MalScore
100/100

evo.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 22/67 Related 2165
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 510.00 KB (522240 bytes)
Compile time: 2017-05-09 03:17:05
MD5: 0ef7043a24a627c9f011de739fb6b3d0
SHA1: 0848fef39cb353b410992ad0478c47cf755bada6
SHA256: 3c1c25ca0a69b8c4fd8657ac3ee98362183d9cac82965a7d083671a6accaba4a
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 5 D$J`L%Pl .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-02-16 18:38:10
Last submission: 2018-02-16 18:38:10
Filename detected: - evo.exe (1)
URL file hosting
hXXp://prosciuttiamo.it/ice/evo.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-02-16 17:22:43 [22/67] VirusTotal
PE Sections 4 suspicious
Name VAddress VSize Size MD5 SHA1
D$J`L%Pl 0x2000 0xd5e0 54784 1a424797db99b24c815fb4994ed25383 7c28800c07131825b8a8f90445301053d3d820f0
.text 0x10000 0x3dd08 253440 e13b16002e8043447a08862963397a10 806ab00e3006d4fa45d4beb80a727dc19de20d7f
.rsrc 0x4e000 0x33a18 211968 25c37de0fd492e69192f016d33f8b80e 8846f70e40c0067b9c704e1bd1bde24828d80a7d
.reloc 0x82000 0xc 512 4e4a67c1ffad72c688ad19cfcdc4fd13 d14eeb3fb7574ba336983085b070684b350f4b1d
0x84000 0x10 512 da8c3884b98792b6bef8967fcff539d0 68e0303f596b209249acb6097527889af6738d8b
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x4e130 209740 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x8147c 20 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_VERSION 0x81490 920 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_MANIFEST 0x81828 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: Copyright \xa9 2018 Northeast Utilities System
Assembly Version: 0.0.0.0
InternalName: evo.exe
FileVersion: 14.2.22.1
CompanyName: Northeast Utilities System
Comments: idebuqos
ProductName: LightCycler\xae Master Mixes
ProductVersion: 14.2.22.1
FileDescription: LightCycler\xae Master Mixes
Translation: 0x0000 0x04b0
OriginalFilename: evo.exe
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
No packers found for this file
File found
FIle type: Library
KERNEL32.dll
mscoree.dll
IP Found
14.2.22.1
URL(s)
No URL found
50a3f39b-4e09-eb28
50a3f39b-4e09-eb29
Northeast Utilities System
idebuqos
Assembly Version
50a3f39b-4e09-eb20
50a3f39b-4e09-eb21
50a3f39b-4e09-eb22
50a3f39b-4e09-eb23
50a3f39b-4e09-eb24
50a3f39b-4e09-eb25
50a3f39b-4e09-eb26
50a3f39b-4e09-eb27
14.2.22.1
evo.exe
"!+*-,0/1/3254647484
50a3f39b-4e09-eb9
50a3f39b-4e09-eb8
50a3f39b-4e09-eb5
50a3f39b-4e09-eb4
50a3f39b-4e09-eb7
50a3f39b-4e09-eb6
50a3f39b-4e09-eb1
50a3f39b-4e09-eb0
50a3f39b-4e09-eb3
50a3f39b-4e09-eb2
InternalName
50a3f39b-4e09-eb39
FileVersion
50a3f39b-4e09-eb12
Copyright
0.0.0.0
VS_VERSION_INFO
StringFileInfo
50a3f39b-4e09-eb36
50a3f39b-4e09-eb42
50a3f39b-4e09-eb43
50a3f39b-4e09-eb40
50a3f39b-4e09-eb41
VarFileInfo
50a3f39b-4e09-eb44
50a3f39b-4e09-eb45
50a3f39b-4e09-eb15
50a3f39b-4e09-eb14
50a3f39b-4e09-eb17
50a3f39b-4e09-eb16
50a3f39b-4e09-eb11
50a3f39b-4e09-eb10
50a3f39b-4e09-eb13
%q^
50a3f39b-4e09-eb37
50a3f39b-4e09-eb33
50a3f39b-4e09-eb35
50a3f39b-4e09-eb34
50a3f39b-4e09-eb19
50a3f39b-4e09-eb18
50a3f39b-4e09-eb31
50a3f39b-4e09-eb30
000004b0
LightCycler
Comments
FileDescription
Translation
OriginalFilename
LegalCopyright
CompanyName
Master Mixes
50a3f39b-4e09-eb38
ProductName
2018 Northeast Utilities System
5311a908-5cc2-bf
50a3f39b-4e09-eb32
ProductVersion
<N j
L|q
h}SPb
75^X
$)HgT
86N?
Qd=V4
\=$&=o
OM5u
-&Iqx
%2n>
N%_@
f)]s
}HI{'
e|I;
nyGC
"1uDg
qd(|
PNG
VO7?J
]; N=T6
l;SEM
0Oa Rw(S&6/~b?in#ZPx%!,]!
2 }x~
xqc
V^p
a+1Q
ObjectHandle
" n U
Gb/
SfBsz
#[>
Ca}qK
6-fXDZIc\JO`{d5"T@-s}0t~,
d0p.'q
$wWi
Gy)Ba@FU#Y&[/B2bD7KDeC:8*
[d"t
g]P5
g<pC7/CG('$),9&Pz_yM1@9q$
ResolveEventHandler
*h.
:$1
get_Height
*XR1
+;Hl;=
C$[Hh
:>Ds1(
&2N$s
-!rNf$"uB)!'7/y7Shh]"8JV4
\0y%
Ck<(
Gzb#YK2
@b%
}V%>$
&;9s
_iG>
V8Y9
.$jI
z/dyI
UefN
Mhh|
Ky/H
^TYb
a2/c
c1|&
(sxp
~j u
U |u
`D8Nq4
:WJ|b!'+6?9r%]@8/dLYc\7x,
= < < < < < < < < < < < < < < <
sD@a$
RGWl
Version
.[Tp_
84vms
JsSf
`WZ2y#
~f@P[
d
o\S8
;Fq$P
|J}T
zgw3?1Z
V1J
I!zc
X (+
B.A
yg 0:
K1-;
pt,m
4P,q
set_EnabledCalc
54_/
3'Kc
gy0|Dln
=<0HN
9<^;?o+nd?N'h5"fZa]-[@<@"
;Uiw
/i|
'EO'
#9En
>6z^
XgdH
$hqq
*/#p
lR&m
r4H\
685y
){HV
__p>n_bX=r)2STtX;JGpt?t+"
l`@M
n$0$
0ArH
j^}!
%GK_\x
ControlStyles
aMh;X(~+}m`JJ9QWANJ6o<bQ%
Marshal
`Dg{
w-)@_Vk,c\x\DvZjO??Cq~lH%
RXCfSJ
6|Owk
n_#z
N`*?
qZA)G{(Txd\124R^{C(ML{M?#
yuo ^
#6Al|U
Bfvu
=?7X ^
5$xPS
V7MK
7FZ`
=> G4
t~iR)w;=_'"Ot;&W@h*6##=`#
bp!)
+jJ&ox`3`EBdiEkwWoA#^6&X
op_Explicit
0!:w
\e<T
SM'>
nFz z
A@CW
System.Security
Gb l
}IDAThC
YZ3\"-
h0vM
s|3?
s0@#
; }?@8
$HV2
get_Hand
B.L][
LrD
QPs<z rzL2+lAgy-JNP=Af\4"
nUG+
6l: W
Z{ sr_
70)`
R R
Tl-:
zLC,
- @w
ZXJX*V
|&#
ZXJX*J
Z TGA
EndInvoke
.5S9
h7AaR
#Zk"<:1o;?;^@WxtZ)i)^O,N#
N-{s
4>;!
