaW
YV"JGE>f
i u+
"+q.
mZ6;
c]%N)9
rn5G]
@Rj
]Qbl
r<^g
0 LX
:")P)
Ib$^
hjA.
P_C|
be2sf
8 { 2
~dr qPfb4
;9NY.
get_CurrentDomain
/} 2:
2S!l
https://www.verisign.com/cps0*
Fm<c
N{)j+6
T(!5
Us=$
{ p}
*uQ9-
%x#M
I8jq
F2&z{r
C5FG
2nW2I+
d; m
LMv88"
Z {26
q>)V
<&(J
{Q\g
w=79A9
|YA2`@
k((8
??ih
Vmy
\@R(
t$gN
pnn%oX
3"17
Km}U+
G I/
G1?7]
X!3d(-
Q_a
}_Rs
nU1!n
.ciw
~7I
H->n
k Lm9 9
g5KxE
P1JO
'EG6
~#B
@:+)
F%/F
X9s:
z g?%
>@lGP[
WWUK
}s<2
sM0&pC
|s|>U|y
>HJ9
Spvi
aNv,S
+-zR
(/]e 4p
!YB @
M5}v
pp+\
{>[Y
0}HU
]<l)
8W'~j
V)7b
a;p
N3;R
Q'Gz,
iVJj
~.R
ZzN"
]Y u
{^B;
r1`o
?[US\
(;OgF
&*8X
R|,pkj
F4!S
3t,*
1'sy
bzn;uk
# M# {
\{=2[
EYBV>I
4'!H
+fF6
j2>
-1Bk%
Vsk(
uYdETl
rC,l
=L&"
2V.oWB.
*mY>
/i:X
&j&.
^<1k
:_}(
`(&HB
63n:*
b,,x
-<x
+~E[
W* ?
&_hCa[
omroI*=
n\~4
~ Z
T+}&
N-Q
\jD3
)N^+Oq
o5<Y)
WriteLine
*
Je} c
,Y@'
6pfp(
m)|y&
tzgH
0]]|-
29}8A
D3VDH
o2<C
+G[3
KY +
Ou I
)\qD
@1&2S7
i lpP
>_wy$}^
mL )
0-U[C.F
rjb|
&,vl
]{{y)
\^|
@p|pu
)g+L8
7u E
6\yyg
cZD`
A*Vw
rp`D
f.:I4
j9v}%0
?}q
R%Ci
F +6
-hl|_
0V0(
d*7
@8P"
d='rwC
`^>\
95."*
g 6mR
-~A' X
QQ<)i
fl!o
X9no
tF20T
2cH_
y]H[
eSH&Q
0S-O
Nm#N
2\e]9v
g[DC
L5 ,]3$U9
B"y{=)
7ZKt
(#KC+
C-Be;TD1
stV:
z7>K
SNpj
bte)
h,X}
]dh
vz~7bJ
81+8
|`1oC
vv;3
64H~
pSN<
;FZ2\
k bd1cQ$T
'QAx
"_1KK5
{t /s
E6`f
uVSX
#}7%
Wc-hP
~HP[
Qj?V
@yJ7
"CP(b
=6Ou
w9Mm
\'x"F7to`
XZW8
AjjV
&ZVH
l%Nk
ldvS\
f|GMu)
[|u=
l*`N^}J
o$N
dZo]
mb4B
!L}-
#.HC
I\v8
]}\1
\+ *1
E^{RA
.cctor
A@ ,
X] z
08W-
p5,`
p$J(
XY*A+
A=c>
ibF 5
- *A %
o:ua
sOmYy
pfY3
:2 isy
N'=ds
$e6
CP)!
S#Eq
`ZZ
>#")
/ up0&;
%YPH
tAzzp;-
mscorlib
F:$`
oSF#
;clxQ
|_OD
X_kP&D
4mYa
ja }^n
/GrX
B%E6[
u)1Xl
NH8U
KL<3U1
biRi
(0&0$
_;aj
g$@D
);e1
4X5{.
7A6_j
/oZq=3N6
<`$R
f3Y*[|
Write
x@$s
:- [s
G H/ g
>n'?
.y6?s's
s>8
U 23l",
Y;!dX
set_AutoScaleDimensions
p&`y
C:U]
@&vN
[V9J
qw5b
PNJ@
RSX8
~clk
UXSm
o^kH41
[qsb
=@gcJ
P,ar!
lEq.
|~
gj\uN
ys~J
:1{2(
t*AwW
D*{fA
#Up<
U 6[
OD%(
Hu*4
xSvi
R{'~
@DQn
WZ8
8Q-)-LK
]|
(1:/f
r 8C
[<4p(5
1aZ-
` _
_w(H
CM5lG
L`7#.
{P`..
`v]q
Gcc%
*@N;
IPs>
ayBU~
K8M*
0nd4
>#~'
iqP]!7
~ dN
dt'D
/53?C%
_h;W
H>E!
I5J@
5S6-rh
@A~ <
/"1:
Yi7<
!=;O
dN W
8SEd;
$?n[
$95b0304f-63ad-4fba-9da6-5ab98efc6c0c
/EN&
AssemblyTrademarkAttribute
7{!n
_R7,
ak_6
w'.
^7q
<p;)
?WL&
Z0~}
O_z4)#P7Lnz
|_%!
9z9c
>(eb
|M~aA+
TimeStamp-2048-20
6$4+
h./E
) a]
Do/X
N4c~k
E RO_
objectToConvert
%M(x
{jW!L@
45Gs 9
(cx%
4od47'
,Xn
J9<:F
eav{i
:T%S/H
#hq
9#!D
$d3)
~|='
R9aa:
3wF8y
yxys/
K\(.
s>(P(
py<*
Kp |
GlI
<m?]
nz9~
-2M{
I6)C
*:Ubl
%>z1
|h>,
<P 2
\meq
934<<
j$"Gn
EY\=
y&ZW
OOCN
s H~
(j+I
IM C
IEnumerable
tu6M
"DK8t,
X7{#
f>-h
ToStringHelper
*9:\G!
A|<Fu
*giw
[9nA
{shF
N=`Y)
ToStringInstanceHelper
{83l
{UGWXY
]_T4'
2z4w
BUQ
-eE/2
<IKf
U' Y~
> }D
- H`
h*>p
M}!x*
1e[]
"[)j
l?\v
haJ%@
HgOBnJ
!6GW
,-"CO)
)3rE
-[LL
uULbz
l$)K!s
M r(
a$n<
gHF[
r}ug:
H8 \
eIP\r
YE6M
(=+w
"9?az*
p5G^
Y%&e
|g"s
kUCVc
{g k7
4Sq<
H s@Y
!) P
ws\.,
M)
^wuW=G
kgi_
!]G\{
$S n
JwWe`
n|+>
4-?x
` Ru
hzRn
~sn
5yBu
q`vm
6,-6
)!u6u$Q`vR/.
`Xs)
a?4ya
01d
`yX
Rf@.
mK 2=o
3~)P
-PF
IigUvc,
I}"
121221000000Z
&!b*:
-w/v
$P9nw_F
f_OK
=P;4
lJZ;
Jq42
]a;1
nJb Or
hYZDn
Jo6L
ie=me
G;P%
KjMq
C1^qH
5O?^
~_hA0S[
gyY
RP! z~<
h( ,
qeRJM
>{iv
OGhC
LO
u5ys/
Awcx0
|r[A
System.Reflection
^*vV
q:f1
sgq
k"qe
/HP@8
lM?v`
9]bES=
$*j\
-EK 5
_0_EQ
^< a-
HJ\@
yzz{
}jNs
Rxf`
xoerrr
BY 8
;#.n:
K
vBuV
% =)
$2
mn/
FO=a
u,nG
*.eS
B29G
}j)E
#TR^
U axt
b0 %
n%
K2o{
{"}6
Abml
>w N
/1(0&0$0"
8nucM
[Uwv'
*&95
\/ y
\M3Wu
sCv}(
xHd\
A;[qk
U?3#<
_&mI
+6B}G
<OvO
get_Controls
-:5`
}Iu:{@
OGT_
?ghYx
_U~F_(
>1 }8N#
&FcH
2<}9
H]\i
VF8%
EBKA
get_Default
Gz(,
K\S
]H++
srd\Y
X3/;kN
~ 0
)w_n
y4]Y
1(c) 2006 VeriSign, Inc. - For authorized use only1E0C
