MalScore
100/100

Mugabe.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 25/64 Related 2135
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 257.00 KB (263168 bytes)
Compile time: 2017-04-23 06:04:09
MD5: 02c547368076c93a76b115f3f9956f41
SHA1: cd11f6fef8a3427296503a34d9d7e244f82e1204
SHA256: 897b3c0b2e5f0e4167ec00a5aea1dda7d0a6006393846135d416b6b1752deda2
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 5 @">$:]e .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-02-12 20:03:58
Last submission: 2018-02-12 20:03:58
Filename detected: - Mugabe.exe (1)
URL file hosting
hXXp://[www].wesleymedsupply.com/Geek/Mugabe.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-02-01 02:33:49 [25/64] VirusTotal
PE Sections 4 suspicious
Name VAddress VSize Size MD5 SHA1
@">$:]e 0x2000 0xb0bc 45568 6ff42b177aeaa2885946630f9fa8571a 5a6d2445f22f7d64a615598fbbbb0f273783048c
.text 0xe000 0x34448 214528 478d3bd8fb10a15a71ef3af91501557f 2b67c07b340941920bda403e62b166bdb4f3474a
.rsrc 0x44000 0x248 1024 b946caa6994b221c70b88134a2559efe 855bdb8be0e3d81b5a4cf543fea265f0c8ec50c5
.reloc 0x46000 0xc 512 5769e8b6122348c97bd972cca036b92d c9410833fc253ac7f91a33b424883861f7ad75e5
0x48000 0x10 512 0f3925967bc8de76b6b6719c00c31db0 065676292394fe5443a73fc10d97ad37125b7a81
PE Resources
Name Offset Size Language Sublanguage Data
RT_MANIFEST 0x44058 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
No Meta found in this file
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
No packers found for this file
File found
FIle type: Library
KERNEL32.dll
mscoree.dll
IP Found
No IP detected
URL(s)
No URL found 
a95fce20-fdd6-5134
a95fce20-fdd6-5135
a95fce20-fdd6-5121
a95fce20-fdd6-5120
a95fce20-fdd6-5123
a95fce20-fdd6-5122
a95fce20-fdd6-5125
a95fce20-fdd6-5124
a95fce20-fdd6-5127
a95fce20-fdd6-5126
]2t
a95fce20-fdd6-5128
e2c4a01f-40b1-9d
a95fce20-fdd6-5133
a95fce20-fdd6-512
a95fce20-fdd6-513
a95fce20-fdd6-510
a95fce20-fdd6-511
a95fce20-fdd6-516
a95fce20-fdd6-517
a95fce20-fdd6-514
a95fce20-fdd6-515
a95fce20-fdd6-518
a95fce20-fdd6-519
a95fce20-fdd6-5114
a95fce20-fdd6-5115
a95fce20-fdd6-5116
a95fce20-fdd6-5117
a95fce20-fdd6-5110
a95fce20-fdd6-5111
a95fce20-fdd6-5112
a95fce20-fdd6-5113
a95fce20-fdd6-5118
a95fce20-fdd6-5119
a95fce20-fdd6-5132
bc4519c8-fdeb-062
bc4519c8-fdeb-061
M2m
bc4519c8-fdeb-060
a95fce20-fdd6-5130
m5z
a95fce20-fdd6-5131
a95fce20-fdd6-5136
a95fce20-fdd6-5129
c66cafa3-c112-8e
a95fce20-fdd6-5137
wERaMp
#IsJ"s
$=}h
'n=J
^#!Q
/YV7
a##2
br1s
HI	}
6~^EObf:
$E57
j;-
v!)pn+7
:L(1
PNG
3,[5
/`3|
t6:
%\6a
x0(M
NlRn
T
6Mz
S#rh<
v~?^v
ObjectHandle
ZEn
`=aU
uD$0i
1jeFv
OF@B>
kyAyy
8v
:
U%IDC
O\/
1j=xI
d,7)
PTdaO-
ResolveEventHandler
pyR:[3tl`& _-&{<2l<sL}ar!
8	HJ
AVH
dbdHrk$&i'r[k$#g"o13w'/D,
+U3
p47O
G>C
iW0P>
^#3l
StQW;
nn/
^)^9
c8J-~
.1 bu?
0xn@BMS`h{Ny$Io$+WMTT iZ,
e41J
E1zI/
||t4
'{)e(
<dH;;2"
x-ucKj~h
ZsJib
zQU}
< <L
6+ik7
2Vy
g9g1O
;W\ig
d0Z"
s|=0
7ZEF]
Ax?%{
v`mf8
$HUvrsJ
O^~5
^/^]
SGr<
4?UV
q$%c
<A2k
^j
~
6-S5Y
E*L_
R_	$
0V~5a
p:|{
TON=
B0fBBB!1qg80uVLyBx9-JL)*+
WL5
ghcBr
gI_@
A4;8+
C&yT
WKQ{
P?TK
PnnJ
rN?
Marshal
=qWU
B:UB
*BQE
.CS0
nx}B'
n08i
sxUV
nBJr{
tip=
L@;?
Fuv{
w&.F+
=-nUc
V0=E
(|;h5
.+l,
op_Explicit
RuntimeFieldHandle
);<
SUz2
L`bC
<0	\s
`.K=!g
Z6c[E
*`FH
iXx3
qH/b
"xo\Q
RIf
.8L
B$<h
Z/eD
Y1Ea
L N;a32
'<TC
`d0w
jx
t
y/-3w1E
_4[K
ho;L
dVo2%
fP"iR
^ucr
Ev_e
Vn-wVo
Xa4$%<
U1>4^
tnFS'
a=`5vu
9xq}
4EyQPC
[,xg
f"s]
*%;J(
DkyF
h!!n
eIDAThC
k>=h*+
)))Q?
AKGF
>djD
z|8!
|7_(O6
'c$=LAR,:af0m0n38+_D+GA-'
H:X'k@>
C[muO
fuq@
G`h~=
`m8r
X0U]
C[/?
3i\
'I[w$j
X8Y
Y_bj
\oWoex,x9n'bjL\I9Q)i7(f7#
2k]B
b:"l;
Dvn>
E&H"
n_K?R
,Q[64
AssemblyCompanyAttribute
babu
_u
W
sPk\
1zqd!
xi-E
HWw	/@
0nD
(,;kp
-['[
1+'cw
oXc
M
@m9j
?^5F
$	|j
Rz!
b*
[*
WY_x
XwU*-
@:!
W;z!
-
$6
]&"J
/
C}
E6mY=GO
scb
F|)D~MF3{B+h1^t;$v2fNK=c(
Enumerable
[XlCz#
+_c-
~n9B'
^:qV
Z&[d
AppDomain
I?bU
veh%
C-yuG/n7
]IiRn%r|W
=?<
y+c7
f	!Z&
get_CurrentDomain
'w9Y
"q8$sAc"^5_Y3+)0L+odQCTZ!
get_Assembly
|Lt|
B2.?
;5F2
l@r
]E\L
wKM)
yFBr
R
_'ye0
Y4!-
X&aI"
5"6
+X?3
G4C
?G27A{
p^)D
:
b"A
V	+U
Toy&x
qmWf
u`F"
;xcO {dE`#ULy1xi$6}iZhzQ$
YC~(
]0=Z#
AssemblyTrademarkAttribute
8Lww
R]zP
1E[S
K?X(
C}YI
"Hd~
Xk?>Sz
Be &g
3|*w
\OI/]
8V#y d
n5HGO
3'*U.N%
%lc[
u9=d
a
=u
fzU6
'*nF<,`(GX"nyS2[9S;N-|Vm"
1oAB
D-^(
`}8T
\=0(CP
#Blob
Control
VtF
}*ze
+iA*a
cZI^
LfD%
xZ(N
?7;ei
Wi!
y<rJ['""p
[,!/
.-1hR
v&",6
lbU0
/P@-6
Nvl"
s.)JQX
2p&+
T&,v
#}-Y
vPb@
f`@?
t&I*
Type
?%zn2
}4ih
T*Hu
92w[H Ru<X#M<Fz!+C?l#2l *
x~F
IEnumerable
GqRS
YM[DBT2
7B0d
#;5^H
NFl.oth
R"?M{T
GS@
)|%
u0y$
KbtQ
0G.w$
)bX9
]/0VDT
S}A)
[e)ItQt910^y@Mq;IP\3-\]S"
SNvywe7F5
3c5[
U:lb
$ M9R
2018
fR;[
VhCY?6$v%{Cz*Tx_&yxT&!lh,
YSDw
3!DS{
B9BB5ABDDF7D5A07991F6CD10A42D3C64A6342EE
[kSh
RPR9
[4u6.
h<Q]D
ISW
ct
#`
WrpK}
B-9I
NsV5
1iq1
21-0
(nIB
VMi$
?$Cq
Char
d*iD
4ML-G
Ca%*#)
y|v*
D8Xp
l\Bf
R\jE
;en
Cv]$
zcH;f
E]kCh;
:d*P
6(fJh
gxoM*
?25Y
j,V3
}Ck|
Ly%
_Yw*
)"U.
:P>+C5YyRCSdLVdj&vP<N'Ln,
DeO}
3'm75
0IE
_YyG
-\T!
:{Xv
%2W4u
$h|z
g	5
t2w@
=:ya
)
H78l
zU25
HEG!
{n8P
Mx2z
get_FullyQualifiedName
uEYW
b4H	Vg
<5/2\r
OC"YOM
k0}]
.Mqv_
S:$V
D:']
ho}p
8[m
eU}r
m*_,YN:5
Y/oe
[I,B
r*uU
96GZ
7fIk
6"[jRUmxeh#B3KXZY_UZvInP$
+c,)
%+DJ
3 x
`jXr]!Q
8d9,
}+-,
E]+U
%-qg"0)6@7I#z3vQeHx-|b#_'