6a>!|
1)*{7s_y
cj<X
xC.L
EAl5/'BWHL)2ex5xMD5]X+Zc
>sJ|
+Y/=
:{m?
:i|
d"mQr0JCv&&qbkvivyYj[Z+1
7?+%
I@.o
.u T6
GXvi
H(e@x
o. :-i
W#6
#{[+
(9,
; Lrb\
~fy/V
RRe3
*_f"
x|qx
8! 4U
3S>97
/7X/bv
set_Alignment
bRN2HK
R3-
+UYo
4/0y
.b8E
'8K89
=5g?
8o+a
?-AB
MuA/L
!K6zb
N^*<
uvL?
B-M
3 ++d
J}+h
>8H
6?7C
^Ds,vIGgoORLR=9\1E;=t!Pm(
D/z%;
`;?I
}&!1Yo H4Mu{$Q8hh&*`L~+D!
`ORNZ"#J>\7?nNwsUCFVjb)t,
bC%
c}!
NOz
Xn].axP*
Ze4 uh
vp~|Q
R`N
Enumerable
Xt`r
$14m z
E|:n
x 72
OLC p_"f<"
5M76Y
9wP\>
AppDomain
O/Kl
~Hij
v|\C
TmD9
F%rO
get_CurrentDomain
V6v[
LXV@
(cj
NWK1-E
a83.F
tCt\E
.,/;
d o}R
;? zK 5
rQ2Qf#>Go1J4?^8%d%{*e/P>,
1r?>
BPrVD}wU#H*e&1gyM#> HQ#G
pA<Y
h({YxG
.k6"`
X,r+
YKE}
0gx$
D$j
|_4a
|6R8
>}U!g
T@xK
{O':m
m-4k3H
NZ"Pxw
e~eW
v z&
H35EJ
pj"["
"RL ]zk
i>&#
Q~IS
<NUIWzIpvXu"VZV6q<ZcNnm<
^hy
XE@HR
AssemblyTrademarkAttribute
3)ba^c,P~MQq?42:%#n-5@<w&
Q]=%#
MKhB}
4pe
--Yr6
pi6@2
r4 =;Z {
l_]
o@v
Pm /
}HsP
*O,x
n`IMRRA
A!bK
K*1Sh
\1gP
S]m=x
1 f
zCU+Y
; %yf
+%d
q2l a
Exl'}H
+J{Vt
oF$l-n
+G;2q R
A v,
=/i%
-9@yG
Control
84d23649-2f60-d5.Resources.resources
a+{O
.2rZPg
TXK):
m5p;|-#O1?)gZb7CgM-3[Mux$
>cf-P
8x< (F
!rG6
xv ab
I ov^y
ihQo
*0p>
xgw?
2Op
gU[fa?
Q{ =
T[m
R^(6qw4
ExgG
|};3
}o$aQ8"<%m:}jZ3!HH;~5p$q%
L`e=
H$r{
H@<H
39,1
oBX
BindingFlags
&IR;
H?_,eks;
Type
G<L<
g*^`!
Q{u\5
F'}<o
' U,
T [KC
23X4_
[ S,Q
u%e
L$l-
sdC
PPa5
7$ti
l\%0
vP=n|
/%>!B
HE;7
y >]
X$lG/
|6
US(~
V$=X
p8yiy
M~$J
e,_y7
siH
v_ 4
|Qo1Y
Cursor
\xVj
u<5t
mbiM
]YbD
x4Md_o
2K#NS
Ths~]
| G7
;tS6
x_?m
]q9L
V?)t
!zJ[x}
Char
bWW:
yeF`Z
F%Qf
dm;Im|NE
sSyI
D7c
hQ]D5H\
^\\@F
0 R_GfZ^@
M.G1
(4_#
;Di
$IM*
bYajv
+vGZS'{
GetValue
>A2'_
}2~uf
Bd%m:
VBEJ
6zWXGpIK*j5DXLa++aiD(CgO"
Z.dR
fA]V
NF|gJ
get_X
get_Y
|PD[
;It4At1~Xbe$WSb!>I#iqvsz"
KV&J
mWr0
>_wp~*
yV!~@12*:_? ?jT%/BY0N -]/
~IDAThC
1 PC?
I>WX
_,;xb^Y
%=UZ
D!
EhT>lW&~&&>4r8}|F`3\%WsK!
VirtualProtectEx
eDNW
"&@;
._(A
@">
get_FullyQualifiedName
10Hk2{
0*Wh
kVZP
zCjT
Qs[qh
74 dp^
xzF
)rPF
}q[
NG8LC
G&r,(4E:'}#--7+@;7,A=(Pw9
)[A0
lYPE
S=~6
4.4X
J,2m^`B(R><vwccsuL'!eF/t$
%=8M
Y=<E1
"u$>
,%*}`)JSPj$R%RA'[F:\gDZj&
2V^] eP v
T5L*"
Db#;Xx
p3UG
fWDmz
z}3&
bF&k
J@ ?
PUIrm?rfT-0Pu,J?+<|W X:&
2 Xh
)-K4
i1.S
Km)+
ynLXK,<)$c"UM[c%}]AD 42M=
4}s#
!>>)`C>\st0{B'hZ+;5CVlbL%
stI7(
i-#/L
-:>n ^c
ZsqsMngpYkuxrHFgX6t(yayk
Q~oV=
U?_:g
kX+<
~B(@
;Tad
jX)a4PId
LC e
@ 54)m
.text
V$df
<Jy]um
o. s
GetString
).fN-
2n~Z
>J_P
vPN'
ODq6
xo=u
^bz +,R%-n>y3|"bz2R;xP-"%
8v |
V u<+i
]_Zz
yp&-*XO`;_>nGLj<b{`(x,La
c*.
%~,
$#*S)
t*Tz
x')J
Au5Y'
R1;H
0c 2
object
%9 {E
2HV-
`jGmN?*>f.
?gMUn-Gr]$R_JcYQ1<AY"-G9*
l2 a-
dj4cF$tqUaV\A[:q%E0pZYF3'
dtr" /e3nMK/hy;}Li%RSoVX
xuMBiBZ3l~\G]aStSm{80hH,(
jX<s
h{C%j
XHj*
m!E$b
j~]u
\gw8Ahg
Oyb
iK2
}Ep-4
yany
o_7/
S V_{
#`u
tHw
8`^n
ktbJ
<B [i
u9*]G
RP+1
fEZF
&*~d
c|YV
?:v
\a,&OIegWL|Ocj>8QObKIsum!
E;=Oe.
2l[#=N3#
vC/2
BRZx
WB?O_v
HLtI
E4@@
d995$c9!X!>~`J^e%FHM_(,b"
t# #
2Ig!2
K3;v<6Wn-gdRK}9lO;k-$$hg'
r O>
j)* 5
!qwa
=ETi
/r=k
>4u#~!jcyzLt@z`k,hJ8|b!2"
#6fF1G
no0,
`;&W
ppuB
0Pos
{Ud`
xqT^}P
8CD<
)e(I:
MuFZ
Hln-|">lD_&ZGK,zVH,4C^n:*
?PN
uF#qM
)Lpc
G }@
> 0b
wq9Sl3
NmsHu
`^/f
x: U
4+(+$
0MG$
&"q#
L.Cu
=Rq"
|nRg`
`.rsrc
;{1R2
?vv5lZ(A+2D0/G,S-*Q6AWh/!