jPY[
T_T QXK
?$Bs
'c XYF
n d8
`3
<KVM
%VeriSign Class 3 Code Signing 2010 CA
MsC'1
wB#9
IU?(K
,Vd 4
^:V
dVqT
-H#;
zk1!YH
"(s
EMZ
.m0T
>QUj
K]I
7CLoJu
)U ;
d@(V]
}vhV/
5C-]
< vg
6#67
e*R$
Vm 8
9+6b
$vo"
\U<~
Q7-+
# Pk
ZDu+:0ZS
r*y`
9qwCi
="i%
#6k$@
RdO1
h6VT>
i1zF]
4>lp
3c_;
2{v&
+TpZ
Jylz
4N\F
FormClosingEventHandler
qR_V
)=q&
WWU!
~stOM
}!l@
09cY
k1p,w
;9l&^i7
oH>
g[P!J3
EYGE:
'e`P
{I`|ZLd
w$Iv
R|"@
ZSvT
Zi?-
8U}"
5i[0u:~!v
LI^y/
WCWa
<'.A
UT i
uaQN
a-k*n
z zi
&*6(
_S7}
va.o
fN
M+ L
n}Z_
` hN
7(l_W
U'lB
VY U,
WI0-4^5 z
)`d
AY9be
7+uX
.z/7Y
2=WwrSL
xU>
>z u
x8::i_
LnN-
B<;R!/
B @9
K(3 ;
I; +
Form1
kQ4({(o
Vx*8
+L@C
Py2bmN
h6.
h7B6
|NdY
Czpy
Z.+r
ec.
,IA"
'{[A C7
E) .
dY +
iM!Q
e3!F
m! \
:nbH
-d/n
)btV
WX<
,rP
Pjc
2 |<C
4^s>l
mOlY
u~|[
`Kz!
1 eI
( 'y
,#'P
xz]|b
Form2
oLu4
O!P$:
Nja6c
fG !
jSPlb
System.Globalization
1jW5%
Y[}
p980
0}\QGc
[8.J
YU!C
sU)T
"IGc
(/_4
AwNH|
vf C
lq sf
;]@O
<\"$7
p2-H/
^C'R
f>@2f!
(s}F
0L+a
*qB&
g7,'
Z|~-
C__s
9n"z?n
https://d.symcb.com/cps0%
!*!N
$<6s
7D`+
wU$Dj
SWyH9
7 L;
C+ o
qgE<
ly [M ec
#vp?$
@%p'
SymantecPKI-1-5670
;K0u J
A|WXp
: ?
+eI.
gb e
> S
#]/F
%/)c
&d=
y/1-
xbCYBE
pluc
System.Collections
//C1u
2eBX3
y clB
NU)
kBx::4
3`yK
,3mI
f2K%
?f8#f
]kHt
S$*{
FJ-a
LM^g
O1D;
Environment
$\-6
RD>o
G.U]dyWW
KEW/n
WglDpf
DUEs[j
;3FV'
Odp#
b>Rg
aaK
-p<N}?
.JeG
U&Iq
x{.t
/wBI
get_EntryPoint
P>a60'
M<J`
http://sv.symcb.com/sv.crt0
o?nbo sHQa
onv$ |
Mc&c
c3q4
Gfv^
k4r|6I
fR:k 2 $
.gW*
{yj,
Mde
1i4Z
UQ"X
)rtn
>,w2
mI#lJ
nj*
W9y^
{o%
l'Q]
Kp&
0~t,];Z
hC8z"o~
.XMwH
G<fW
w\]a
OT\)
QH ~
z)^4
\CG(i{
_frX
PopIndent
ttEd
dcyv
STo
1 ?A
.d_[
=bI+
`n YDR
I? K
Z>}sv
V;5/
s6Dm
cr]V
8?um
`xzo
B2hvN&o
YmR4F
c, 6
L){T
#P!l
!]R]
RemoveAt
gN6\
FCl4p
%VeriSign Class 3 Code Signing 2010 CA0
'!J^H=L
E.>B
~.r|
l_ hb
)y$I]
hEU,H
k[:E
#h~-n
+(T)
s 6K
o)16
4t=#
]IV"}
-3q3
U<T`
g6 |
System.Collections.Generic
.W%{
wL\J
GH.S
Q\\J
yu ^P
%obg
UH{\Q
!Wr
?_r1
}?h_
1 U _
R9;^B
U2Uhj"
q/=q
za'L
Q2 F
z>EcY!
?]!?=+hg8
j)cJs
)|pR)
cM~f; e
bl9W
B8U.D
X'L r
+@NeDp
F4*6w
Ts#V
b9G1
A%{c
[.}"R=&
Aqx$L
n'/f 3
K=sv
i|{F
F*@0
^FS\
X'LCIM
U%a(=
`R6&f>
;P2,
0#?j
%*TH
M57/
].Db
:@@k
)*=lR
E+$O
BGTw
^|B#
m LT
2(^Q
QUp8
x({.
~\yd
^$.<
B:;/
h0K:
55va.<V
#/@9=
R`t0
6TkD
GEuV
}^K
j?($
}%fJ,%
=%k;
CJKh
*A%
H7XrC0
fTZhE
,n_/S
OInkq
xRPJ
;bQb
ED u
p^<0d
"N!w
$.l@
[}GCh]GY
Gb*)
n[2F
;!#: B.
0, 4
) 9Sjwo
l%)g"
\5W`{f
eyql
h_ &
*<aAU
}jVh)IL
Jb+HI_?
b($s
>h Y
O-H>
`H2|
<!`
?gbl
4#{e/w
}t~Q
^w\)
25@U
123
Yxv6
)Tb
?=39c
+Symantec Time Stamping Services Signer - G40
v:)-
QqUv
qZI{n
uLuG'C~
BA(Rd
=M3b7
B~&>
:nhIG
u`av
]Eg.
er%4
Symantec SHA256 TimeStamping CA0
^ 12
k tER@
>~>e
A/%2`F
gbG}
v71l
l+2<
dDPXl
BWwE
ZHA3
X=s1`v
-csI
G;.:
X'MP
$4Q
:' =w
`9>"mk[p
kWq>k
8Fn7
vVcY
MZ#Y
78{d
QiD?
y2Z
}}V
-n%4
n/+%
Q&PO
SA:HN
;-"<(
pXOEo
*}t
f@6NO
{4~
nOJC#
Kpa)[
$ +k4
E|H2
H'V
+'<"
`)%i
IEvidenceFactory
Lp-CQ
;)UI
4L0Z
d~w
AyTC'
;#AJ
RP A
mehs
~C`R
Y7CX
'ts]^
>Lw;
[]//-
cy^
!J!L
c.!T
U^r=
*wt
k%(xW
Gjn
coWZ
hxP8
B;3q
sO2I
iq@@
KM^.
qJp$
_?YS
| b2
Ky><3
Ft\|
1\l2
n>Kv
::WgL
g7`8-a
Axav
7-, Vy
IEquatable`1
Hz4 ?
N.!
fP1
t5"J0
ak?an
TR 1K
),!s
1>Xn@
>2 Xs
G0E%
a <`fA
m9\ljr
d! Mu
%<@G
B +*lv
GX,73
VUH<
W$ A
-3jF
ks{
C1'$
set_Dock
!6
!Y 8n
(h0Z
uJxE
OQ1m
:`bt
3u>D
-sTjc
VY8l
cuz{
,=*q
14+KI
JfG
1P@[
;p'/
C$S1
tLj5V
L$p
km;!
=s)6
V>_I P
1{Wi;b
-P/X
( >;u_1ou
Mjh*t
"XLqT
/(-k
!_.!
Q"!_
bFbl
axQ;eL
,}l)
%2}Z]
E</@_
siAdRc
F *j
E>|j%o5`H
nkc
/k`;
/s75
OLF|
+72/
Nc;?c#
ZW=a kkm
N2^NG
o<zY
,,T'
8- d
9~
2fj$m
:*c>G&
s^xcR
Q G<
o>P%|
6DDs>)
S\QFx
+ hd@
RXXy
https://www.verisign.com/rpa0
2HjW
,+xO
;e3~
+{ d
4:gX