2d[j
XI
%
2*zED
{+ C
~S||
_;tD
1<?Fb
#_Mkm
60R2
.text
?>AxE
+s>]
$ykb<
GetString
m	<=,0&
|hTvM
b6 '+
Component
zshX,?
c
B}
reD9yR)I:ugZtai%E+}BLPe/$
S	PAi?
%b f
{p%_z
\=uW
0 6J
#cayI
C;:B
s|k
%)8<
972E5B7A81D57777C26EA850B403977F079C7032
3Yc
*JP(
6!(-
<ys
[3$tOLm
@z1J
I
E=i
-J^;;
System.Reflection
*3a
bu_R
Cb8
R?f^
P=GJ
)J=a
}cd=
FiTX
_p ?
U3H4udQ
v_p.
The0>d
GP	{'
1{4UP
{Nqg
o UO'
{R{eG_"
oq0E
Mn|+2
lpXX
K`$"
E[Gl
vn<I
Z?D
70a<
|)F_G+
t&&C=
q=V;
Jvw}3
F
	:f
_}HO
{J2y
<8
54}F
k?zs
)S)M
^?D>
e?PX
|?7{
Cc,
Ae
;,~
489x%
\p,N
|bc;DT)L!|WQB2#!$0sxP+o#&
eZ u
})l(
qn"!K
j4BF
vu=v
_(jTl^LHdZfMBCUq5s0}<W!-"
F4gYh
6N
4Q6nv
GIm<C	3
Fl${J
7DUT4
Jx	f0
/"~@
NIug
H|3
jH
@T%.
-i#?
!!S:
Xg?
o4[U
rbG\
m
QHd
o`-v
5RRV
$2J5
C?i4
kernel32.dll
xQwg
m.OO
Sz
5
JT_xTw
@'SZb
,'#Zj
tc@
Jzsrnea/\ 5Kzn768-j~H%*7$
!Jy
qr
q0
gNST?|YvE"pg8M,+5Q%uK,11
._SwaSZC}
G*g~
lQ+2Aa_
"
Z
*cGP)
7iW
OYo(
q6PN\
MFTbk8E
8 uu
Ei;&z
fN\
CGJ#-
siw|
]Ne?W
K<~/
|@#+
p"T!
v.o1
_5
\oYE
ot-J
H\t1
m}7[\ p2Vh2O& }Eg@|w!zqg
7{{x
.nFY
[,Y _
,8Z+
Ido*
~p
*05
YL: SV
TB+]]
2.pb
(sl
,XkH
>
cj
o,k%
i\01
y;8O=
GID
j7Pd
+0]m
iN('
1Xjn
5(V&j
[R3G
:@(Z`
;JT9
fumatul Ucide.exe
o|`
I:Sz
)iby
=f")
3l^f
$a]
WWM3
/q4BWS
W\j;
k}1%[3a
TH8F
<m,^
ZJEo
ME&5
%7is^Hs
(KfL
-.i
x(.n
Mi
\sb
m&vr:gj
;Fat
cO
:|N
F"D|
kb1x
4NNa
:^A&
()W}
GtM{
KFlV
;Dh=
W^uu
n/[z
vU!5
\)VM
2S5I
iu:Hd
teNZ
OnPaint
]j
;		ve`B9
aLc/
zkbJ]
CXrz
Zl.?N
~_@v
X]TC4P
J)@
&8h'M
w	K
Write
b
f#
>qEh
P<,G
RQJt<J,Zs<M"JKG?A&|0E{D+(
J$H\A8
(|=d#JVlwU2OcU85(BdR|^qw$
,ah
!z1N
#8x}!j}gmJ@ `'P[b/7o['j("
-%
17RV
c4DW
v=3c
DZW}3
gn-u5
>vDQ
gk^O%6'
LMsb
u:HTS
R_jXD
/o@
47@Sq
J}+G
rF
m
ZE.cW
5~BIX>
CVFoo3/
u0gX
H?a
7z&yO
8$:'[;x$
KI`X
Xj'89I
-Mro>c
c1{S<UE
mxLK
|Y[
FPN
wycA
qr
/
rK]^T
System.IO
WrapNonExceptionThrows
Z\
[
^]KN
@{p5
I	i
?X
Z4u=?
yGxL
}q?~
}Mv2
.wqy0`ViG
\(&^
Console
k6v=
!WQl
?=$p]
B eP
a&v,
rPXN
V#*
#
m
va
T
]j\
X5]b
D	.:
|c,+x0dUz#PO2_A`B$5AG5:d
A'CC)
@s7h
`Y_i
\cAd
^2AC
`m"f
IObjectHandle
nH(4bx_
3h_?'
MADE(I*mI[-fn,; ]Hl7XLBR"
P	h^|xI
_- l
-!ze
#'{
|&vuY
e/IsB
<0Gg
Sq9QkmU"
nzP
5nk7Q
klFJ
IHDR
dStM
64kl
>-&z
w1ZR
\y,yv
G`t?
GoGJYp"wt
,^CF
WG[I8
ZiU
!~OS}
/hKF
-|!*{
^|
<g9
\XED#PCwRcXG]kI6&)'I-O-0"
g~cu
H	03
WJ(TEE
~(x!f
3;_+
6u`G
%w*v9
System
59BZ
2Q/%
#
eHd
zj/?
7	DG
qFIs
B7hk
n)"1,
8} a5%'P
RQb]
d!q]]
R,Po\
v$Zls
>U|P
[CPbk,;_n;ryar IfW\)M[o,!
dI`fZs[rIFq:Z>Pf=W^W#7bA#
==j.
HaT
?+(0
czn_n
m|b~
KQBweB
@{Skij
G
JJ
2I:6
_TZIQ
CreateInstance
~fl
+TEy
Evl_
|^)8
hfq]
=M!0
#!Ma
oIDAThC
,wPC
MethodBase
/=:R_"eA^6pcQrc6~]28(JOq
|I~=
ayz^&
System.Collections
#_hv
M"w~i
-m#M"
_BKu
TfP*
#L$[
5_
a`
5'FbF
+pll/T<
/"EU
s[-x
dZ/z
$]@V
/1Rs
xde
bg$f
ErVJ
VirtualProtect
?I\@
aZe%r
'l,l
nK72o
Xh&,9
g:n+
S([0zTxjq5?cl%Q<kQ+Hd)VY
C(bv0
[LM_UM=
WZ.n
M:=g:
uhHw3Z
XEL3
sAqZiao9
nH}
get_EntryPoint
bCtJbg%9^|!^)F=3#+cvK'{X
Lc,^/
xBlp
+\_6y
UwLr
.SPY
t(Q5o
rDzRz
.'{c
9k(8h3LTHYq38GUb}Y><@PF-!
szF:y
iL`S`G
rUD<
YTwZ
0
3
F)B~
Pilr4
^^-8]km#90X_:Ar:\]Ygs\k5
]Ox}
0]yt
]-k8N
??DJb)
YK{]
\&gFd2[7s
k!*s=
add_AssemblyResolve
rmRg<n]ScFKtu}9[3%>_Bzi6"
Sq="H
?<m1
R1i"y{
t
1RmO
Pa1J
EMGK
Zj	9FE
D.jN8
ruL}
SeBi
2(*;~
+zIvnD
[&Wv
Fc<,
Jj].
3'\Z
~XX|SuIgus_tX[[EsPrjU<6:"
^"	[C
.wn}
Q('2o
VbH
T6Bh
,]wu2
xth
X1tSR
]WxR
KYG
1%0g
5\}=b
<
~E<
kusv8
P1Nr
6fSK
y*J:X"/C-QJ4> 8TfF&8@b/("
y\wE'*
M}?+5
u
}X9b
=q(K
zDy4
c'%B
"$4V-/
Intern
=<4
@K
v"U[QYr
V'lY
[~pY
bRX@$
h;L
6uhF
3n6<
dGL(
^~Zh
:"bK~$y
?_r(
DJ5
get_UTF8
^~?h
LtBv
Sx!V
tK2{
=v7E
57"Y4J
,i9hR
jkE&XV/X47<2>i()q!iBj>}{!
9)A'u
e&v0O
sMPb?@LmCSNai@jD1lV;>Qd!#
t3P
O]"
QK6A
R*K!lKYTL0I(g]Ah%B+1m+- +
FZ<(
~ZY.
bYzS
hO<9
S;s~
aWYL
hH{ .
p{C
<E6)Z
i*'
System.Runtime.InteropServices
3X]5?Y
m~8*
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD
J{g^e
!}?t
"w{G
TJv[G';YpBkJL<}>L`Mho]r]"
UBC>
DRB+
~BN@
]5w]
[V'%{
I	H}B6kr
[EmU
;\>x
ieIl
vn)zg
2
2[
a]T6
bH&:
l_N=
o,W'
Pof4
F3e~
(\
WHf
WOLw
#r4yO
1#]{n
&JOz
KRR)
h O\
_6X"
!N2[P=kFwfz5M|TtTDNz3dsy
[U=D
cs_
e?tHW
bgQg4
k gj
#2:a
n0$){4
zOJo|l
j6DW
y
&6h?
xV'>
}KbY:
&?!M#b
L38/fSXq>DXQzX^}7<f\!CLC!
;VpB
System.Core
O@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
    <security>
      <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
        <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>
fu(:
sq+
LkgV
0btQ-
D"P
z5O
<;%
M|oG
7P2=r
*f00
#y
Q
Ld1q
I $]
R_m/(X_
4i1sF
,\nJ
^_|/J
MbH8-
fY;y
/|v_
C$Nkk
)\
(
UQ+Ov
cGY%)
q3Ue"L*
KB<LUCl;%fA*`9CSBC6x$4>q/
ye;?
oja1
HpAc
L>c[
9"P&
I\X7
#GUID
}^]\V[H~/izEwY5u}IQ*Vaj="
c,S
~W:EdQEj[A=djwq8vM5"AEKY!
w?jJ
sq`Hl
BH$\0F,zo:{w89$Zi'%@UgY^#
2B/:=@
kCPrfcR^&H5d+u=2a,&cx<<{0
0f9efe38-4040-5f.Resources.resources
5uKm
a9?
MCA;
#Strings
V<Tcq\oM
)Ep%
BV%:
X2)p[nF(}7-nFd+Tk=rqy}-+#
N.x_
N>nMHQ;k4jWqa;<xE2=Cwi_H"
n)
!(
)B~
.E]z+
_{-
iyBi'H
V)op2
#{pM
M91Y
IwS'>
get_Length
F@]PCX6sWmQU:S/p~'=j]!_%
D{tf
*@<}
0zUu
4>O{=
S7t!
_Q;e
{Eo
h!QG`
:lVedZ-l
t(`1
idC^_
)Kwp
h_ju
70@%Z
'}crK
fnw?
% v
]k.X
/%$C
_'cw
';R
XpUj
[{ 9h
y:Ul
>4du
wErAJ
ErLp
jA
A
-ixw
6L7g
ValueType
a]
RV#
e.3
GuidAttribute
`EEqk%
afT&
jDSV5s
]W!PQf
}
=^?
tex_6
"=P	U%
W-*
W-F:
s&ks
q
M"tM
yc|Zn
ka51
}p"mQ
Yx1,w
`,:s2Z2=u&HrGxw3:<<Gb':T"
};:
p)bRix9{ dLJ*?Xc|0@swS<p"
TFG&
cpdS
4HZ+
6sYd
c]k
l"TPC
VExa
#/:FGU
wU90(
^n	\
:YKAHU
x}uf
%<Bs
QRH
k~0)0;^k_Qa<aVIqZC=?Y>xb*
^!P|7
CVc3.
C:ur
dofZ\
*!l/
q%.