=xs1
.PHfi
wXx
dR1N{
#`Yk
?(a
aBC_
C$D1
'-J i6xFD/H=?s#,s-T%4p"q!
`Kyy
qY4z
R%FH%+4G1i&2\q\( e1d72IO'
Z"M
get_Default
W4 4
\DD
/#3"
j U.
I1a8%
kernel32.dll
Mz`[w5
result
'j?5
dqDe
lB1
~vAv
Y JQX^G$
<+jd
{.Ft
@XwX
ar+/
@u@ow
$zf.
/e.]q
XMfBD
*dG-
o{4(
['sG
q~(EJA
.RWIe8
@dw
SH2
H83'#
nqy"
y=@w
(;niq
Rqb#
R6zNf
P$0$
2[I
4Gh#
|,n4
q-)MD4hF+;{ATjg#/Jcmid5!#
:tN<
_Y%
=#:;(
v_]-
ojgk
G>N3
z+RLu
e^I.
4QX\
sMv|
P >fi
\?mj
_wyS|
i n~s
)yT\
Gb.
Hwo/ni
(`Jv
!,46
RH\L
w ,\
GzaA
|=BK
J:c|`qZ
/ 5
FeXX
)RfKV:
jnc
d=P"
I/4J
MouseEventArgs
wVY]
V+A1w
JBNO
icE8
y`"i
j#K6
?/~Cs
/C'J
ue /
Llj~
NQ B
MlM{I
P=c8
sUbB@
\dR S
lp_R
J`QGa
K8l0
/ OQ
M 3,
aB+Uf
!0e`&n
4hj x,o
P}4SdC
t6q%P
aLA ua
|'G.
(
M;iu
`9}5
Kko\>
{PHXt6\(
d-mmH7IbskutcQnQ]x, ETh@"
%5-_{
9 o
|SmR
&`4R&
hO}l
IsNx;{
7Cib
nr\<
uy?
, {A
!o>`
^jUD:lYi
=(+2k
>qM 2
2W>
_N\_
v++a
lw&!'
1c4sF
!+?I
J$dc
)S`v
tg`
X{n
jvLF
MVC
`Od F8
XJX*V
Gni9KLg
HN/
}"S
\1;6
Write
$zD*?
A?g.
OnMouseMove
&';bf@,uVZI'{+-Oi<?r*e5A"
Gq{Ta
]5/ini&e3pH&8y:o+dREQ+<B"
Mw_&DM
Ell,
Vx wgD
#!g$
; {3D.8
1p@Jv
9iWugrL
:PRdr
wGaD#r1sM
w1$j
get_Assembly
WeoA
[:B&GWrN3J1[c:G0)@4$`p2"
eTc(n
^}+,
F*;-eu
5TpN
LG,p
.;Vw
x/I:2
3 fp
Y=am
kAXq,
<#%
UWar"
7@_?
\`z&
py@pvyM
'p^#
5ww:
himTT2
(!q:"@Nfge\-r"MHIK^jTE6|"
Invoke
+;>.
PWa7
>o,!
l $r
w^-:I-
F5p.
VLzR
Z5y{
pf_Z
System.IO
a(oM";/D'In6FbU@/NhQC?9V%
WrapNonExceptionThrows
O)OR
#AfxhkrhQBKc`J6_x:L]q?Ip
Oy
6d *
i#$!j&hG
**":)e
Y +L8IJI?<[+_1S?JvTtdE&k$
OCf4h
@fHI%v
pf3w
DgIX,@
Console
QM ^6
g97j
sgW`~+
nj(WH&
YSL\g
E9[:
-+ X
0|6K
kR}vOJ
H 1
(%<%
u+q"
T$>G
r&>k
,R}54
7^q 2
@{'(
IObjectHandle
Bb~D
RuntimeFieldHandle
[:%Z
xV9yZl
OC@/
ybEE3
p`BcV
jQZ}
M~\4
w4)5[
V~zW2N/VhSr%-AH6,v0S58hh
D[!q9
$V7LV
>|v
c ?O
|=uZ
nN0|
ML-O
=4Q5"
IHDR
l 0
cZy<
>(Ov
U9zg
66!jp
EO<cB,1
C0ab
6|?J
]a,H
81+@2a
o`uQ8
g&*[_
p3HM
wQ\P_z&^QWkC!$3pAx>knq?l$
5}COJ
FD8W
gE$w/v
R{%+
+i_u=
e4M*
J !&
hM9
^&^e)
t\6/<pZ
bjT8|
PH=
-C:d1k
^8gnA@\]Dp`a\5M@e/Rbv9R2!
5\9R
mt`#
System
EventArgs
W1N=
|Ehe
7V>i
f~#jGF''Q!wOr_1OQ>Hehh<8&
}"4f
.NI_
=,!wg
~,GTC
X!*l
IPaX
`5eU
:LG"
]VqL01G
T>*b
N?>y*%r?l#Eo?GU/e Z[877\!
Uc]G4
b*
N5R;-
=#:K:c<5;:18FNa{_6yQ]yV*#
~6Gl
_i}Co/gRo<)=Hk}$|N8UU[3t$
[\>vB
}~PT
c"&O
3og<
o`CXD
:3?@
wy+"O
LdRM
h wbf
{e-t(^~
=J:`
D1ZNY
fK{3
KZ+W@;E&$z,MgmPPa%yTN8Z=$
CreateInstance
?SX>
H'(5
TUYv
Ucq=
8*'p
WsE@
q@U;c
oE&"
e]C
MethodBase
#Strings
Font
A t]
System.Collections
Kc5a
ZXM(!
_R5`a
_s$J*
xlNW(&\ixtnpK D9[jB5GGWo!
Y-?]c\
/6;#jO0LKc[~C%za+|0 PiK'%
n6IgNb9
[XPS
B;3q
bmX[)
I{DV
G8rn)
5~5F
Qir'ErLHzw/J0 OS{J$6>POU$
4?\0
w*Ey
EM4X
-stk
pK/kOs
B]u%
jP^6
tz5<
Environment
vtI-F
get_EnabledCalc
p3]WA4^;
VirtualProtect
-v;8
}[\W
#z7n)t
;;Yq
]X>nHC
F'+A|d
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
LJe}
U7t
"G;c
CkTc
'1y)
-+ANu
o5,?
k1Mk
Zou|
get_EntryPoint
11j^
cd Z
jP=c
fvA'
7Vs=
]w+x% "
ltSF
@1z
z@H0(
KX%|
(~Tt7
Tb TiI
Wv=s
9 w^
z .a
@w5,w
GetType
|Eus4
.<GU
Mk[V>M
add_AssemblyResolve
<T3
m!yf
{Bhl
W7 %
IDAThC
21E+
g"!)
;B6xjGQ3$=&"QXpKAGG|)T"#(
${<k
P8rl
<aD,
XJ !|u
uxM4
`V;:
\S5h
NvJS
'aj^A
set_OverIndex
JwJ
DXg*z1
~'30
*/6R
~WBU$
.OX_
|]:$5
V\tn
8Lm"
hG~3
5]u=D
PABtfJwp+`C%T5wQrF3QfrzC"
1NUR)&/hu?Co26Y%A~U{Gf$w
1F<<
D$J`L%Pl
KFIn?