];)&
cv &OkP
pby!
=~GMtUc
|yv.y
G{W?
fX"b
"-:
2'Q~-?
Tsc}x
Data
WqJDj
3BH8Q:|8
a b>h
4Lx_
*W<Hxa@D0
8fAc-
;)-z
/BvG
G,tM#
UU3##,s
KFMu
rjr
7R\RF
S:{
6,/0nS
pHYs
L( {
P~6
[>HE#
|d4q
Y^K/&
]rB
B>DnHd
$:R5
K{u>
5J
#2k"y
]]xc98b
i*a! 3
o$0?^P
`$}
F"u7
*$1X
LdFw
{e?)
MJ:kw
z4>8
Did
\|> (
N+(p%
_jH}
3jA
uX*3'
H}Q
|fsF
\^U+
+2.9E
uf 2
QVo]
(0I-
znc*o
~3lG
h;/+g
")e1
cX<g
hC8 /
TyTk
hNBP
=/uO
Z+u qbl
,u43
%6pG3>
. j xW
%2/%g
k6Bq[
y+/Q
190315235959Z0u1 0
x\i?{
{aCy
ul%
c&-5
~ y?
/t@i
ph/C
/AT}l
0-
IcV
\$wK
C`C3
\Z^ k;
u>A`
e0+a
A6"UeF`
!Tho
r8ts
Jq6x
3j4L
VKAZ
x@4X
Y~ m
"oNB
m3J_
'NWm
Uy1
r@i'
w[yqN
;rQ+
0 Yl
|X}<
,Qhz1
76wz
c828
(?r<=u
d f{NU
UC>p
~/H`
Tr jE
dK f
,X i
vQHIi
^19&~
# ' b
{k6h
%8@i,
Pn(N
k9*@H
e!,w
v[c,;
#H~ |
-f>XXmu
U|*
7KC4
%r :/
AJ)vK7
KiP/
5/3X
90705
^T\F"PP
>=#
V)=1
nqGl
uo6}
kbQc
u(,
) }4
-~oV]k
-ncY
j&`*
? FpW
cAfJ(-
N%`G
,u*HI
mftM5
l2XA
T12
+ p
,ft
I/q W
}h8?
2j"z
1-z:V
get_Item
g1ad(
P 3U
&'Xy
d6zA[
h`gq{
2vb W
AY_#
]L65
4j?I
F12N
u+QB0
T4{QL
LfM/
7Bn Uu42
nhd
aP,6
{"$a
6_Q~/!4
G$\]
4$0y
;IPZ
2K2=H
vHP0
[<U7 ^
FB?pR
^3FQ@T
g A:
D[{ o
@,:(
^-?)N`
kkF
aV5b
# VI
1<mL
_&QN
6EMG
xqL}
4F-C
L#',Q<_-
Hybr
? ^\bt
Kl{n
B (c
k7y9s!
m<Y=
Dbdba`
7^R
)g-`
YV=
4m5 ,
Ef^hr
!}V
ob%V
vp@I
jvIE4v
& {m
l,n>
om =
B@
?HIy
n }i
v ?%l
:1g.
w7lL
Bl;+5
{/,U+
B=e6
X,K_^i
ID]`F: f
J9+#"hM
Q-iYHz
Q'S R
pnpTzt
SetData
t>oy
9;:2
j!uV
(?L'*
qRe>N
MethodInfo
|s]k4
I[
}Ff[<
s3clM
uoZb
IhNYQ
#~w[WR
stEK
FCD}sz
X y
X f
vBBq
+ eNv
q|&P
%X.wP
aEQ>
ib8D
T _p
:bzE
#kl[
6ln+
Rvld
j|i|Y)
)!AB
'f27(
'HX8
UP{S
%fVuD
4~eS3
!z|X
$"+=
?k1!
P'E9
ok`
{k@*
(cC4
ETe)jY &
l?0
5D:
uJXQ
IRl#F
m!*IM
[3'^J
,=-a8
X -
X +
/a2G
OK*FM
j0,X-k2
YtIc]
tJGAI
7Ab -n4
p2-
MG*j
~s'j-
4]G;
W#<H
)HfJ3D9>
k$?L
CompressionMode
L?J
K}M3Nv
UraNT
^}|8j
2Xs($
qS9D
XDOH
R1&L
+%AhR !
)sw_
xRfK
G+)d
?"{l
-htI
jx7E
=w0Rl
_;k}
BIZR
=[*8
\D1<
*sc,$
S LU
CcrJyM<
WEVN
5G%J
(]#3K
a:apb
F6k\
92=4
Qh2#
}#7E1
)Yt)
P"O
NQL>l/<
tGVA
,YmI
,s0eB
,z-;!0
=7k(
* qR
p$JVV
72J^,
N.#x
;ZE}
XvK!%
/q%ZI
/JX C
y@ c
Pm{(
<%;2
EaVZ
g^HQ
G]d"
&"O
_GH
1sw"
get_CurrentCulture
tI }}?^
15\f
VeriSign Trust Network1;09
1 L
X;5Wu
>/5g
!ZfHh
/N8`
fn W
N6`n
&2 b
t_,
JI8'JB&
gVvCNw
h`:*
jn2msB
f6S
vQ4b<
Error
W_R77
nz>m\a
_Rf8
[lRJ
G1)i
<S|5
VeeZ
y\Q7
XN}9
NYz\
9s;n
nG7
xxeB
zosn
z{R8
0[es2T
i$ 0
M@Hw
REp7
yePfQ]3"
gEM_
T7/<
(BIh
_$rT
rS!
@Yvg
y R^
\l=
$?d}
t )Gz
iFj&
@|6;
#6EI<
)==r
i{P
~Y8SZ
f@PW
ComponentResourceManager
_7q'S
oY,>
Vf }
wJ#j
qC z
6F?<
GY +
>re-S
~cfX
` KtSon*
~d\rz
Gc>u
Ou(c*
B?)(^
$:r>
)$Y
@`E(>
Kyv{)
:T6^
71@G
TimeStamp-2048-50
9lF[I
{\D7@
[b(X$
X+>;>
(Jdy
<tFHWJ
(b#@]Q
Kp}l
WP\:
csX?Av
QV8W
;u#+dQ:
rHOf
a,Da
Ob>x
E@l4S
i Ih
KO0D
B4|H&:
-DkP
^VoV
( `
K$
#Gup
r;|}
]rGM y
"92C
<xZr
x &F
&a i(
8NeYi
yd@]
"ue5
Ag&s
"d4|
RCW!
`>Qvv
./IA
=Ifh
hZ0R<]
($CK>A1
rcz-
I29}3
p"Cs
VeT
U!*^ j
"70
C4LU`0
-lU{1)
>1_+
%~AD
)~lz
tHxP
R.[L
B T,
P^S#fM
7^,s
fGhL&!
+W2O
'e.F6
\^sTI
K2XU
2FT\
Jqg#}
vdX
6n68
@R; t
n|AR
aTWC
iB w
yI)Dh
TZ9])
Ro ?
M"v% x)6/U
E:A?
(55V
$)vJ
%e1,i?
fvYU~
y}Zf
ILz'<{
JR~d
8Y +
o/O r=*tGF
ju#Ct
O4 :
`n'znm
ZlF] ~Z
$::+
eaFH
sgk}
H*g&
/"RK
jZQ'
"@nE
7fhGU;
.6Ht
zEh
V vnu
+7 ,
qLK`
?OqV
>| D7
H|@*
*;"m
OPd
,
f@rK
#&= J
yBUL
wVg8
QE M
!Vo79
WM`'
ns8&`}
3 8
X] I
Al/0
e7'G
E%]r
U!S>
J>(z
hIst
\[6r
z/PQ
bXHb
)-3f
QCJ>
`y-`xZ
vDb03'
{ ;2!
KLzN
#s,U^
26UR
o}w;
a? @
k1/6I
gGp"
6tqE0
+QHI
6@CM
DeflateStream
get_CurrentIndent
<{Cy
\^ @s
TuZ}
0' 2nL
kkD)
p)+@
YI,=
S`)j
W$M
J1=X
|9S?!
p>"5,
m@A2"
set_IsWarning
n$HP
r^j,H
_gYn
w-+8
MMSd
'eh I
(i8$
_ke"H
3 Y<
A[Yr}
Iu8kc;
g0e0*
,%SR
_aFh-
jxr$Sl\+
`F~T
"n| d
'4Q&
eZ6f
f AU
1W?*"
M2tz
z DG
2?
BT+
H~U6
t+1|>Q