lNN
\Z9l
pZU'
4=6x
y*'-
%E(L
2e<l[
k97Y.
H
)9eb
,}~+
"HEq
i?r,
3U
,
Rz-^G
DOj4
6O~4
4wjbL
sS/6
&337
(%h6rZQ4y::Cj|2"`[CPpSdD$
5uuB
|`=
%#\@
P<NH
-;lM
2q@m!
TXri
'-J8
UInt32
t>)W
+s//
4^,r
j{"
7ej<%q<YM
pIDAThC
q#1E
S	wX:~
6Jd3c
ToString
MQvCm
+$h\
#&,At
_'O(
As%-N
9b`*
L:K8y
hy5D
8hTRo[=
|L^7
nnIC
6.3y?YS
',{>
hsLh
P#:,y8*BsA&n AH3YH[)Cs_n&
h;8x
QEg;
=FrO2
$2f
5sOX
\y|f
tX5[cOt39 ?B1Hk#+T#"029L"
i1N3
}<_4
_k
qVr=
|D+k&
ServiceBase
F*9M\:L
ZId%3
xH'2%
mki[
Rn|\
*Woe
f^`w
(MUZi
a=gQ
4+
*
.sa|
!/p=B$(!1Vn8z1;7nYN\Ed5@!
.9._R2=
@%@g
c2J'
\k~nfK
_;{)
C5#
?oSy~
MLQk
e+/-
YS97
z&>t
v9HJ
z	%2
\s4@
ab#l
7ZY#
AssemblyTitleAttribute
6za\
<4WN1
=U't$R"
/jUs
IWR0k
:0}h
fKQ	rYy
b=%=
U5i8s
jO@^
LFd>y}v2~-SQTF}B8/:;_ 6L
MQZ@
-lkSotR $y;
fk j
p&s#
NaRL
Installer
Od/d
qTq5$
4gJmo
Io#F
97bxxll
P!<B
;pG^
+w!J
zE}O<
a{*+
6|#
1|96
}nG6
/V#K
g=G
*tB
Dp[
L[X6
eV8Gk
.i=X
OISEU]\
6+,B
H D(
[p(pZ
j%=/
-Zz3
0ct7
2 VY<)
ThemeInfoAttribute
Kh3 ?66LqsIp?"F"7 )#vTbL'
Qs@1
Data
NwQck
K{u
T~?h
Se&
^
S)^#[B]N
!gAeT>
6F@7%=%Hf<1lLndy'"Bg+tL%#
KhFa:S
)kt
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD|
4(Is
+`kCRV
L"~Z
?S^#
$W0H
e>fxN
QHmu
PR8*1IZ
P+pc
DfPh
!/te
<%\w
pJvB
pHYs
.ctor
4,}m_
~^o
rJZw$
OJ/}
_8K"iB
y5r%M1
!femF
7a[A
0_EC
sdQ6
get_Message
Container
MDPi
+1dpc'qZ/911(rU!iRa@_*D?
L!ZW
{kUX
J+>g$
,8W}
BUiZ
qh76
V/-J
m#=|
|D^M
|.O#
Invoke
RYd6PJ
;^
1IDAThC
(vR]
e(Jb
Q`}|
edM5
e=w~
kbLw7
4fHJ
%Pa<
h>,}
t/,#CDI;(C\ q+w3UFIj+"?v(
XI>Mm
u<C}
g{{idp
T~'n
Cq4}
Qjo%
]RGR
&NsG"
Zdy1=
6G|+
eP)Vh
?bnG
VLG
|m5c
*w'.
.9@$*
fSxr
<p.J
GexEU
Di(R
w={
Module
PaintEventArgs
+0~q
:7GF
7y+A
jZkE
Array
E-xAo
u.bq$=
6~rI
BCBb
B*kH\"R
1>*F
->&<U
nr<1
BY*W
@.reloc
ZYmk
|g&A
zcVS
31;fbb:v
+N_6
=Zm7S6GAZoZiDEX$vXjj>b;Q#
=/Y$,
L9^
K__SA
co8I
IPue<
T:[
hcdRk
8?%)nBi
Byte
get_Chars
7fmv2z'
wKbB
$=Xq}L^/P`l^bdnqOF#DMT:p$
\D_q&X*H
Kxob01"@4&o_=_NCbKIAJN!8&
Oqop
?cAX/CSWVc(/i6-[-4H_{%460
,+,$\
43-'2
%	oC
p00g
<]l8
RTVM
6#brhI@
ILt	W
24d_
!i7H8wZ
VPv
y
z dK
fm5[
CZ	|
6N5
^yq"
~2dBk
m,Au
8Q/|
d'{"9
H,*:w
l&m^
`HaP
5P	h
dH/(d
G~2n
{9w
I\l*
I88q
=Aj[
#U}W
yc
mkOv
QJ~
2bnv~
J{*k
<*YPuh
B0~E
TG^S
Lww3
@GKJ!k
-'6g
i1OP
f+&k
j;{j
5eB/tO}QF}6yD*NvHT+(n:xH%
>I\zcJ
LiEjM
%1[4iX
y` A
Z VP
AQI8
mv(7
5D`T
%"+%
GMYT8
\?eJ
41~!
@d%N
2Wz|
3M-X9e[G6RMeGLVP%zsY>:;x!
t^Vy;
6kZ~
t~k8
W
9P!+
{k_
M-7[
w~-,nQ
Ew{u
0G(^TUq]enI[{CQ[Q#JR\~9b"
WG(*
+GI?
<eG3
Z)|E-d9
w1L$
Y=~Ve3U,L7cS#hf%MxTlY<PB%
X(91V*AJ|&YI1N+_JQJjdG'H#
>/}t
&P0q
s
"j
sH;e
/ocj`T
A^CztAnLp,R5(GeMh4;f7#"]/
N#JS
e^}%
ExJn,9w2
!0RBG
^[|E
RuntimeCompatibilityAttribute
WZex
BF%/kov"j3UF*R-z-!u=fjdN"
Tm:)
$*rD
:Oj~
/mL=AZ
qrc'
Assembly
RXl$
,E;
v2uz
&E5]
o}`
dw
M
(be3g
R`&Dc
Zjdk
{uwL
Z_p&r
yyv?
Td\Z\`$?m|GQ5eEg:JBUfD"!'
ph	
~"
I/?
s1D-XT~%>-(>\Zg?N'@goh++'
iO}%
wA9!\
pA~
vJYr{a+
&J_k
#IYd
\L>j
N]mR
l]N7|
"=f
x18A[
8&*\
eE?^
O.35
~!Rg\d
V'@V
Bg-I
YE.`
y-'g
|}3U<e)JX&Vw'\lanIji(-`4
zxu
Nyz#
k2x*/
;b|9
nqk>
j){rd
;iZH
d#oy
'0:g
VH1JA@N
Sqhj
)Ovx
=?mv=
Tk"'
Ok	]
B|C
NewGuid
HdC_g
/;\.
Ky%L
set_AutoScaleMode
P0m
M
=a7[~lb592k"-FL6V\K66SWw!
P<roqx-j@1%6'#<_dDF!&0Si!
a?IM
?*Vb
jtp-
JIw#
f2\9
47(>O:t
Fubq
F546
Lt(^
Rrsi
jlH
;>W]
.Eu4
U7nG^
;BQ!
-c@&=i
@!C[
.X[R:
IContainer
37}ol
t2=Sy5Y(2PZUy:Qsm8&Ec]ri
V:g$L:<|A:6a0|;rM,'F@sf>#
t`H
af**]
qm0;4
y,G~?
b|7
p_SZ
HHz?
HG6,
WA]JCT
g8!*3]5xRJr11*ToD43lW!Z~+
->n1O
3>C66l
r<Km
T|6^
u>\E
ISerializable
p>kn
/T"Xm
frKI
DtWn
j;f3
pcOk
D5vB
c0b0w
}tgB
Q<4gl|
e3wf48BCkd!$4dh!|]Jd3+3N6
m<U7
1:
>x*^
A<=f
kVn z/Z
"?9z
3
.\
4ZK?
c$;a
le>Zs
:KGM
}`	W
lXLPwC
2
wm
3.2P
4v[(
%-rh]
eB8|
EbFRp
8(7
h`\M:4
xFKM
`{GVi
D6Pj
q2lq
u3T+
g85
F<T:
rIDAThC
b<Yh
t	y<
|
20
Vw/)
7Z#o
;Syn
1"#i
WZAo
ZHaeqyxofy.Resources.resources
F
4O0
(O|S^ g
B*VscE
ContainerControl
;@Fl
9hv4BJ
2_Ou
,xPg
Q&~W
nJh)
1-]8t
|TYx
rNPT
818_
z3T5Y]
UX=A
k="	g
~DU*
OhjR
PnDx
6vu&!c
P1:C'r
9BuD
bS.RBi
{FR/
4+Qm'
ReadByte
R\r?'
Snk:
l:oA
b(pSUu
+<8#
@OY'
E3o)-
h;Yu
qS0(/
RZ+
}	c$N
V65z
'.*
/Qf^
[G-B
%A.J}<
,=S\
vTsa
tT5*%
,cLkY
^f1
`0RYf
!@zKE^
h
{
)T[r6
G,'F
%B,"
Z>npu
o6j~
:wbga
f/'f
AssemblyCopyrightAttribute
gn`c
N$\k
^9I+2I
`7w%
>b=K=XGU 0m<VW@4wWf&a+#!"
I.I 5wp}
\sKIb
q`*mV
4i)&
wBi'
Z	be
)?fl
ONzt
S6{L
o@oW
J<]*(1r5,0FBu#0/wo<n6D'{#
o=ZU
{QGa
`ltKl
&^l$b#oco"F}PNfQ|Jr)d>aD#
qoq]
#)86
)%0@id
`\lP
s0^v
zUo@
p?&f
"jRBA
)hH0
O:4g
4O_$v
!GlK
(:?5i
kQ0-5
=J(a
J=<x!P*P
];^q
8dg-
)
,8
xLa
2,][
p ?A
6/]c
xw56
-cN![
VcA/
S
BD
^{fM
jM%H:q&8
RcQY
f%#.
R@Owp5-HlJ6Hgb;"SWqaI6::1
gM{g
*iP
CuBy
$^[O]
;,tzGl
G7-@
:xs~
3Uttb
bfs1
av 4
,aJymB_8jt\-_t<8Kd$oE&09)
RXVx.hD.
Y@ar
wU:@
mIZ(Q
)n
6X!f#
3U
E=[Z
TJo(
x3r<v+b
GZ^iI
tt| H
b"S"
%~Iq
MF~X
=b4]T
k*pc2
Read
j3I$
S?-U
GzK?SC>9xl;\UC1cbbR+P84k&
6'x
/z>x^n7
GP4s5
i;bU
IConvertible
SYPTV6
Er?S
k?
I8`oD
qI9e@
tH7-
Xqe'
8ov'
?IDAThC
#{aL
;rc
Nn6W
D~i\1,
?pS#i4!J
ARbY
&=~`?
GYpM
gAMA
0)X
=TwKJ
nYIj
ip#@
T!15
3P"
kS!vU
{3IO)
AutoScaleMode
j	(aU\
ATPj
Q]W~
|Go3g/
oNVKQ
MarshalByRefObject
F*1
eu*7
VU{/Y
.cctor
&:=C
C+9co*nR
Lg_SFu
FRdt#
mscorlib
?d9
S)/#_
IotNR-r
hzpe
/7Pw
Q[B\q
d;M-T
.A#V
$PXk;bAyQzP
h[ \G
wb
A
[[3L
krGB
L$d5
'J9
x{"0
m8fs
LD7\9a2<x /L(>VFV9()@98h%
xeH]\
yRo"
n3Z
ow/w
~%-&
0^)~
o@9)
nu5%
![:$
Guid
7/4T9(
iT
n
p/Z,N
kw2aw
cf~Kx
rre't
.?S'
Y5+)B
D$R-
% lJ
V*#A
(V$m
(rx\[
"c=d}
t	#H|?
&P:0
}Zid}9yW
Mq+&
wh5
oqej
^|_lhY
Bl&)
XPHb
{~o(h
t]Yb
1Vx%j
y,9M
"b="%
W;oM
RuntimeTypeHandle
N  D"
OS+}
/A_
RZ)8M
DuQ
ZJGvC
Tc&U/
w@
[x
ia_ w
QV&S
#CGb
xS8W/
Ap=9
S'Nl
jP'V
ijEu
H-O1a^4W[y 8%":+Cka 8RiT0
RS	[
yl#b
F<L3
N]K6P
zdiZ
y/)M
;JZe 6NIV;^\x!G c9K5J5\P-
qY~e8;4
2TA;
4(Bu
^tSxq
x88d_
<hkM
yv98
#c[2
ymc
Append
@:Pb&
D?M|
m2#nN
|fDT
m|~(
%Vod
ZFc~
System.ServiceProcess
f"7Mo?puB[Jurs|PtIgE?r,0"
6^4G
C@N
bwkPO
)CaMs`2c:_}Zxhg5j>61^j[z"
{p*#
-"t phU(7qK"=U;|wE|mp %:!
Qi&c9
Psk\0s
RV|a
^	5Y@
Y2e\
\Rwp98)$WlcBQ/<{1-Ld--+G0
x\Fbd.{l"
8]Fx
(PCM
]}i5
U#&n
ac_Xw
]dWo
AssemblyDescriptionAttribute
_;~$
EZ,;
ZQnYM
2 7hK
9Mx7
}l)
7&fF
0kWf
AFDt
GTzR|
N!t&%Y
rwB1
xS;)/
FbZU
8z[+!
)VZoP
;*n	>
]$|^j
?n<s~AxSW('UL)T:=#}RL+Yg"
*4\o
0(_O
i.1\
p!w5
B>em*m
Q(>'A
UXN
SOI<+g*n
`u)6s
f2	Z
=6*5
htC=
n@?6
Ct/`n
RjB
<V>
/Xs8
1|
_
t%!f|Z/
*(.VG2
gyhs%
-n d
;G+x[<*+Ub AQ5j-'L9w`h)l%
DC@j
's~J[o(Q]_'ZEdz~)%`w,+`y)
cN7/
Hc_
_&z8
T\qG
`_#o
$aB[
m._~O
UserControl
+M<D1
-f}hL
dM	[V
i_@J
0y6Uz<
S'\8;
dEx
System.Configuration.Install
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
,R\V
@%MGj
.Sw}
0]3;f,
d<d[
B`H~
#Bii
pfD`
D4sM
#_m0
iw1%
ResourceDictionaryLocation
jP-Z)
uLw
Y*l
mscoree.dll
!This program cannot be run in DOS mode.