1|Mi
TabControl
/#o4
}[N&
vjXGQ7
>'9N
1&w}
!|4=
[*Wr
3b4N
I3-}
vOcy
xyc
j@g_
-0T7
cpku
(T{j
h[(<-
PSdZ
/t'D
E 0hro
;0*eV0)yP+<o9$P9H8?s9uH5
%FSs
R(Fp
4b%8
j) C
|bYp
H{|]
og4}
Color
!8U!
Xug{A9
w-o\
wRanslK'9r5u*<f?<Vz7=|xU$
Intern
o#x!s
!D$@
$AK4M
~m/5^
= H =
CM%>oX
F!v
UMW=N
set_BackColor
8~_W
Oa"
:rnLRtj_?YwI7l~=D{%QMP#S
h)oY
c-Qd
VD,n
get_UTF8
_BnYy C?j
o9U
hY75K3_5x6'lNMs8:<$7|"!_#
m#R(
get_Width
EQ\
n'e<U
}:Nne"9z
M\ui
$|XnAT
T Ci
& |x
q9FW>
ZX {`
FIBby
||]%
UB&X
U:RN~
Uo(i
Zf<cS/
qH}4
U@O
get_Revision
d'5-
%Bj*iz
CB A
76@Ql
K-4
/a;C2
4y(P
y!2m<
j!PJA
L@"pKO1uah22me<cZF&r{e@,/
<AV)r
"MGva
\bCn
K9EoQ
T"|c
B7^,5
&)]r
:oM
.td
cU-s0[
UD$+!
{+UO
PKz>
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD
G)
p6|T4N
ib|B
%opq
,n[
|uG,
M p6S
b!/wSi
"DT~
Rr?3
-M{
rPu
mLww
(2xC$
E$k
y*t ~
{FJ
,S f
VmhT
`((K)
;3E3
9o?R
"Cu'Xn
dtx1X
O^3X:|&2IWK
LS/S
eYAz
ME
;S_a
,}J7
;E*[:
-})G
k3~m]w-
Mi^S0
@T(!
eT@M
8YWU
LOW |
U TA
xi22
5P
^9z{_ u
4&KY
a7+r
'w2o
System.Core
~mun
16+t
n 4Z
Hs)}
Pg;|
=xR]-b
<-g~<v
f-D
i W
y"O|W/9I
Delegate
mM(0
wecdX5mN
dtbe
m8U 1
[\gfS
C+)i.
{f4~
FCGt
n39n`
:(I
\wgth
=QLB
Dazgs=f
X +4(+
( _}
h&f2
*~8XC_
OQu\W\
<+awD
5Kb"8|d$G;|Vk4P#"$6LUFK|&
x.l,
rCd&BymP2pjD^a[d9)D+vSRW"
U/#h
7eD^
g?iv
T0|k+m4 &cpax>&L{b494Nlc
H*yP
N xpV
.V1A*=
Jzk
NA]O
w<\cjYV
+? w
&RBE
2ICv
3"8W%
ex1k-0
{IDAThC
''H(}W
MC9s
hOM
6Y9+
u!/V?
'zBU4
>]_x4I
>{TY
m<U+
4Y3=
s_b"
jQ1v
u^(
;eFRA
yq|u J{kyt% D|vD@!W$lo?U#
zM10Q?
6gnpc6<
rE+M
yHdK8
]I:KPm
}ehbw
set_DoubleBuffered
@FY.< ;cS
m X
get_Length
N xK
2Y*9
wI O
u !~
RB-8
vy_)}
(Ab'"K
kH@k
-|HI
qfvbTw<R^":;0 `!@#2"7:a,$
'eA=&;
`Kzyo!!A|SS$mV~VrS',o0VO$
9%J),TLVM%<#56rX:86%om++$
imxT
! /4
]4pd
_]du66
)S 6c
H6gI
Contains
T|{&
xhZHB
/^@y
5y#US+^0\SQ%& SvR]M(h%vO(
IEvidenceFactory
j ^o
_ *.u
P.#
pbRV
w=TO
H<do(cDf_-"WsQgoJqLQCRhi#
5mJ
'@6Kp
1LC9
V6_$
ValueType
eVV]
KNVH
GuidAttribute
bYj
?.Fc+
&;*#
Tr+E.
q-oce$H!$_)po+M=M0adE-~[$
E9/j}
Brc\svi
&Y|l
JDQY
1?Fb*
Zv V A
W^}R0
z_Q
/R]
<JRS
6zk?
d#UvL
m're
get_Count
cZANM
pm+L
|^YfeMW8#;[uzywX,tfLBG##
ny.A
b?b
s]id
D#?z
;y*{
F:6
System.Runtime.Remoting
h;U>
"zXP
iwjBU
N1gT
CFVAhL0qJEjk+/rv8`Q`$7W6&
_"'<
sB})
D]!~e
mOu;.
W)6)
UK:u:
ekPn
[%<%
pqxW
.x-sh
-r%n
%qRf:
l}S+
GetField
1$p2
.Ion
;U<g
2>Pj
]g.'
@L|'\6i`Wvh6X@hH=ZYjPBco&
bim
P4A}
;ieb
OsqM
S[Hi
0]t]u
F_:x
kOyQ
0Em@
Eg:b&:`a(yS'dI|8)_v9sy;W
]& r
SCw ImV?mAD/!h,mGJ\2'gu[!
8uzp
^lR[@<A"zc=umI_nN85Tt6YL
R TQ
a>t09
UInt32
zXS)
7nEW
@ZiP
'fbLLw=
get_Version
R#q%
7N,b
/;/.
rb/
ToString
9 #W
kJ}t
_ BA
<M<Z
+\QN
a>. i
3>^ &6rNRG'=G0H{/KeEcr42
Rl. m
04]5
nE L
O}~W
"\0Ws
p':p
AssemblyCompanyAttribute
, n[^
GcCU
H1 9
pnc:
J >}KB6~Xy9Zm
% /*D
HbHO
s?{#
8i$\GL
H\(ZC]
pxv,
bXiy
`IgR
l%%2n5\
)*,;
X<8yn@=+
ServiceBase
Gt'[
(HZN
#!}r
ocFz
=i;"
7. Z
jfM
'fg:
GetTabRect
w:O8G
bg[&
a<~in
D6XFT1 at"FR)`M!L7Xb|(`Y#
:xC|%hZp&$e$'RRfq^gZFl?&%
6}66
7S:Q6rIN@VtN2%7a5#_2hjfJ"
DHN5&
a:-,d
5QQ
>yPr
]M__q
.2)
KVi>mK=^Ypt(}V+& bC3t^vJ!
mRl89NMq%z,Ha`SSv(RF4DJR#
H#+k
##sI
\v *I
AssemblyTitleAttribute
h%o"
fKx$L)"
}D&Qp>M
r50{
@Ims
e R;
p^R6
!.Nd
kfhr
/L4e
YJ_6
:s}kd}
0i"+[)+f6`!jeN$_/1/>d|s<#
n% $2l
6T\c<
2CdtSv]@m;+Ow_;)&UQg&o<$$
=]=D
Ia1%
x\V'
"J|U
e2 t
Q%9%<
/GXP
ag[F
R -B
i>mp{"O|)FHyQL=K7$tX/QTU"
9.B,
H:Z`
ok` S`
C&qfHIR'C##=%j^'I7_dLO#]0
(&ZDy@"J2NxNJIw7( b^\|k[#
=)c:
#<n
E@v$
vLA?
gdP|!