F~Q
n_ }
+#wQ *@
2(*'3
rn(0
Vg1(
IES]m
Lr U
D53p
,D~4
H}4T
2$P]
!1+V
IBRcu
n4L*
L{K<t
AppendLine
0.W
Qkjp
-;:
C:1#kRe
1^yg
Sr_&
OJho4
{,g1<
\,1T
%rT6ee]
ie:3
PTTM
A @1
QxZP
,h=r(
;g~k0
s>$c[;
~HVV
nd qx
;HT
| +#aKH
dk%b
9% S
s bl
29Ef
6S+P
+Tj{
VU?h
pX{n
QU<'
bi:EI
FormClosingEventArgs
E1x*P
TE 0
9cnz[
-ppb
BSJB
:'jI
]NK`
$ *;
S_j8r
K8Qx
mYFzVO
XK5v_Ry
zB-ucx]n
Hc(s
6?E6
,)wS
}ryEy
yr!*r
ZHEM
]U6Y
0Yax
/P <iIT
/k``
n/Qoo
xNQ{
LkIQ%
i.~8/
o \L
vl/n
o`sm6
m<N3
,+Q8
aXVX
Tf$W
9J <
2q$M
D"8.
a ZOf
"7{ay ZK
%P\ }
dotRb
X?lV
p-wY
W%A_h
2>B2
+' p,R
Gb3X$+
(A?x?o
HvM5
|>p?
D34p*
L}UZn
Z(usZ
2OS|
cOt$
LMuY
B@L
I 5pn
`XoFB
/, q
X e6
y0'j
"`PW8
[)KM{
ouDT
,RVb=
$7 ,
LmQ_a
@ V +
~;QlV"
-F39
z{Llrnl`R
mt0/\O
EhF$
a@/9:
%c<
+#qI
s>?f~uk
&*Usg
"Q=0>*
mO3g
})X$
?0Kb
=8-
/K`u
3^ 7
hj`&jz
-5)
D>VMh5
+http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<
R(_0
`%=m
tuva
^,og
}# 5
F?$b
IIc+
d(RK
AD-z
@C{q(
xMTl
%0?G
0!0
y`f
~!3gt
8~ O{
D#1TUa
'E'U*
r,T.
g{~~
l/G)T`
uji1
b&K)
=RM/
c dR*<
YtLT
=)g+
qC (
:
KU$M
mv#6
U}89MM
1{Mi
%/U
TE
= r.]
0jCw
t /l
6y[$
V7h^
.R__
LjgXJa
\t%
q"cY
`D7@
Iv2UL
s([y
MqWY
dR>.
7N\u
W *c
^6J:
:k(C
=Nab
1HY'8
.CDX
K L?7
h'Qf
KdTR
BT{KI
F1+K
+D E
ZD?i
e[>
z'=#0]
}6:
vU4-
EgO=
NRtdu
/`J.v#
eITU
RL8a
qvwQ
DT
(W#}
qC@b~J
}3d&j
|+~d
YoR
d9~3
N |e
u ~N
IEND
HI]1
%u O
629o^
q}2%
h&,H
N]viy
s6 &k
G =l?
8JL K
wtkV
7~K6v
{#L:
pMnT
fFe
_'N
~c
o2Sy
~r}'7=o
Ih:W
JE>I
\V:u
xz=c
R{w3
ZG`:o
9km{bU
PF!_
2~eD
d!Oe
VZaaP
bRW{
"_jX
tdR$
_fxz
zx15
#z12
abz
YnYXuf
'C 7
(5NF
/tDs
e%C(
StringBuilder
Y%UU
Hz$=z
~*O X+
!IR#'
[^F}j
%bVdJJL
.W p
r3TIL
KpM
get_Errors
=Mu3D
9JO9
3tLcl
u z=
OnqZ7T
W\G9
7 MA5
JZx,
g')?wM
#$<*O
l8NV
EventHandler
qC5
NU*I
!9`%A
y]u
%Q<"D
"U\Y
V?K'
Bdg_
4Wua
D+0
$htVjj
+JGk
54[L|6
LF.C
t}~e3
RKku
O1Eim
=X|&
s+a
lK5
WR
-6Yu
[nSbt
C {
%CCj
M]1P^
--tB
&R )0
`j4q
g zwl
K_nv
FZZ|^!D
LUJ_r~
@gg'
[.~)
'6qw
6{;a
? ,AS
`-4Gc|B
ou~ N
w3[f
eE-M
N&ZF
_{HS
) c(
RBsu
C>;c
'LmW
PJj;#
,?g@
`vcK
'dy
e*dt
jA/*
1783BA030420F6BEE6B097ECA175A0DA47736F77
d5ln
c&u'FG
TIPs}
| gD
`4W}W
m#D[
E\I|
f9'e
/$D%
-e_C
(~x
ymzI
c Ht
^=?X
T)iE
/8>GAD
YUK>
ClearIndent
cLwwwww7{
?k D]
lGB6
-th9n
XDvd
6 L
6EIh
!'B
5'V>S
.[Ws
{F 1 &
W:o81
K#2G
!h:$J
'8
js~/
/p+v
nbzj
>H<g'
52.U
j8b
tZ},
[Ap^*
DY +
s~-p
1JQu^
>v4mA
*VG9
P(#F
f[ <GW
=E5
(fep
~OD
`vgTh!t
2@ko
KBHkI
d7B(
9
{U.Q[
|xE#g
String
http://www.symauth.com/rpa00
/D&Z/
u^:p%
Qv_7|K
j\ ,
ff;*
Qh @
p(x\4
RQe5
[haR_5
+(P.A
XurG
t"H_
YG$J
2hjU:
Cbnq
HY8a
@N4
CompilerError
InitializeArray
wB+|
G3j/
5vSH
/FMv
OD-S`v]
ga #
]pNO
310111235959Z0w1 0
s%\;
,o('Z
EditorBrowsableAttribute
5`,$
$o'R
^jX
B(lpX<
B-vG9
"X'4
x60ULM
P]VY
1%i~*
K_Ka
Rabx
Y&8A
P| z
NcL<
6s(+
dg:eR
_h&y7
mCC#
,y?P
ay [
/0-0+
C*B@P
Qq_U
Load
p pqd
get_NewLine
+wn
o'xLi
iU l
vh~ic
(Symantec SHA256 TimeStamping Signer - G20
KOF%
PM'-;
I@wd
hZI*+
;<O
Akh1
L667T5
.aN
`@tNXL?$e
Fz =
z7uSW
h"\sM
lnkWP
;x \
1*+5
sF K-
8q
fD."o
^HX-
~vT G9C
\sc
""=l{
eoR4
y@b%
R(}Ym4
2V3W
p!4F
&wGQ
E arKh
pDf Z
+O|R
Vr(7
]B2Y
<QZXu
RuntimeHelpers
"_i4u
nkzL,
#-2M
!\|T
[CSn:
hj 5
\g&{
`LAN
^BR
e~LU
6D5_
t3\#
k88o
^ RW
ZK~4
o<58rh\u3S*
Object
or$"
v-
4!{[
uJlWx
8)2}Pp
u\ sn
,m~[$
*{,/
omV%
"mzP
H9; `GCZ
D5?Y
hQBBw
Djsk1
,BUYn
v))L
]fDP
/CvH
E.~
@8bF
textToAppend
j>W%G
"a]|J
~Rb&
&ap.
[6RSD
DMiw)
&Q*4
EJ 3x
e {j
^y!Z
A:G
lb?/
C Yjp
f3~aa!
qX^`G
Ew!
?9y-
YjcaYC@E
/<L-O
RsP;k
j-,//
*_>
gq!a
!\rd;
o#L}
n Nu^
4Af=`
xLyBB
r[bq
V:d\
j(8*
8)Sr
6QZJ
#0!0
tlP
e64u
Bbo&'
! o'
-#d
?t ^YqJ
**nV
_W$O
JR2TevqL7
+ )Q
.v1\0KB
3A~Z
Y@*[
j&OL1}
IpBlj
F_q)Z
0:<D
)`4j
H; 3
J\(
`.a+
Exit
CompilationRelaxationsAttribute
T{eKB
8eU>*
s#+N