$
~#;?f
RT;#
Qjvn?Ge/KnO0xY4gY*>Q0kGh%
>b#k
&D]J
[g v
[Tj~@
gbd48
!ABQ
ayi,t
"0?
z6|)
w"(L
^8$B
|oy4!
(W"z"
<*.[
HV_
&TOne
d'6K
/%DM9
Dispose
|2<!
yxRnOwO7'SCsDkx?pRNw3/L["
`
i>
#Fd
kqv4K
Z]Xz
|Q]|*n%
(bbhIC
N6{*
<*KP
`%	|S
qo*Q#
%R.#
5,WC
#$tM
EK
-
du
3
3A2P
x"d
yOce`
mE74
=N;1
rT._v
^EwS
;nkp
r&R	!-
'1v9
kPg/
_?z
w'61G
B:1i
icpH
eS/s
QrA]XbK
KMl*n'
S aV
h.A"
KoyLWl
A*GgB
9=E	+
5I[V)<
mC5.
9"9:%1$
X-nqgz
4p0j.
wwjZ
6HFg
-nRs
$fff3e983-7ab2-4233-8e9d-63afccc95964
L($
nZ56z0y"'cFHp5hq>&}fk&">0
Mn-
BSJB
:D{)
"\RS
fJ@CP
OHVJ
l%V|
ypqM
qC"z!0RU-
#?q/
,V"3DR
dTxa{S
7r]=
Q4W1
$w:[
|_k,
TW3%I)r
!&Coff
lIDAThC
)%boQ
ywJMdf
;'tCP
44|N
u7g8
/q{a
4u0i:W^
VXw*
7!FV
c4Dx
MJU5C
$)jH
@">$:]e
bxLg
k'$]
9Tsq
'uD
IntPtr
z.B`
NlLvU)v
[Mr
jaLqi
6?*T
9B2,
<'mIo
VP)p
7e:Q
>h?bR
/qu-
dfh$HAa9xcBW?KJ6U+d7 SmN"
}
lA
k$vH
t3P[
_AppDomain
W@|jW
^n#;
KVbQ
p	*v
eWv[C
[X|%
%6ht
"]>5
s^P*
53^>RW< YQ@"Dn~;5`6 4)$"+
B14l&Rb3h0tf-%k|C^Rrdi~m!
|I9
.[l
e==
System.Linq
M>{y
qIDAThC
r<=	t
u!x
Tuw4
InvalidOperationException
f/nE
c$TX
qbdh
,
zx
/0#?!
qJ|*
gQL(
1UM}~>
i+H#xg
J>)
k(!$:]
H26|q
aPh
6Jk):
*PL3
6uYe6
#&S
fa^`
`4S`
L}<
_O'*U-#(<3JBCSK1~UR v|/]$
m(u~i
&37l
BKX
|]ww{v
?mkO!
poC@
DwuR`
BlockCopy
casS
0S^H
HOu^
GL:s2
=lq_z
;`lv'_N
"-%=F
l=iS
Sx{
k>,W]
}5C($
(<4
qr`P
Y}w%
yO`A
p4?w
\GnS87Gvar32BHd]fl$&k;nD$
(K'X
zKIL*Q
7Q0(
lxNdv3(<io<6!,NEJyChf)08
o<~n
ih/2
<L.mM
<q4G
YWf(
jIDAThC
6RJ?
RE5q
Q2wJC;
+!Mq'A
c8Sh
8sK1t
K-EiV
D90574A20BB1284227DEF0F70F1CF6BD0FC140DA
HAR2
Y]s
=oN>&-$,[!3anmM38a]~`e+&&
(%tb
Q`K0
3~F/A
iM+8
0)P%kk
=AiL
bHTNR
,rZ@
m\P*
C<
U
_jQ1j<
@523
D8t
Zt4 :E
~K=6
2>Ty
rqw8
:Lg|