OCkSI
[#sU
mmDJ
`T|F
"X
-EYH_
wXKr"
Z9lX
5'3J
y]T
]b_ZiF
J&c{x
=ceP?9
1JlK
!+^a
Data
JrKuxk
g:%\hU
3 d
xQL2
aY$_
ApQ
vGwG
Enabled
[|($xpva,^|dRq:5\I1`cN>}!
*Ik~
xmX}
uG{LHNm)|LfX$qRNC!Nd;iOS%
1lM(y
cB<rpA;}?"F"A<O 9j3'@n l'
r!#@
h- bP
9tAL
ItJL
\i5_Q0='=HL:HWRvP}"X\|Rz"
G-9l)
F~> M
~31_ +
A'ph
RzRCN
Sr]"n
hhPv
pHYs
.ctor
J[W?
\P2@
hORX
@_@
#P }N
get_SelectedIndex
zN?'
swkO=U`9
N]%D
WM@1
get_Message
Container
lu;'x
@BO^
169j
F$]'h>
k"Qa
&-CP
8iluHw
A*sN
Fx~'C-3
3KS 9
Main
0jg=)
uXtG
7K"
~9/T
dy;}n*3
NMKX
_O_M
yP*d2
gu~7
9=cK
*Ie)
ZXJX*
^M.M
kvA7e{
lw,-
hw6"
4hM$h"Q
e(YZ
1>/Xj)+ZNzDk&@ Qvi1BTf(%%
sB i
]LT6
V{h:b
2cQ-
H[]Az
*]qE
q%Q{
o,-Y
nyza
NrzlBr
43D3z
Z6d4
O3jNJ
0^VZU
<KT(
X;ou 5
l]q%
zx?S
f-!`
5}:u
~w.w
&jBlXQaXM1LmhuoAa QB\jAX
9p0JY
TzxV
wi!Y
Module
3s[D
(XTj
>x]F
26v2
)X&_$
5Uu|
Array
9
8t>o-a
Tjmyf
/w)Q
z/;fj
tMo H
NiF
+l|}
j!:
T ("
wjt~
@.reloc
djmi
zR!x
o::_pYb>tv5b*0Au`yFR9pU #
L>bTO
]1<F+WS
e)w
#:NC
],HNf{
m^e&
A;%I
C=6Q
~/ %
VflIp
PeUK
rBQGv
TabSizeMode
h#Wo
Byte
get_Chars
:[iZ
i0(U
g%/g
DO{-
n mcK :
F.Nn
(7'\
HHJwwJI
% o[
tL(@
]F4{oS
+RsZod
7\gl
3 4.
D3GBgYJ,7G1W@C4|dFkZyPXK-
4iNg
>$t&V
ZHa$
4Y&b
';s6
O:h\3?etL,RI%&L8Lh"qnPH+$
d]p
+J%jf
JF3]
i#a
'/^S
' zujb
s25
\mo<
pn?3
W-Uu*
&|s5
sM:-
;[3]
g<n{_6
A)Pe
$QG he5
2 c^
i{mWr
deYxo
cqb eOL
1ke(
9b U|0
- !IW
M3kaimn6"C/n{JupG+-P=td|!
jWfAGibE]h'IC-\2l+kHelY8%
do2R N
a b\e
8yae
jTDR(
sny
a}q*
1Xy`Xz
p9=L
mo{k8
@M''
{T&9
4cQg
1C+vX
get_Location
o6Lh2
..V_
K<~E:7
A}V2
G\/WW
^?-j6
./?dfr
Mgql
/k$:
'R[L
2$$> &
v? `
?L A
#{Q=Y
U)X<R@M=m~'*ku!6^MLvxvH:(
U0N
I\u1W
B}`XV)<A$#57I}U W-pd5a'=2
oK~}cT>%:zM;ud1S]=PD<M|L
SWY-
CnjJ
FreeHGlobal
bJ[L
e+C?
S yp
%'(L
N KF
Z K
sxr+
(+1v@1d2Pk:fA\P|Te6*oYqt
Y4%x
o[eNL/Oy
ub_Y()9
M1rcz
(6RK
@#A5@Xb)VY63k`L({VwQ7$OU"
6{ B[.
o$`vfD+_}b{ V'B-QPB0hh62$
mb U
BLq{
rcX$
|D"F
d=wIE9r
q`fF
Gilu
s L%
gK}D
\C b*
}H9;b
0@5
+ UK
K&[ VLQPr #Ecad$!6_$?V"#9
4=~U
6&O
vqi>
HQFGER
RuntimeCompatibilityAttribute
EH:HC0
BKr3b
j&R^
`4ZzS[!mH ,XlQ-83G |2Njk'
:s/{
+V^wPx
+R(+
IX`b
8s,X
<3XA
V "'Xh
Assembly
I 0n
wSY_
-ks&
T*i)
8D8Y{7|
*U^QP
w6BF
Z7UF1)Z7F3lmp%+J77J5tOwZ"
auESlp\w
YI.F
w .G
fqOc
9-}
IDisposable
6q7V3
d&%Mr
q7`\)
03K
TzM{?
U4-l
<z[W~mIR!_J,r$!5,dI\c6'4#
OI_8? 7+'
#[qa
uT`"
GBKz
Q~5
kfel
uLu9
nPf!
W@OZ
Rr+n
ylj1knqm-"=CAdjz?DoWaS6M!
^l`S
C648C0E55DD0A71600A3C979FEC05C180303B2F7
-P41G
9]YP
-a[Y
oDHZ
wL')n^iG@qyhN\j!CQIJYe:p
NTT#l
ho0u
7B(sZ
lvDF d
Cwi
mn ,
(+J9qhJR4N{Jy[COr+K/1"*-$
($kD
Size
vfUO
ExF
EQ A
lYRy/Iw%'9:Q{c%|09"7Y-<E!
(c?)}
NewGuid
Uv_e2
Rg6&
>' h
nX*:"
hCae
)Uf5 b9
set_AutoScaleMode
I#F[
~V!<
3gM:
!LZ:
bZL2U
o ZC
*bz~
zIlj
x]eeHKEXg~{Tf"dm[dcSUawJ%
}*-[
= nl
}^ml
>+4#
hkR`R
=Mw+1iW
VTRN
Znawb
6Fch
wzR+
}J3L
A8t
Rc;Tl
IContainer
K9_Tz
{)fc_n
]II1
> y/
9LK*
OJ8v
rI&#
&qo!
)e[^
KQC%K
Y`z)
hv-4
y.Z+
j7X@v:
MrYSu y
Z1R 0
Zc/-
Tnqx
]jkn
Kp)4\B
ejx f
;ue
Tf >D8
#RR\(
T=E "
'H-=
"Lb
H_J%-0
MzOBh+9)5C22DL!PHc-0R*p=-
ISerializable
G'5x
sM_-
WM5VT6gmdT-*a)kt#00+S"{b&
PARC
-sH}
Vq7|c02}CV2z)tg@*n7,=yyw!
n1Vv
H\.pk
I%zO
o{c'%
@WC/t
mlt6
wkLg
VFq]
Z(1
2rXB
4[55Zlam9Kl:&<L+9/XYuX[N#
J{^
=O":
P*qb
Q#QB4'
g~Q1
Y oB;
T rm+
-K^VCrR=n%Y0jF7z]x(?BU=)"
nA:{Q
Z 2`'
ID}|`
I/li3=
_+V$R\
H|+$
(>Jz
cSVe
'WM<
0K\Y
#Blob
vj{[/
}>@(
qg3oH,
get_OverIndex
G8hb]
GpN47
'B O
>bXkX
1%K A
9p!eI
+MBb
1a1f
cPYu,Q
v#O9
,@re
/is{S
YoX}
\`1afIaY
W9BA
,0xOP
Lk(a
@D4G
a`gr'1lL
eyjn
KHl@8
pPmYlY
-;l<
GetFunctionPointerForDelegate
[5u=
AGX?o{(
.fD9V
6h/jP
-k ^
>b ! $^0
7Y&6
f tUz
G#(=I!