j )>{d=eG]
3I0k^x
g2d1
$pf8
'beH
cF jT
HZ?N'/
o4EuLp\
^D5IT3
_,
m0 J
|;UDM
'XlJ
IBIR
WC &xF
+D@>
z}t;
ResumeLayout
jKgW%
p1T h
J7=3
Microsoft Code Verification Root0
pq V
Y A-
(J8c
Wx7+
RFi
/SZ<|
g-7
EhAr:
y 1Sen
7n4B
Ag"P
|q+W
x9J.
'<m$
~u}
2_|u
#If_
<QQ5
'FXY7a
-$+>`
75cx
psC(
8P%:
PGx3gy`P
45@3+
-~E$
# ta
P9 Mq]r
twBb
Z.{$
T9d0
g<0NQ
LpurE
\jC%
a276
VeriSign Trust Network1:08
d_Rf
3J-<
%|Ioo pD35
Vj`J
<;
&<(K)
System.Threading
"~<
m9 B
}3TX"
CmJi
`\3q
u \G.
W*BE_
Y^Ct>
5)rP
J8o6
0lp`
f uu
bvf,
Uizn9
@!tp
ResolveEventArgs
)lfZ
y$d^`3
i n
7e/3
iy;>a
[8^T
l~ bY
s_s"
15KI#z_
CbP=
(;cm
g4 c8X!zB"
"*6 Vk
%/Nt
H,Z
}wWs.i
@MVJ
ij,F
{r@#J.>
!fwO
s.:jtQ
o8{O
`Q2
f ut
set_ErrorText
[f/b
\12*
[0D
g}K
8s ZA6
b\l:
3]ZT
9yn5
0^8,8|
-MxW
4]Z#RZ
4 M>;
nUJ'
WF4[
UaY%j
csc/
G6=H
1[30
{18Z
R"`tb|
<Dwy^U
73"q
5mo/
5Y:
@@X&
E_/]
%x$Wg/T
+K`+<
[d5k-
>7$O
[ %T
2I C
zMly?K:
gI[M
It Sp
5 rw
KxiP
v\B!+
2%(
l)G,cos1
/[<B
PI%=~
E4J4
0L0#
Western Cape1
|E3l
\AeF
S U@
=V|_N
b bl
S 0Y
;WMg%U
c#g<
aQRQ\
X*@`k
9^7f
Zm[.q
<Ws*
&)/.
g;%N
Y u
gQk<
OJyV
-$WE
kv5H
Qz%A
^ 90
V\p]h
6 L
_3[,_
R N'
N2w0
B "{
,,MW
:|Vs
_8.#|
~:v<
M&$j
Hp2n
2jPw
|y4$6
n]GD
^E]"
.9jw
!)*ii}_b
DE8AF79676FDDB60C1FA4569B52989FEE063F91E
mk\z
M9-0M
k >q
bKnC
9 G
$)0jQ
K lJ
@]W
R(6]
c5`:
c7?QtH
E{ c
]=R*
oq.nN
p!:NTK
3wa=_
_'hVO:q
C8iYy
AM_.
?> J-
GetTypeFromHandle
yL{U
2RjuP
/"&F
"4jT
:R#W
9_w
Rnf`*
Evz`sK
f7Bv
WzE5
VVl&\
FApD
//bl
2^<~V
[>I9
f?-r
mF?B
e9bl
y!e
:NLD
JA;6
r#S"
(ACTWk2
Yy,b
/(=8%
<#;I
http://s2.symcb.com0
s.#i
;QUola>^
]6kD
[RxJW
d[.E2
ak.{
/dvy@
':k#
(yv7
T|
RC &d
:Tw uh
i^ no
qe5
AW[2&
2?+C
<.oz7
G8n##"}
6TC\8
c"sT`
|Z5|
System.Runtime.InteropServices
<!ui1
LBMj
Wyf4
A&4L
QnTS
+ggPm
?nyps
a}E3
L')]
$oWBw
3.<4
6a0S
sv+\2
zePb
'y;;w
.3'"
IqZ#
yvw
(6'f
(8=?
!oWSQ
System.Runtime.CompilerServices
<h5h
,H^Fl
I6ON
ZuJWb
}=2Y
\Tb>
=?*?#
Bb 8
,T)/
[-:F5
NV[j
>R`;6
E}Af
Ef>~{
DcToG
=K)WJh
c1lZ
6=_1
m ti
mV~_
M- C
}tI.N
dV(U
o k'
u]ERf)
GP/xZ
VLm]Pxt
o"E#l
T|Zz
thXT
EEun
bsW*D~
?'p6
set_FormatProvider
BZ-n
/*E/:
\_|t`
\Qy*
H%xf
[r|4>
ii5gP
[m *n
q pJ
AhNXv
zD)7
eB #
qm6i
6 h
/)bl
8mr'
S|A{
IComparable`1
,I4b/$
g)VY
_|o|
>|#M
<zf
h(uZ >
qzS c&p
U~P_kXR
'(Ul
d)Nd
(7aLK
131210000000Z
l*'7
;:gl
.Q*Ar]
jNvH
zQj^k
Ej|=
~c B]U
C Z8
i3+Y
mO=
TimeStamp-2048-30
-6 {
61M
-1dL
r yX
\l'
n4jj
5Q8Q
\RrZG*Xa
T]zOf
+k{8
&yBZ
MMagq"
KN^(
3E;b
,V{g
>yL
{ |z
GiRz
n47
m#cg
1Qoo
Z/g[
kiO7
Te2x
!Jdgq
y ~S
_jP{
PVXa
:({Y
KyBf
"$R
;1k
icgt
0":C/
A xw
h"];
. ?B
0+_[^
)39v
,_ A
q`?*
o]~
g(P0
J}4lJ
6t&!
xew7
x#QF
nGyY
hN^:
n$9);
_f|u
R(|!
r}-V3P
> g}ik
As!M
eEvfS#
Kk)$
<i%[t&{
?ly8
AOJ+
nEviE
nLOz
Y`u)
('t
MKt m
0eZC
3fTy
S+z+
0+kr54OGm1,
*.tX
Km2kp
yblv
|IA)<
Z JM[0
@D=
s]N'z
\^g
OA-Ue l-
B*(%
\Vm"
Z5_Pc
j#I[
TK`L!
1P 9~
e5x1M
%!vJk
8gCa16@
]b3=+9
em[.
u' U
:`Kb{m
%=:&
|2c^
Q ?H
|9eU
Z\ck
@wFi s
Ce?>p
:z:I
j}w <
"{b:
;V"%
z~W
=A .?
Fj)`
L;1(b_
v+ec
{<$~
.EQJ
$P/U
>@/
FK0
3LPe
]3,V
Q_n
{6aV
VM
~9w"h
S'VI
Tq .
48cAwo
uVm"1 DMN
n'D{
mPky
rxChe
6v" J
9aC,
xqD+
ZAit%
=r+!
uA[P
%{U2
D~AR
S~BT
Xa 6
C4Qm
_2j b
( va
Ehip
B)@[R
Z"X=
mQ3b
`gl`%Dd
"r0s|
c0lp^D>$
d=*q
f&&
\BwT
p;0?p]
}-70\
6B_r
pA=?
a&l>
&ce
7Ovk
%`{` 'n
1z]j
UQpK
qtN?
RabYf
iTJ9
r'!s~+e
O=GJ
^\Tz
a}H3
)3&N
*[EC@
XN)|Q
Concat
8`zS,
jJi4~L
mYt5
(&6|
YUp[T
>cC$4
f+eF
;Bu6Wd{
-k?{
LmCC
O(<kq"
-F<z
{A';
"|da
OhF =aV
:2Nj
yGKH
_Y"3L
3Xa)
#9
Wjk^
:+E3
I@8C{9
'rp8k
`a75
=O8 LaN
N+r#
9dj2F
/0Q
e0?c
i8H;o
A|j
XJ|>
|0A+
l2h JA
9BNN0m
K _kQ
Upd& tt
N\T<
sB;ok
zmN3
-J~i
_0(!
u wK
D#G5
|vC{
ZY0
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven03_64 Seven03_64 VirtualBox 2018-04-07 19:23:04 2018-04-07 19:25:58 174