	>]
/a
P
&V'9'i+
|F.|x
UK1
G4@83
Jw(z
l
	1X

xm"
!tBA
W|$AV
SwoS
MethodInfo
;_9)NF
[
s
MP4.pNu>]
mpdk
@5kF
Eb(h
1($Y
y
Zt
O6s\ka
<wfU
>-nef_
CompilationRelaxationsAttribute
sVu#
/w3#
7E?Q
-Cum{CZ
*[mZi
an.YP}
T=W
rHi`
c!|
yGej3
n]U7
MemoryStream
DI6:0
B4K[
L?uC
twgA
T
we
ResolveEventArgs
9Hiy8
jSRl
C9b
Tyr|
j"2V
k?_{x+
";gp
w1k&
c
u&
5nC.4
`|'0
X:m[
N=R<
oL	9
Oc,$
eq_=
K/7z
Dr]
>*GZ
hn6d
"30j(O
?N8R`
B`Vh[jU
uqUOr
u%P|
r63|
$dbb
=9
z
36
!K
r9z1
p8gK
_!PI9
Y0?
Y9 p
lqO#
FyJB
|n6p
%Pj1o
p
jkq
ig y
^)<I
EfCha
s*O1
|k
!,^K
B|o
vd*b
DM,b'
?X-2
P>w=J
c`!X
6{
t
Q[RF]o
c~:/FJ+n
uwIga
OI>
~HKi
IEND
%l]0mb
95iG
T<*~
TuNku
gW{)
2$u
]+R=f
=5#,\
<!o=3
)C6H
e|=
vO)QL
fsE
qi1n
ZIuT
KLG#
3009A9B3C2291589C277BC17EA7B7AE49847B36A
}1jr
@GC)
>
 ,
'MxF
Et&'rD
{&GPT
m%w
p$q>
!!Zn
w[+6
+nd:B
t
`$
U6=?
Qf.q
)Idt,

- 9v
=:$&(1
Fh[
Mfi
azi*
Y
\E
J(`o`
q5yz
V.VQ
]zy"i
nvUB
pm)/
j+:hX
J)BT
EcPp_{q
T9IP-
>I"UF
h|L
_B/
K_3,(q6
_j1q
}a	]
-4KK
cf77
Concat
2yShKyr
fF	0
|1g}
G`\ml
gXe%
StringBuilder
^(`*
aCv
9mv%
[Mqa
lop7>?Rx +^DU[O{J&Ue#6,;-
tDry
VGeo
[I_V
kCCI.d,
21]a
*
G3sJT
\u|x
wH^+
Stream
"kE
a[eH
q}-p&
LM3m
z$@*
x EMhC
'xSL
%>JH
Ml?P
*S1J
pd;5
*e[]
Ze
+
35>	;a
AN-(!"
@-Sh
E72438DD9A06CF862B9274B492DED459CB035989
>sx;a
f$mE~
vcyt,t
:#V67F{
pBI.
`TT:MDR
T_c):
7VM'
4iX1
vD.n-pwJf
RIkc
vd3e
)W:T
)!A.
_&,?
/^[O
+!!Z
u6
9L76
t|&?B<
Sh_r^
2:xH
d(BVF]X
AssemblyFileVersionAttribute
_&EjE
@U6%4
System.Text
c<gZoOr8H9/URBU/*2?*MF;0'
EI6
oCPf
1Q&tP=$3X;X\,r#*_Rvy<@cQ%
Gh(J
fR,Li
U-*
}Q*`'
]5$Y
o{#GO#D1H?J>`kLK%`pJeT?L$
u}$0U=/e|3/6h, B<&`Keus@#
LHP'
/e&Hd
\ 'S
&
*g
cJ44
T`7!;#vr t
7u9+v}
b"
~qv7qeG
hRQa5
T*S$.sE
(q8
E9t
VgPEgT
GetElementType
av	v4
.1E5
?582
qYen
N12p6@?k9f8@yOXagt9Rl(o9-
[#XC^
CxeC
)R<o//
7hiY2
HHKMr
.$r[
3R/W
nF-W
V25f|M
(%4X
bK)M
Q3
_
Z9k9Ah
-#*cQI)'w"nzD~2:*lS9G8Wr"
\,<jL
##o@p
:1qV50=RLfNgZXcDb'Rkqd_%
b 5bbR3>#^YH|vkTW?<N5)5](
)HG.}
UiGP
cVxUdJ?J=
v|>v
H&ex
Oq4\"&
rgkv{
$vH6x
_|!j
of,$
>3$U
FAbsN
F^a1Q
V@SO
'r'b
I`+;
Gf1n
$e?;
RQY4
]K&o1A
=*QQu
E
bS
aA3rfx
\P3
9IF`
*XX|
iOKF
_	%'<T
LK/u7
H(%x|
]7uy
*CDzFB$
*
5/ma
\&;U
U[HM
.[O
ffEv
)ArJ
RunInstallerAttribute
:6
EC?u
w4D@
f
k]
String
UrF?7
~/us
_CorExeMain
-OXh
oXUD6F
E'nrowm
~!{O
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
qI8
7M6X9v
_r+u
RVbE
i/%)k
-M^@iB
$9j+N
Za37K
FI;*
ZiWl.3
v2x?
_=z
@m#1D
InitializeArray
H$}?
2A5bp
m>e!
KENH
KDWh
PH_vQ
COxt=t-
3M}w
X^qh
r(By@
'.nWUL$
xa6&PLfIotg[tUb-Y:SZjqY,&
;"K(
>"5
>|w4j
?X,2
ToArray
c}T>
.OcF
TcOs
Zb?Kc
{hze
29u
w
Lsy;'
an7d
,p6)
X)9nq
^`'
Mb.;T
QBs>
0\Z%
^'M5
V-`t
fKb<
E:pl
{/h5
X]9I~
GTz(
9$=&e1@Fhn,(CC=-UR~ y*0u0
.9!X
5qYD90
|-
7`Q56
M