ContainerControl
_]~t
Gwp))
w!L$|g
($zlS>
sf u
zIDAThC
?~@F
_>7/ y
xe3<
*If"
diY%u
O*9nI
M:jS
q \$
2U'zr
J~(t
Z?ow
r@n0
B7<Pf$
ReadByte
g*nn
g c
u}lo
i;}s>
8lu\Y
t?i9
"r$r
<+%Y
AU'i
E)K$
(e#zr
d7u
3F1764884A245F1B3FA91DEC2E25339F23787561
<w%q%
-lQ
cE_v
IMKwmh
1Vnq
<2{^H:dzY>oNG_A3 _ >SvMg%
L802
ltvuN@2}5j@|GRs@ObndO}lT"
'}N`e@
*6=z?
rtMJ8
".s_
ua!Hh
{j5I9G\M%c6d0P$(-&%B1J3%
AllocHGlobal
m$"
/)SU
sftM
LsLq
iMBin
#*d_H
AssemblyCopyrightAttribute
FJZM0J [O0B<ynKBY#\Vg`{N#
P`cTx
m<."
-}PUc%{]qk=A3_v&2R3,$h+\%
cOvw
t"'
?lO2
-0Qs
`B G
Rn{X
E}3m
Di;?
fG88
xM Be
".H(`
UHcf}u
@rm;
W wS
^Ld\w2!N3m,y?\i'IY1 4H*u'
GsiSdWp#}:6]_\i(R]uphq<o
T1H X
9dV,,
?~=G
z^z$k
Y[H3w
6 $G
a7yl
Qy~
-iR!
+0;R
=4{FsR
%U}M
0zVa|
:9z",
{&Sm<(N9=3SyGe^)r%+3 T5l#
JJ+7
D)/CE
!IP^}
nQO$
b(;I
'ehc
J}y=
w')&S4
iwa6@=q<rU#"nW+(o8v>C=2_3
1w l
{ V=
dSph
$d7d569b1-de38-46b8-a74d-1bb4220cf8c8
UZW<u\bZc%q4PNh5^g_#JJ_V!
yL #jM}#
<x%8G
t a%
m4V$b\D840Cq|M+44"O(Q!v<
}M ;
nT|h
:oN{
:K Q0
>uWLiQ
W\V6
I2;e
_pww
hx&P
wY>L@1
)BK(HC,?sum;4:]]qzl6Ak<4!
l(Yt
0.6xGQ
)I :
E8TUvR
Mn>Y
^[g;
;>IC|
_@y;
[XLw
,B#`
<cQb.b
#D Y
`Y@o
ControlEventArgs
G/2N^
"Dmf
*M.,L
}uNLq
F}7 \
Nhgk
>'8~Q
*-&"FJ{p#b^(%Gy?[*3{W;$?/
-K^|bo
BSJB
>j99_u
set_Enabled
lq)Hg
qL Lu
uf"/
An G
,/s]@#
&? c
Read
ruQp
t6 ?
JON]
zCak
YXba
QD|}
R_;7
81H8
ou2Us/-ySv}2z=y,TzMM<>!:%
F5 iK
5Z!t
$,sf
o a7
'$UCh
x (.
DQD+AaZ
Z,:vBfNH]V/3PP#:X s":]N$
UuMY
Z'm"E0[{k9r,vdp-&KE$h0-E!
LgyEQTJp<|F%H+x{EOD@rYo&!
get_Value
i,zo~
lg:)rN
`N&Td
XNsu
/c5-
:9?Se
F`j89
kvHL
!63<
oq{-Gf?,Ej''~y,b%^Ot*Hi\!
tT*7G
s~mWO
Vvl5%
k>0_
ZS8KG6-ncI6w(+o'oHoOa^!8(
+i:XkO if?6mq6KSX}>/K,v[
CoL,
DN} +|
;Y d$
qa%x
/6!F
KWPaH''(nE;r79MUZ6N18;d&!
\r-g
gAMA
'>4o
:m&NM
2~`W
{c=
$`HH
kn k
AutoScaleMode
dN-Eg
E3|
>(e(
MarshalByRefObject
QGvg
nu;oD18(
.cctor
]eAg
Dpcp
AsyncCallback
?a6
Zz, Tk
7o^VG"FLg1d37^7@>11(Alsk
1kG-9
mscorlib
p8Ld2,}?5>+-Yf[_bT[L c<L'
QqQ
SF5+x5CV0>+fPS?)bs3 \8dS1
Wi@~
/qzY
Pt\M
$D)
9>P95
/kMs
G\y'}
0r]|z5
mi(c
/<=L
B,v]A
E(:-
OxaqIYvq*)R;!Jz( reipa#b
Invalidate
>62"L?YLiB=%]!97s[A\t6?K!
Op@K
6dS)
<FTVmT@
:Hxb
r )!
d+{3=
tX_bEn
$6XQ
iKa1;
hZDF
4dTj
7`Au
u#QJv
S-n;
*PCZ[\-/ a
get_TabPages
0hlg\n
!P
g:hd
j/Y >
%z~`
Z/(%
9A2
HC)B
ye8(E,J2cKDy=tOI=AGZ!'C3
-?Tkc/
+7R*
J&K[
|Q^o
yroSl
OPGD
Guid
H7sk
Pak@DR
`;C-P
/yT]C
k p0
@b9T
PDO3
s]}X
FFK)~/`6w(Q2K?\&mCaTd*p&
dG
$U{&
,vvA5
U5ju)
7FEZ
MbAr
5X,pBZ<h25S1C}Q:5QM;&,k5
~N%q
~2`fp
*lUM
j;Sr
C7YI
System.Reflection
j@^B
vz%&
k='P
H-tT
cS UG
v}> Z
nB2d
6 *A
RuntimeTypeHandle
+48.
_x\!
w bt
=Z"U
eC8q
lgm
feS Jv
;trJ5
Te!'
2018
Z)FS
M)*T
^[zjs&e,B-pae{PR*"'7i&yO"
N?v!
y|O&z
@8Kw
1n&Lw
6?Fk
cAH8bJ<Xm[2CN(D%f--qVW>#"
Qw!S
sender
p48{w
Qjv (
:MF#
&I:X
an\cx
7@<~KRs,N0$tEKj*(7_88<y`)
:Jd/
M>-M
#_o~`r
vN-I
NNVRXu
vkiC c
49$|*
-jwk
U\>buJVE
k">|
Append
i4\;
mS<!f
7+] A
QyK+R
522^
Ne"|0
/rG#
)l (
System.ServiceProcess
op_Equality
)l#'
0oz>b
u H^^\
Wxy)
:&uii6
vW#_
nMIN
xcJ@
5M+3
T|4,;7D
@kAe
K^2y[1k"=pqg9{}~vtF_Wqym
T]e}
Q/'%IyYuU+"4{Jur75}DmOVS"
Tcb#q
5Bz1
g]}}
{2q%
=X7`
w^W
eeYq
AssemblyDescriptionAttribute
]rcUC?,>J-%2iiGC$U~-$2Hf'
9K q!