8 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven03_64 Seven03_64 VirtualBox 2018-04-07 19:23:04 2018-04-07 19:25:58 174

10 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\Tilatii111_signed.exe.config
C:\Users\Seven01\AppData\Local\Temp\Tilatii111_signed.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\Tilatii111_signed.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll
C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af
C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
C:\Users\Seven01\AppData\Local\Temp\Tilatii111_signed.config
C:\Users\Seven01\AppData\Local\Temp\Tilatii111_signed.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\uxtheme.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\Globalization\it-it.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Local\GDIPFONTCACHEV1.DAT
C:\Windows\Fonts\ahronbd.ttf
C:\Windows\Fonts\tahoma.ttf
C:\Windows\Fonts\msjh.ttf
C:\Windows\Fonts\msyh.ttf
C:\Windows\Fonts\malgun.ttf
C:\Windows\Fonts\micross.ttf
C:\Windows\Fonts\segoeui.ttf
C:\Windows\Fonts\staticcache.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.INI
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bcrypt.dll
C:\Users\Seven01\AppData\Local\Temp\Tilatii111_signed.exe:Zone.Identifier
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Users\Seven01\AppData\Local\Temp\it-IT\mndgrhsz.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mndgrhsz.resources\mndgrhsz.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mndgrhsz.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\mndgrhsz.resources\mndgrhsz.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it.nlp
C:\Users\Seven01\AppData\Local\Temp\it\mndgrhsz.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\mndgrhsz.resources\mndgrhsz.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\mndgrhsz.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\mndgrhsz.resources\mndgrhsz.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.default
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.default
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.default
C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.new
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2524.27658359
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.new
C:\Users\Seven01\AppData\Roaming
C:\Users\Seven01\AppData\Roaming\Microsoft
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2524.27658359
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2524.27658406