O8M`e
1F'J
'NHh
.'bp
r-Y	a
M}}
0SZ['}
m65-K
,'y
h,n'
eR(\
~iWQ
Load
mIDAThC
B"/uU
_z1h4+
i@@%
get_Module
System.Windows
MsGw*?i
qOgA}
'I.x
5?[A
s9+\
0	I"R
get_FullName
`o<b
LRfyV]
|VVsm
FcVI
1cb:V
e"
S?i3
S
tJ
2J9O
+Y{
Y-F
q]&s
HL-XP
qRKI
^pG2
BfvX
!4F/Da
X02&>4
2:ap<
qWY^
(vK@
1_t6}
<\^q
7T-P
vL}<
$p>
'j#
;z-Y
/'3lY
<=Twu
M`\vI?<
u]k&9
ZWLtc
0Sn9
2{4f3
ouH(
e@"G
I{p9
la%I;st^Fl3u1WzN(Lg]TV>H"
;R+Um
2KY}
o"/r-
\0^
fss-
^=9-Oa
4ZSqN
!)n
I_Z&
RuntimeHelpers
u6~
_q:
8+8 ;
qUf
s6>v
&*N8
1O:
!N
>wD#G
^M4<;
ra
AqXY
'FK0.
JZya
I>iZ
T64?
hCN>
)M15
X>0[e
KbHv q
-@w
|-a.ev
I(()s
3fkU
|dj}
dWlD
E]uT
K[}b
z	L
_4[Q:^1,3y#Ay2e'ab::KlYe+
8p[5
Uq~!9&
Object
|Fn@
AK<S
$
%)?s
&c|X
7(
I
bCRL`TRE3qn9HEsmQ&LS>;wD%
x3a!
[.qk^
iBP4
ComVisibleAttribute
D3<l
?Tnn~
g	)
PP/u}rK
!_7WR
QB!o]3>!
eMtLMV
xN,F
j9
t+^pK
h
1s{H
OK54
=>lA
VR1~
5M$W
Rsc<
ROmq
CVB^C(
H6=
uyQ.
abpxR
~b79&OJ?d3$(NFnACd2h@gTN"
Dl`t<:X#?J;9=~*FR{{ ,HfW!
iyT
F,gj
sw*Z
,h\o}!#Oui-lLXn;HIuz%Yin%
]LHL
6y0`
MqbY&
nIDAThC
=
#
iCsu=8
%&\1&4v
AssemblyConfigurationAttribute
b!y>:
en;.E
aCo3LK;ZPTwFSRO3'\>8@iD^&
^5w>
%xnP
I/6b
+>1d
$Pe,
w~Khg=&NY},tzhx}Egggod4/$
QH%#C?3kZ_#sqj}~,;`+RtXs!
x,2
Mb&v\jY34SH'MqOb\^w|%/o;"
9flF
6DWlUj
IlYY
[D]H
F9~
1.0.0.0
5,Fj
Mc=#
p
A*
=V8.
>^oM
jV5(
|.QS
QPxV
CqPe
>FE"5
\>]/>W
-Q1d4HZ
-\6fa
@bL%
C>5I]-
J(@E#
@_@6
Qkm
$&U
%d0i
esOg
U3f6
<+q _
({clI
}7X_;
#J]j":
f}Jux
kIDAThC
q3`/
\{"L
^6RlW
N/VkZ
CreateInstanceAndUnwrap
_fA
*Ays_6
L,H,
!q/b|
hV$U
G5Kf
c-
tpK%4
k]%FU
iqm.
pbb:
U|/Mq
IYsL
Dx8U
jF;}
?)!e	Y
Rri/
K?Y{
Po{}
LuHbK]
_=YRNAB
!K}3
-~Wb
6P'C
RD(i
H/3UL
N{&Z
r>%q
5u7/z
0BhA"7
;qml
q/RG
NQKX
Y2TJ
"Qz
VWi9
l
NG
fvIyZ
.@xv
a/(f
8-9O
{zKZSZw<{}n<cUr>zN0+5[8a"
~jQ`
Z['?7Q88{C2\WAz_RY};k_/e!
W!w]1
set_ServiceName
X7
`mosS
>D#o
N.#y
z;2A
>i/=&-
>It|2v^NZ
V{VoD~W
_S
$}
gm|ynx
=WM#\
S20w
3tw4
T!\h[tX#n?_r-l146,4!aKUT%
0p2,=
c.TMN
CMLN
6^(^	 T
E#c=
#fF
F@Ii
)D8%C
On~s
;5mr
~tE5t
W`\1'
q[#n
Wt7u
nv:N
5Klw
NA\
.32&
Et]T_
XHrp
;3aC
O:}d>[]<:&C`nFd;8J(wZASC"
xJTf
W.Bx
&R3&c}[~4^$>{_3B/1Kqzv<%"
RG?9
RG
0
:;8uY
7u}
|#qt
<InM
1L&p
%4Ct
%=g
xb;#
Sf?+
UKz|
n|yW
niI
'+qV]?r
!` -
8R"	O
qZcw
kV^
(] I
GetHINSTANCE
V;/=
fumatul Ucide
Buffer
:yG+
C$9O
wWS\/6
Z#?2
`kh(S~$MxQ/<<V{Bp#zv}3yi!
r)>t
wbWH
aF8A
Y:5c%E
DNLZv"S#*g)jH'h;v]7/<X5S!
7jr_
S3-j:$h
v3[x[]v2
O`wwob
Ruk-
Czq;d4>?|%'&[T')%5*HB#_2$
\r c
"R2Z
L1IntmIvPyp:@'mWO7MZW&L]
[z0
{rwBM
.?QEi
KSbLz?kmrK\1H1~,WH'Od=a>%
:.ka
sHBr
`JCT
=`l~
]3![]
]O9z
)Cd!%
r2NW
OFBS\ZBiI?>xRl"%7RCelY/E$
L^c]w"(
.$%U~.Y
&P:k
.q5t
m]N
Gi)(+P~nijv<UEF///!,4@G+"
yE2o
E16?
n+GCO
c`n{a
`.rsrc
Jp;Z
x;u>18
HXrUZ
SPD:EZ`
CBN\s
Yoq
C>!W
<d>l7
19:+
O\|:E
%K.D
$@?R
Oq+
t
G9JB
)2TG
Z2W_
^M1c&b
_**_
lM~b
et*L
l^e~
->3
K~.#
,A=S
(BVLsD;;k6LM)p;ZhT[:Jw+R#
jfI(@+!TQ&@6;Zyg];hZ:gT:'
5|jH
Copyright
?5
^,(
ArgumentNullException
A8
=
S
,J
!ll<>,
N`BE
0`e
/|R/C
?s?_Ax
f,G\
,
br3[
v0$+
86zWE
LQU
A'pw
,[B?
|nvP
]/V%i
-F[Bi
g4HV
q'$Vrh
[*u?
v2.0.50727
6M[)9
4k<
\=KkLh
3-Vk
g+Q
ST@',8
:m+t
koa(e
t[|!
Ob{{(P
x$P:
MyR)
haP
EW%3SMJdh,W"|yIUp$j<QdLO#
DJo0a
doIn
boF\O
q5yI*Rls (v/l$ht,U@2>[#*$
h`p\
ktr
G6;(M
|c\t
BGDr
</Yc
Exception
|zi^
@fUNkFCW
+M^%
lzo
@
i0<V(^_OwaZ*|<zf o<pv/6O&
^f'j
`]Jn
z>3
)
@#Gd
J/BP
lH;
Qf>
GetTypeFromHandle
]k2&A%OfHbuCM{AEu954_6JM
#NGo
I;5<|
$4[?
F5^A
2nJd
wx'\
|eV
xcB!
Ry*S
System.Runtime.Remoting
KgcF
(cCs
|gA
$ka\
R}Nk
oVi\
q~?r
WS#@
fd:A
t;q:O}u
BV-9
rZ-r
I\R#
neeI
ffa
^c,o
B_x\
|DmQ3
igr
[T
pgG\l
s.@-J
%yx_qFQvA9I#[b3n}bN$P-Tg!
$[Ls
S~=^
m_(@
G[x]K
+^*B
R}ZA]th
System.Runtime.Serialization
m &'
kH_iq
<J1
!|58fH7
A%mF4
9P*9\
[%Et
4D`X
ha1y&
\>:6
FG$=
^-	QnvhW
\1+e<<R
DTh8}
w{.k
Z0{r
hHVn
ne{\
[!$Y
5,/%
Mfp
1Bu*
PZ~
t@,b
z^#<
;Y4q
,xL?
m2.N
7dt7p
2TIXYX$t^Gnc[={u%\`n$hTN'
\xx,+5
Math
Eo3_
zAP5
BBM
MN49e
[4]=
YZ ybMw
XtLv#:t7wa!xOn+TItP'1G|3'
<Bn`
Ob"
]w,#
tmj+
%+P<
bHdI
:Luu
Na?eCyy6,pO)ky<C3XHILW'g$
\@Q
="jp
System.Runtime.CompilerServices
< G51
6;iw
Si6o
-Y(
`W|+|
SuppressIldasmAttribute
T]'U
6]&p
H_f?
#zYG
9?D#L$DeLdV|h-EGUk0l&F K!
XVO'&F
1Rp1
hLo0
)""F!4
B`te
OFJk
Y6},
n`	{k9
(}oKs,S
?F~
j>j4p3
YicUJ
/ m?
,e8~h=Bg
m=X'
yujX
9ilHj
'_|z?
(`7T
%iX
'X)`
Rq9X
{B[X
Y^PU
KqN#
)Dz,[
L'nP
e/p7
os-d
&B5JM
YG5]
I<o([
eyp$
AZh
R	/pc
O({.
LC5Z
uqb1'
fqlm?
]F9}Q?C&M^)&F/W42||a4c<C,
fDQbti
SK\Q	(
^b4[
tD7
u=HK
Oszc
M/.o
Cq!h
3
?X
S],c<
9
5[
Si6:
2xt@N
IDisposable
r[?\
b36}
*`@.
_PBB
g_zb
=?8O
P{Fj5
J9WJ
>zF?
36JQ
gdHv/
Wd5E
l
1
"en8
/ Ie
DK\r
`26|iPRE!zXm93f5$,@[K)=%/
RW[vN
? .=
d?>#|Q1
bWJ?7'}6b3KQr$_18*-$!(r -
pOw#3
AssemblyProductAttribute
%K")
BEBW
r!T8
=).@
+ia=
:#!c
cjqVqQ
<Module>
pkC)
E.r
.u	rr
17[^/om
d,`d
J=z<
H_WX]
$UGdDi
zD7Z
{U%rx
J5b
iQ"\
wi&o
r>S)[1vyF`#j9b>,WM_B#(Hu$
)fd[xyt+
|IDAThC
kb|,
e?m))~UQQt
[9p~.
Pb;@j
DYU_lp
12kp]
DAJc
W<.2Q
2'7^
Sg
TdtW
<uUj
@huq
yF24
4nM~8
4S0{
Ob\e
n+	k a
TFid
|DI&
;*Ye
&JX(
+-Ufj/G
`Xo
|wpe*
qmj=d
iD^0s%
*!
S0I?
]oc+
]sV|
4Gu7^
'6'W
x
W!
-cvQ
+{xiW2%sxVVA<Ow|I:*THe=~
'CK%
F0,9
c5d<F"3-6&8x"4o'l2HF@XO>#
&Pq#k
A*,8;>%K8uA"0v't_Oa5HuzG!
Mmh-p
yw>	$h
B&wn
"B]Q3
R+g
[PT*:bUW<IqKKNieq$>;M]A2$
1b9qIA/03XY4svsK#ShIca:#(
/a1[
l9'u
n}t5
(&~l
jGLhx
W>[|
;pL%
~cI<:
lCiVq
2
~)
Y~&{
oM}+
PresentationFramework
ZZHW
9m,_
Dgr>
(
"cR[R
c^?kcv#`(8<qEl99fPS`:pz_!
4V\2e
`ck
>s>[
R)6-
_f&_gJ
}-LN%
3HC
&B^;
[I8T
7~$Y
yKH	IK
xxk-0
bG_yux
>E,|
&JwV(8C|14`GDhP%6,=~wKZz"
;nV*
?2	x
OUlL
TeA%%-}y88FiTCzW'*V[<PJ@"
k`wn2]
{M\
#R}C
WjZ(
kc>a
'A;^
*O<;
a@d	qsx
-
T*
cU|e
~c %
?qO
=Wq/R
zct;
I^Ux_
npWz
Kr23
Oq:V
I9~C
9BX2
/@&/`
LqSc
YLvk'
Encoding
K+"_
1cb;
6RzFW
!$;3
k!=-+ 5
]>9fhsn
IEnumerable`1
~eY
?_koq
{qVL
D2'?C
`s51
c_|
KI+h
4J^9Z
OjD.
(dPC2
tU,ZW
-#Kl
qWfJVh?+wM|agev";QN$cO^=#
h6$2
q?x[
aS|"
%5e9B
Rvh"
!6@xYi|
GU)C
O	fP
2b(-
,:yw4
.&n7c?	h
f%>0
)cQ
rK;I
#L"
W|Y%>-
KqO6
8`=sa
29!v"):aX"4d1|vj l5sY2EJ-
#'@g
WARxC6i
}42U
hosG
K]g4@
|
"8
X4t1
<%'0
f)%e
vty
System.ComponentModel
L}7C
GWHV
W*2d`y
@=;"
Q2ri(
_ayv7
JJ~Sp
zej$6
nC
=#oq
M=lj
-Et]
! 88T
O-REz>
}C{Q;
b95)4G
Gz
27g
2dX]=
'F"l
{={
v;9]b
uei
VT,=K
1\${`4l<'/X!yNwcEf5/d~|O!
M4H_
Db{%
L!z%e
{z"
vL&JT
3
.~
`:dD
{92k8
A(4_
%
Ru
5hs`*
9FFK
|WDHc
cFz/
E>4|
2HkF
0_mAEhfik1tV1={_a2?2D7je!
System.Collections.Generic
,}D0
M7'2&$
WX:J8
?fM).
q6t(Mi
2u/"
eh&
->Do
AUOyD
:*Ic
{\%OW
rBN?
2s]b
System.Windows.Forms
v[b(
F o
L=eQ*
YwGzm
2PL[
s`.
E<[=
^7x8
Ef4#>
$,+@
L&uN
:}p
WriteLine
Y&
O,9r
~oc#:
System.Drawing.Bitmap
l{mB
1=-4
A5*~4-X
`Kom
?^23
MI6@2
bNhh!#5ZFg:oWFC#[o!9`&|b4
eGy/q
'cB)L
_H8%
6h;1i*
>i1+
8G
=
E't>?
0*Jsm*
<]ZE
pkEz
disposing
w`@bh
jCT.
$4O:ga"
.Z1O
{=eH
EXn{<:wuc:5
?N}>
%RjLC
$m>,L
q|orni
wRyK
VFQN
^H{`s+
|]V@ALv
J
=e
A<|$
[jSD
?n=[f
(
x~-[
75v>
nOvN
NEe.s
:[\zVR
T/$G
is?N
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05_64 Seven05_64 VirtualBox 2018-02-12 20:03:32 2018-02-12 20:06:23 171