[D|,
mAWL
b) b
zurfpZ
(oqx%
F?b,A
tgBUo
sE]583!
r53dk
_8.U
d61Z
Y d6
T.9|
lB8#
5}RC
vK,0
k OjQ
Imxv&6 4rySUJm\QQfR K/7&'
1:t\6
CNu58r
:c;2
gZAC
?cU1
'NFG
{ r+
@Sg,
hz^d6k\
xlUZ075Ry4WDbenSC;J[/;>q
7fU<eV+
\)W&
oo]G
v|*'
)Uk_
A~zZ
G C|
m2;*
Vt}6
R@ 8;
i=&]
%tMX
)]|)M)b
"w>(
]^,15
_=H~
hSVS
HJER2
<8[!
YjF0A
>dVW+#\NqT-Nw8?uz*)s`-sR!
g|9?
o%c
#\"b
}s| ~
97 ,
{T@qo)"hu^7@V`~H&aw^1!qZ(
rREGc]z
_&S
RFe\
G&RH
W5~aoc
bYp2
xd]#n
$bpbOR
IoC/
HJ!H
UY$ <-
R*XV-
qx0K^
QX* `
-'M@
{aG:
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
GL 8'
D928O
IdRD
j<Xf
40^Y
j )
1fqV
/V#H
juF:PF/X;D4!^,,/?ravO+Ka*
V)L=
q#Lp
2H0A
UX s
#Sm(
)4O
i/op6
(Csk
[0{cJ
mscoree.dll
!This program cannot be run in DOS mode. $
U3N-
;1[38
callback
9GB
%!.p
bL'v
pW2LPh
aveJ
mA:W
G4cA^E n
w-Y<\.
Dispose
sgCMZ
<Cyxy
@0yg
tlnh
'Ipb
`)`o
3B)7
=}3S*
5Z*De
'xZh
&u_8S
wM_T
!8tM
4E2BE99140D24066CADC84F74FA899FEE5976B68
EUWd
|iFN\Mi>C~z_eL)r_Yr!k&W0
6W+ [
ICloneable
)n}v
1A
J;2j
hb%')
A\22
DM\(f
)6!k
N}}R
?)8vSB-
L1=F
|5=8CZR%;bf:Nj(78W%[(pyH!
Dz\7
Kz u
}$-4
-0)p
eY2
E2~2,
4iLa
];<
O]oUy
PAf1@
iiiFJ
8aK*
;Q#m
)LAl
=!34
'U>:
VEj^
i>sL
V[QU~
T( N
8A#!R
JTB~y
n7HW
#GUID
b*zWT>@
9Zk?
7 tZ
j:T[(
KHh-Nj
;P w[$0
tt,]/]
/,usT
WqXCJ0
['k[
ys?w
E/iX
&vemhsp#6Y`8B"Z-sTM\;G5!$
x0VM)
]+)X
|`58`
wz;;
:mld
^POg
ZJCz
C /
#8^-
5H+,dFl"SgJOX7-N=0%o_t{@"
@4_C!>b"&~)<F5 vZ? Lg4]!%
!hr?
4^:k
dg|O
}lK8z
QUQs
G#ua
qYLt`C$- [
6m<T
nF}
6dLy
d<f/
+k +c=
'u
Pa-NI
aHY
|Q6H?
. :%w
jW*w`7
wBz@ 1l(T<yS5VomoN[|: S&%
_#CM>
Va?>
zBA= &iZJ
Nx]9
`fBB
$P [+
T)]E,
^*Qyht%D%*ve@wF]J| x0<QA"
get_ModuleHandle
9}OmYU
h&~
'ur[3,eU]fJds|C@M7XG6ez3"
TFUy
W?hH9-
-=Hp#Ev
rzsHjy
[ @m:+v
3rr
cz4z
{K0Tzl
IntPtr
>[W
,1?b
ys{P?L
#-F<
o,^nd
JjZ?
}M.>ay
$[ChoW
$Bo P
+qbX?$U
|Z]7
6s!3=
*AOj
tB}O
Eg'L
XuinY
DP]_
fP+e
=4IM
<N?=
1,O"&e
4(M9
f ;,
TD8&
{EqP
ct%ZeQ
1 E-u"b
&Ci=
cy87Q
*8 H
6 jN/Q
B[?~7
1\!C
O ]=
k ED
y 8mP
lWZ9i
System.Linq
x?b6
3e4*
qx*u
MO`<(
zdtir
x37Bf
C708234F139063BBE3CBE2208BB6ACFACBC50333
isB<
{`D``DU cF2C%+&X@|1GPPQ*(
<I*Fq$DdPU*'+in{C/4f(Z:['
@F w
i`g[
ooZO
R: C
#N$_
h Wo-
)/vj
SaA[
p=38/
##WTI
R8n@
9w@q
?):"/Y,>e%_lCI};e+8gToE,%
B4\9|
K-|Enh
Fv cIQ
CjIZSe
!TSh
upLP
~Z|O$#+
pa(T
InvalidOperationException
yIDAThC
~EAhq
kDe[
WM<
cfTf
Y<v5G
88&>
NY#
LW_%|Qh
d8txVaWImlG0/}{PiT#-oxAB!
Xs|&4
<Y >")
%?+c
cS fU
*4IOT(`4
(xB9
].4e
_l2/m
`cZB
BlockCopy
.e]H
6n#OJ"/"u6I0g>?(O(-;y&jv%
e-==
ExQS
,3Z ,
n?dw
u3>$
7gYH
8,,|C
%E->
= 6Xd=K
%I495/9c`8`9,rAZV 2$ <6e*
7u_K*x
IYJ;
n'\(S s
`!=`
L w
ECT
MWTXg
6 PUe
W#rxL[
b,3j
Io|O
6LUyOS}aFr TJ=]:VD"`CJHz!
CK_.ov
)mz^
x8C
8}!A%1E*X$ D!KTyJlU-(G7
=C I2t
-7rZ
lZXaI
%6G3
Bu{^
(x^-^
"WY%
7oYP
KXM
6dd1B%^fJ
g{'$
A1ah
^m-|c
%hv}KX_kA=-z%N~"r oj+T{h
$1ZL
Q%!"
yF8)
4/#)3
,2l;
K kA4!
\%13
-q&
1$\_s/
;}< >Lc+g>reqIAp| _&'Op?!
}# <
J!!xk
B}{v
~JDK
0?"J
J)1C=/
=`uBNR]
SYp`+
NY"
)5"c
C{x61
sy~{bS6
@/RX
tQ66
Mk_}
(h=f;g
6Rqk<!
8L""
x>"
~V25
OY@Li|7p-`gYL`*~<W4\5Cca
MethodInfo
C-8OOZ
Sj+-
)jxy=y
n\nXaW
m` #c
c7c
dA%G
|=3+xTK9txUMo<mNtp`tMQyc
~$Zy~n^
:J8
`,O)
<giF
CompilationRelaxationsAttribute
GJZ
ua}d
,V \
kPa,<
TabPageCollection
"SAJ
r$qn
)s6Q(
Q|]i
xE|{_i,QGq-i}Qn{]sudQ,,x
ACU8
MemoryStream
E[lU
Sl^.