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\Tilatii111_signed.exe.config
C:\Users\Seven01\AppData\Local\Temp\Tilatii111_signed.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll
C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Local\GDIPFONTCACHEV1.DAT
C:\Windows\Fonts\tahoma.ttf
C:\Windows\Fonts\msjh.ttf
C:\Windows\Fonts\msyh.ttf
C:\Windows\Fonts\malgun.ttf
C:\Windows\Fonts\micross.ttf
C:\Windows\Fonts\segoeui.ttf
C:\Windows\Fonts\staticcache.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll

Write Files

C:\Users\Seven01\AppData\Local\GDIPFONTCACHEV1.DAT
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.new
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2524.27658359
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.new
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2524.27658359
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch

Delete Files

C:\Users\Seven01\AppData\Local\Temp\Tilatii111_signed.exe:Zone.Identifier
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2524.27658359
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.new
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2524.27658359
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2524.27658406

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Tilatii111_signed.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\crypt32
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DebugHeapFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\msasn1
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Certificate\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Initialization\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Message\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Signature\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\CertCheck\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Cleanup\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
HKEY_USERS\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\State
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security\Safety Warning Level
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Safer
HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Safer
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\TrustedPublisher\Safer
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagLevel
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagMatchAnyMask
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Wintrust\Config
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{000C10F1-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{BA08A66F-113B-4D58-9329-A1B37AF30F0E}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptSIPDllPutSignedDataMsg
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{000C10F1-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{BA08A66F-113B-4D58-9329-A1B37AF30F0E}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptSIPDllGetSignedDataMsg
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e1dbe01\754d2dc0
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts
HKEY_CURRENT_USER\Software\Microsoft\GDIPlus
HKEY_CURRENT_USER\Software\Microsoft\GDIPlus\FontCachePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink
HKEY_CURRENT_USER\EUDC\1252
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000410
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Segoe UI
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.5.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7080f698\2196f656
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|Tilatii111_signed.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|Tilatii111_signed.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|Tilatii111_signed.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7080f698\2273d723
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet\MediaPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet\MediaPermission\Xml
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet\WebBrowserPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet\WebBrowserPermission\Xml
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet\MediaPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet\MediaPermission\Xml
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet\WebBrowserPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet\WebBrowserPermission\Xml
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Namespaces
HKEY_CURRENT_USER\
HKEY_CURRENT_USER\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DebugHeapFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\State
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security\Safety Warning Level
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagLevel
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagMatchAnyMask
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_CURRENT_USER\Software\Microsoft\GDIPlus\FontCachePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000410
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet\MediaPermission\Xml
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet\WebBrowserPermission\Xml
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet\MediaPermission\Xml
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet\WebBrowserPermission\Xml
HKEY_CURRENT_USER\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Write Keys

HKEY_CURRENT_USER\(Default)