6 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05_64 Seven05_64 VirtualBox 2018-02-12 20:03:32 2018-02-12 20:06:23 171

8 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\Mugabe.exe.config
C:\Users\Seven01\AppData\Local\Temp\Mugabe.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\Mugabe.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Users\Seven01\AppData\Local\Temp\Mugabe.config
C:\Users\Seven01\AppData\Local\Temp\Mugabe.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Users\Seven01\AppData\Local\Temp\e0f9c28b-9009-4103-8c55-4a6528adb15f.dll
C:\Users\Seven01\AppData\Local\Temp\e0f9c28b-9009-4103-8c55-4a6528adb15f\e0f9c28b-9009-4103-8c55-4a6528adb15f.dll
C:\Users\Seven01\AppData\Local\Temp\e0f9c28b-9009-4103-8c55-4a6528adb15f.exe
C:\Users\Seven01\AppData\Local\Temp\e0f9c28b-9009-4103-8c55-4a6528adb15f\e0f9c28b-9009-4103-8c55-4a6528adb15f.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it-it.nlp
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\f02737c83305687a68c088927a6c5a98\System.Configuration.Install.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.INI
C:\Users\Seven01\AppData\Local\Temp\Mugabe.exe:Zone.Identifier
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\cf293040f3a93afa1ea782487acae816\WindowsBase.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\2ad23de8284d4594aa658dfb5e667d97\PresentationCore.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\bfaf8f86e69928fb2f67987c0203f603\PresentationFramework.ni.dll
C:\Windows\assembly\GAC_MSIL\PresentationFramework\3.0.0.0__31bf3856ad364e35\PresentationFramework.INI
C:\Windows\assembly\GAC_MSIL\WindowsBase\3.0.0.0__31bf3856ad364e35\WindowsBase.INI
C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationCore.INI
C:\Users\Seven01\AppData\Local\Temp\it-IT\fumatul Ucide.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\fumatul Ucide.resources\fumatul Ucide.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\fumatul Ucide.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\fumatul Ucide.resources\fumatul Ucide.resources.exe
C:\Windows\Globalization\it.nlp
C:\Users\Seven01\AppData\Local\Temp\it\fumatul Ucide.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\fumatul Ucide.resources\fumatul Ucide.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\fumatul Ucide.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\fumatul Ucide.resources\fumatul Ucide.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2404.21660062
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2404.21660062
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2404.21660078

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\Mugabe.exe.config
C:\Users\Seven01\AppData\Local\Temp\Mugabe.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\f02737c83305687a68c088927a6c5a98\System.Configuration.Install.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\cf293040f3a93afa1ea782487acae816\WindowsBase.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\2ad23de8284d4594aa658dfb5e667d97\PresentationCore.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\bfaf8f86e69928fb2f67987c0203f603\PresentationFramework.ni.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll