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
kernelbase.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.ProcessIdToSessionId
imm32.dll.ImmCreateContext
imm32.dll.ImmDestroyContext
imm32.dll.ImmNotifyIME
imm32.dll.ImmAssociateContext
imm32.dll.ImmReleaseContext
imm32.dll.ImmGetContext
imm32.dll.ImmGetCompositionStringA
imm32.dll.ImmSetCompositionStringA
imm32.dll.ImmGetCompositionStringW
imm32.dll.ImmSetCompositionStringW
imm32.dll.ImmSetCandidateWindow
mscorsec.dll.GetPublisher
mscoree.dll.CoInitializeEE
mscoreei.dll.CoInitializeEE
mscorwks.dll.CoInitializeEE
wintrust.dll.WintrustCertificateTrust
mscorsec.dll.CORPolicyEE
wintrust.dll.SoftpubInitialize
wintrust.dll.SoftpubLoadMessage
wintrust.dll.SoftpubLoadSignature
wintrust.dll.SoftpubCheckCert
cryptsp.dll.CryptAcquireContextA
wintrust.dll.CryptSIPPutSignedDataMsg
wintrust.dll.CryptSIPGetSignedDataMsg
imagehlp.dll.ImageGetCertificateData
wintrust.dll.SoftpubAuthenticode
wintrust.dll.SoftpubCleanup
ole32.dll.CoTaskMemAlloc
cryptsp.dll.CryptReleaseContext
mscoree.dll.CoUninitializeEE
mscoreei.dll.CoUninitializeEE
mscorwks.dll.CoUninitializeEE
kernel32.dll.QueryActCtxW
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
kernel32.dll.GetFullPathNameW
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
uxtheme.dll.IsAppThemed
kernel32.dll.CreateActCtxA
ole32.dll.CoTaskMemFree
user32.dll.RegisterWindowMessageW
user32.dll.GetSystemMetrics
user32.dll.AdjustWindowRectEx
kernel32.dll.GetCurrentProcess
kernel32.dll.GetCurrentThread
kernel32.dll.DuplicateHandle
kernel32.dll.GetCurrentThreadId
kernel32.dll.GetCurrentActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
kernel32.dll.GetModuleHandleW
kernel32.dll.GetProcAddress
user32.dll.DefWindowProcW
gdi32.dll.GetStockObject
kernel32.dll.GetUserDefaultUILanguage
user32.dll.RegisterClassW
user32.dll.CreateWindowExW
user32.dll.SetWindowLongW
user32.dll.GetWindowLongW
user32.dll.CallWindowProcW
user32.dll.GetClientRect
user32.dll.GetWindowRect
user32.dll.GetParent
kernel32.dll.DeactivateActCtx
gdi32.dll.CreateCompatibleDC
kernel32.dll.GetSystemDefaultLCID
gdi32.dll.GetObjectW
user32.dll.GetDC
kernel32.dll.GetCurrentProcessId
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
mscoreei.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipCreateFontFromLogfontW
kernel32.dll.RegOpenKeyExW
kernel32.dll.RegQueryInfoKeyA
kernel32.dll.RegCloseKey
kernel32.dll.RegCreateKeyExW
kernel32.dll.RegQueryValueExW
kernel32.dll.RegEnumValueW
kernel32.dll.RegQueryInfoKeyW
mscoree.dll.ND_RI2
mscoreei.dll.ND_RI2
mscoree.dll.ND_RU1
mscoreei.dll.ND_RU1
gdiplus.dll.GdipGetFontUnit
gdiplus.dll.GdipGetFontSize
gdiplus.dll.GdipGetFontStyle
gdiplus.dll.GdipGetFamily
user32.dll.ReleaseDC
gdiplus.dll.GdipCreateFromHDC
gdiplus.dll.GdipGetDpiY
gdiplus.dll.GdipGetFontHeight
gdiplus.dll.GdipGetEmHeight
gdiplus.dll.GdipGetLineSpacing
gdiplus.dll.GdipDeleteGraphics
gdiplus.dll.GdipCreateFont
gdiplus.dll.GdipDeleteFont
gdiplus.dll.GdipGetLogFontW
mscoree.dll.ND_WU1
mscoreei.dll.ND_WU1
gdi32.dll.CreateFontIndirectW
gdi32.dll.SelectObject
gdi32.dll.GetTextMetricsW
gdi32.dll.GetTextExtentPoint32W
gdi32.dll.DeleteDC
dwmapi.dll.DwmIsCompositionEnabled
user32.dll.SetWindowTextW
user32.dll.GetProcessWindowStation
user32.dll.GetUserObjectInformationA
kernel32.dll.CreateEventW
kernel32.dll.CloseHandle
kernel32.dll.SwitchToThread
kernel32.dll.SetConsoleCtrlHandler
user32.dll.GetClassInfoW
kernel32.dll.SetEvent
kernel32.dll.GetStartupInfoW
gdi32.dll.GetDeviceCaps
user32.dll.CreateIconFromResourceEx
user32.dll.MsgWaitForMultipleObjectsEx
user32.dll.SendMessageW
gdi32.dll.GetLayout
gdi32.dll.GdiRealizationInfo
gdi32.dll.FontIsLinked
gdi32.dll.GetTextFaceAliasW
gdi32.dll.GetFontAssocStatus
advapi32.dll.RegQueryValueExA
user32.dll.GetSystemMenu
user32.dll.GetWindowPlacement
user32.dll.EnableMenuItem
user32.dll.GetWindowTextLengthW
user32.dll.GetWindowTextW
user32.dll.SetWindowPos
user32.dll.RedrawWindow
user32.dll.ShowWindow
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptCreateHash
cryptsp.dll.CryptHashData
cryptsp.dll.CryptGetHashParam
cryptsp.dll.CryptDestroyHash
bcrypt.dll.BCryptGetFipsAlgorithmMode
kernel32.dll.DeleteFileW
advapi32.dll.LookupPrivilegeValueW
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
culture.dll.ConvertLangIdToCultureName
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
kernel32.dll.WerRegisterMemoryBlock
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipGetImageEncodersSize
kernel32.dll.LocalAlloc
gdiplus.dll.GdipGetImageEncoders
kernel32.dll.RtlMoveMemory
kernel32.dll.LocalFree
gdiplus.dll.GdipSaveImageToStream
oleaut32.dll.#8
oleaut32.dll.#9
oleaut32.dll.#10
gdiplus.dll.GdipCreateBitmapFromStream
gdiplus.dll.GdipBitmapLockBits
gdiplus.dll.GdipBitmapUnlockBits
kernel32.dll.GlobalMemoryStatusEx
gdiplus.dll.GdipDisposeImage
cryptsp.dll.CryptGetProvParam
cryptsp.dll.CryptImportKey
cryptsp.dll.CryptSetKeyParam
cryptsp.dll.CryptDecrypt
cryptsp.dll.CryptEncrypt
cryptsp.dll.CryptDestroyKey
user32.dll.PeekMessageW
user32.dll.TranslateMessage
user32.dll.DispatchMessageW
user32.dll.PostMessageW
advapi32.dll.RegSetValueExW
kernel32.dll.CreateProcessW
ntdll.dll.NtAlertResumeThread
ntdll.dll.NtGetContextThread
ntdll.dll.NtReadVirtualMemory
ntdll.dll.NtSetContextThread
ntdll.dll.NtWriteVirtualMemory
kernel32.dll.VirtualAllocEx
kernel32.dll.VirtualFreeEx
kernel32.dll.VirtualProtectEx
kernel32.dll.Wow64GetThreadContext
kernel32.dll.Wow64SetThreadContext
ntdll.dll.ZwUnmapViewOfSection
user32.dll.DestroyIcon
user32.dll.DestroyWindow
user32.dll.PostThreadMessageW
ole32.dll.OleInitialize
ole32.dll.CoRegisterMessageFilter
user32.dll.GetMessageA
user32.dll.EnumThreadWindows
user32.dll.SetClassLongW
user32.dll.UnregisterClassW
kernel32.dll.DeleteAtom
user32.dll.IsWindow
oleaut32.dll.#500
gdi32.dll.DeleteObject
ole32.dll.CoUninitialize
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
advapi32.dll.EventUnregister

Execute Commands

"C:\Users\Seven01\AppData\Local\Temp\Tilatii111_signed.exe"

Started Services

Nothing to display

Created Services

Nothing to display

#infosec #automation

TheSystem Itself @ 2018-04-07 19:24:32

Detected family: #Ispy

TheSystem Itself @ 2018-04-07 19:32:02