Write Files

Nothing to display

Delete Files

C:\Users\Seven01\AppData\Local\Temp\Mugabe.exe:Zone.Identifier
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2404.21660062
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2404.21660062
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2404.21660078

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mugabe.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\68706ec5\5adb9883
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration.Install__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.ServiceProcess__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.5.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.0.PresentationFramework__31bf3856ad364e35
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\68fb5015\1b89bb32\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\68fb5015\1b89bb32\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\68fb5015\1b89bb32\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\68fb5015\1b89bb32\7a\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\68fb5015\1b89bb32\7a\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\68fb5015\1b89bb32\7a\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\528efda8\3dbff305\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\528efda8\3dbff305\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\528efda8\3dbff305\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\528efda8\3dbff305\7b\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\528efda8\3dbff305\7b\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\528efda8\3dbff305\7b\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2d485ce4\6944285d\73
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2d485ce4\6944285d\73\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2d485ce4\6944285d\73\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2d485ce4\6944285d\73\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2d485ce4\6944285d\73\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2d485ce4\6944285d\73\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\43fd4348\4eab5f0e\74
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\43fd4348\4eab5f0e\74\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\43fd4348\4eab5f0e\74\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\43fd4348\4eab5f0e\74\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\43fd4348\4eab5f0e\74\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\43fd4348\4eab5f0e\74\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6b2ef2ae\3270cb54\75
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6b2ef2ae\3270cb54\75\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6b2ef2ae\3270cb54\75\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6b2ef2ae\3270cb54\75\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6b2ef2ae\3270cb54\75\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6b2ef2ae\3270cb54\75\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\5b43ba09\48ffecdd\76
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\5b43ba09\48ffecdd\76\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\5b43ba09\48ffecdd\76\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\5b43ba09\48ffecdd\76\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\5b43ba09\48ffecdd\76\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\5b43ba09\48ffecdd\76\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\77ccecdd\1a2c19d\77
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\77ccecdd\1a2c19d\77\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\77ccecdd\1a2c19d\77\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\77ccecdd\1a2c19d\77\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\77ccecdd\1a2c19d\77\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\77ccecdd\1a2c19d\77\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6e35940e\1639fec2\81
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6e35940e\1639fec2\81\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6e35940e\1639fec2\81\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6e35940e\1639fec2\81\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6e35940e\1639fec2\81\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6e35940e\1639fec2\81\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\82
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\82\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\82\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\82\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\82\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\82\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7f3aad1e\165f8aa0\7d
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7f3aad1e\165f8aa0\7d\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7f3aad1e\165f8aa0\7d\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7f3aad1e\165f8aa0\7d\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7f3aad1e\165f8aa0\7d\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7f3aad1e\165f8aa0\7d\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2ffb0c52\13250b76\7f
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2ffb0c52\13250b76\7f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2ffb0c52\13250b76\7f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2ffb0c52\13250b76\7f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2ffb0c52\13250b76\7f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2ffb0c52\13250b76\7f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\PresentationFramework,3.0.0.0,,31bf3856ad364e35,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.0.PresentationCore__31bf3856ad364e35
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\PresentationCore,3.0.0.0,,31bf3856ad364e35,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.0.WindowsBase__31bf3856ad364e35
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\WindowsBase,3.0.0.0,,31bf3856ad364e35,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.0.PresentationCFFRasterizer__31bf3856ad364e35
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\PresentationCFFRasterizer,3.0.0.0,,31bf3856ad364e35,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.8.0.Microsoft.VisualC__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualC,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.0.UIAutomationTypes__31bf3856ad364e35
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\UIAutomationTypes,3.0.0.0,,31bf3856ad364e35,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.0.UIAutomationProvider__31bf3856ad364e35
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\UIAutomationProvider,3.0.0.0,,31bf3856ad364e35,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Data__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Data,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.0.System.Printing__31bf3856ad364e35
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Printing,3.0.0.0,,31bf3856ad364e35,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.0.PresentationUI__31bf3856ad364e35
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\PresentationUI,3.0.0.0,,31bf3856ad364e35,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.0.ReachFramework__31bf3856ad364e35
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\ReachFramework,3.0.0.0,,31bf3856ad364e35,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1802fdb\2cba36d3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|Mugabe.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|Mugabe.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|Mugabe.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1802fdb\45b258e6
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Namespaces
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\68fb5015\1b89bb32\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\68fb5015\1b89bb32\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\68fb5015\1b89bb32\7a\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\68fb5015\1b89bb32\7a\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\68fb5015\1b89bb32\7a\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\528efda8\3dbff305\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\528efda8\3dbff305\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\528efda8\3dbff305\7b\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\528efda8\3dbff305\7b\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\528efda8\3dbff305\7b\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2d485ce4\6944285d\73\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2d485ce4\6944285d\73\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2d485ce4\6944285d\73\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2d485ce4\6944285d\73\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2d485ce4\6944285d\73\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\43fd4348\4eab5f0e\74\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\43fd4348\4eab5f0e\74\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\43fd4348\4eab5f0e\74\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\43fd4348\4eab5f0e\74\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\43fd4348\4eab5f0e\74\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6b2ef2ae\3270cb54\75\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6b2ef2ae\3270cb54\75\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6b2ef2ae\3270cb54\75\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6b2ef2ae\3270cb54\75\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6b2ef2ae\3270cb54\75\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\5b43ba09\48ffecdd\76\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\5b43ba09\48ffecdd\76\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\5b43ba09\48ffecdd\76\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\5b43ba09\48ffecdd\76\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\5b43ba09\48ffecdd\76\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\77ccecdd\1a2c19d\77\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\77ccecdd\1a2c19d\77\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\77ccecdd\1a2c19d\77\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\77ccecdd\1a2c19d\77\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\77ccecdd\1a2c19d\77\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6e35940e\1639fec2\81\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6e35940e\1639fec2\81\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6e35940e\1639fec2\81\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6e35940e\1639fec2\81\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6e35940e\1639fec2\81\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\82\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\82\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\82\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\82\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\82\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7f3aad1e\165f8aa0\7d\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7f3aad1e\165f8aa0\7d\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7f3aad1e\165f8aa0\7d\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7f3aad1e\165f8aa0\7d\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7f3aad1e\165f8aa0\7d\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2ffb0c52\13250b76\7f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2ffb0c52\13250b76\7f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2ffb0c52\13250b76\7f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2ffb0c52\13250b76\7f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2ffb0c52\13250b76\7f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\PresentationFramework,3.0.0.0,,31bf3856ad364e35,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\PresentationCore,3.0.0.0,,31bf3856ad364e35,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\WindowsBase,3.0.0.0,,31bf3856ad364e35,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\PresentationCFFRasterizer,3.0.0.0,,31bf3856ad364e35,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualC,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\UIAutomationTypes,3.0.0.0,,31bf3856ad364e35,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\UIAutomationProvider,3.0.0.0,,31bf3856ad364e35,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Data,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Printing,3.0.0.0,,31bf3856ad364e35,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\PresentationUI,3.0.0.0,,31bf3856ad364e35,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\ReachFramework,3.0.0.0,,31bf3856ad364e35,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Write Keys

Nothing to display

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
kernel32.dll.QueryActCtxW
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
kernel32.dll.GetFullPathNameW
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.VirtualProtect
kernel32.dll.GlobalMemoryStatusEx
ole32.dll.CoCreateGuid
kernel32.dll.GetUserDefaultUILanguage
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.GetStdHandle
kernel32.dll.CloseHandle
kernel32.dll.DeleteFileW
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
kernel32.dll.GetCurrentProcess
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
kernel32.dll.WerRegisterMemoryBlock
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipGetImageEncodersSize
kernel32.dll.LocalAlloc
gdiplus.dll.GdipGetImageEncoders
kernel32.dll.RtlMoveMemory
kernel32.dll.LocalFree
gdiplus.dll.GdipSaveImageToStream
oleaut32.dll.#8
oleaut32.dll.#9
oleaut32.dll.#10
gdiplus.dll.GdipCreateBitmapFromStream
gdiplus.dll.GdipBitmapLockBits
gdiplus.dll.GdipBitmapUnlockBits
kernel32.dll.GetProcAddress
kernel32.dll.CreateProcessW
ntdll.dll.NtAlertResumeThread
ntdll.dll.NtGetContextThread
ntdll.dll.NtReadVirtualMemory
ntdll.dll.NtSetContextThread
ntdll.dll.NtWriteVirtualMemory
kernel32.dll.VirtualAllocEx
kernel32.dll.VirtualFreeEx
kernel32.dll.SwitchToThread
gdiplus.dll.GdipDisposeImage
kernel32.dll.VirtualProtectEx
kernel32.dll.Wow64GetThreadContext
kernel32.dll.Wow64SetThreadContext
ntdll.dll.ZwUnmapViewOfSection
kernel32.dll.DeleteAtom
ole32.dll.CoUninitialize
oleaut32.dll.#500
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
advapi32.dll.EventUnregister

Execute Commands

"C:\Users\Seven01\AppData\Local\Temp\Mugabe.exe"

Started Services

Nothing to display

Created Services

Nothing to display