7 a~y
hyf;
`%'7P
Fx=_
ResolveEventArgs
v.D0
f&u`P
jw:U^
k1
{i$^
^6oe
UAD\
9>L ]
7Sr `
.9gV
Ua ^
=vl-k@v=Zh'r(2Fq"w?S8YQ"+
OnControlAdded
g"8[3
O$0r
y }@ q
V<+@W
w^
* Txj
Naq4
8}.t
|BBt|
mOx%
@=bXy
,IC,
O ?R
f1WP
*X o
xPvI.
8H58
Tcex
N`p
|>^
*]gw
Prg
N@#O
im`o@.-
VUci
qi(w
i,q;
O>l]
[/z,
Gwm]m
eN_Gm7
OIQ2
VKW5JiAH!^5e'ryC*<B+qSkS
Xq &b
v E_
]X.:
=`:]kN1o-&}OFw<{xsD4&QKJ!
J_8fz
IEND
UIkB1kl=U2$x?aTbI"%=2d>-#
J[> D
l;y G
FzQPA
NE'}
e7ODA
4tD?
$3L&
79+^-b&C,>XXz"XvJ'5'+d{G!
0IyG
" !L
+ysOq>i\0
nI
AWno
*."W
xlS9
'N>{<0+/by__[uUZ21) `?'6)
g3AueI:
5\sV
S+7
>W &C5?75G&G od#in+dWdPe
f^%
{HwJs
%tbzAe6}Q<'Cdr`4X5Y&XPkU!
(z;M
oN,PM
Rr^[
6ohxC
bf.4
'*-z
G1mG
3)_h
(M}gE
~%9
6QpS
^pFf
_uf\

eAYJ,NM9xEhLcpu~?hqAP!4$'
)V7
Mutation
(z>
-6u/
{fau
c/JQ
Rectangle
^7W~
S i`^
)rBl
cS[ a
get_White
YW@?e
Uva@
`?"=B
H8lek
Z'T9
V'+:
+XIq
A@f=
A^d(#
K[O=
ohN s
eR_A
Concat
$:8A
M5#;
iT?HvY2)D(v
X'sz
T( fa
StringBuilder
5q+TC
.R,9
38=
k@3@
Rc@,
r/"
(0[?(L0qFTGAhBKZtaLWeAAr!
z\D#JB
H5Vj
!}#0
QGv~Q
ob{]
<V140
)hJ
O CdJ
>-T
hcUo
g YE
8^4.n
PI*w
F>cC
52hn
g )gA
@ 4C^
w{hXPk
(=ni[?0sOfc+je+;Qq~+h"!['
5#7
e0(FIA
E}J~~]I
Qc*f
{<]!
F@E%,g#p% Fg5EIG]*?S'"1<!
uZjYoqKuKse#PdW9t%}N+i$-
%|Y6
lUdHa
e_urN[
9 /H
o\9^
%"?j?
d'A{
>!qpU
0pD
be '
{STu
N6>R
B"1:
gVHi
sutS
""nVKj%Xs(gw6@}ox'Gc*'s,
>dJ|O76W"u2V&cJ$*i7\-aV^=
+@C&o
obSNP$/-[eY4Nf`9DSG#h(q7
D>z\<
N_d0
m=D%
eh .
dgO f
`a2#
&tg%
5U[K
AssemblyFileVersionAttribute
FPw\
%VL%y>.
FeTv
&zwA
System.Text
xw$$
oDRKufs
Q^Hy
_N6fw
= IQ9
}|d;Oh
FDl`
3il@9f
Rg\t
ew0
8d3#
yyL6f6P
W*c*
:->]
>wBYrQ
hiw$
e,k@e
B\JhG
5*MUQ
itezS
:q!h
$u 6
DdF4Rfa:0,A(qrb7Dqfq;|?f!
42clu
hW a
Ktzt
8YH@
@c %HZI
LY\+ydj
deKTh
Component
GetElementType
(Ez
eq4n b?.
X?5Y
p>MA
oQb3n
wdSg
<=Pp
)n K
+zc
l$Hor
9 4%l
(+
_>D^
{Q#5|=ad=J=FhH0qXug!V"?=%
dhab
kDKPr
3)Gt3
h7( R7
5FT~
DII<
K4dK,Sch6
5 5-
j]1<
(/'*
"7P^
m`k
:@H:
Avr7
_S%)K
Z]%m
Z4[P:[0JHT:RDSJE_j;@U`<N"
}!`'
03Qzt
:D]%
`^5Eq
lq1C
7[r
=[?T{
!wA}
-[P^
(dLJ
1]4E
a7~/d
%^ )RSWP@DBe!LUnm/I0f}{T"
#1d^
>q"(
ks,ZM=Qd-5X*Zmbu9o[iRr`W'
,@ "
-:K}53t+D7GC9r850!Z}x-!u(
4PPZ]/$
.8z'
Encoding
)$l33S
cV5$4+
_~a!^
&f/
.UC,
2t^J3kVRFzvawq"WC_bAdN,9"
FieldInfo
{|RgmF'
F9v 4
*/w5
C4fmME~hei'U:ZP{;9 _d62i
i!5Rw
[Oi@e
ModuleHandle
Buffer
&T&ir
0
/:)HL
Vb /,{mBy
s<I&
E hLE
kcf2$.}
05`zGC
r)%4
im)) gN
J\JK
8MXz
DKlO
&5Uf
q=Ne^;X
|+cN}
String
AME:@$XHa=oSS)Z{26}6-/+M(
ICollection
_CorExeMain
&p#[u
)c_n
W|@)
! IsB`e
v{h(
')Z /
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
i~}[
:Y4z)
RWSn
=6 U
hUB5
0RS:
&t\ .
}eLY*
5 bb
}Wf!
! 1x
KXS!
M+6Yw$
SU6
^7)g
InitializeArray
U %.L
,5'si
B$ t!
!Al<
x1m'gf
iv_Z:
cu r
` !S-t
]&fn^z
KeyI0
WKJ9
.3^o%r'R
EaI0
oo*t
ToArray
rqbzz
k588D
v`8P
A@e
OnCreateControl
BIo
);6*
|w?n,
ED(P
Y8&hA_n6L[KwVvh~=B2UXuTt"
?Sdbh,B
$PL7\b&(gfTN$eQ&-EvBJ)q!,
y8UUy
DtDU
5
EHmt
ZSmb
cG"g
WL[;aDF
:O-^
QFYt
uOm&
B5is
cTNl
GR!2
G2v- QM
Yx@#
Cursors
[<n0twEKXUrtt6}!kB:t$S7?
2_ E
3w\5
\L@s
@:NR
WHng
get_Hovering
zi0RyC;\R(lq
x:H#
gu|,2
#91|CCy-,5~#~sg/!@*WYl,)
D&y,x-
V@;px
)0wW=
+ O[:/
\^Mi
^3~<
.ltI
&X*l`x7B:oKFCfr~@h5J<m:]
z9K`|.
"rP[
fdiU
`x,9
"1-Xw
L+h?w
Confuser.Runtime
AI$(t
avc+fG*RIk!1}khn[y'HlHk>(
aWOKN"/P`0IU%f!1IZ$J^W-_"
&ZbXE2za:\ Vu2~VFx*9"'8Y%
1}~QW
1u<
Load
W)|R5K
]7mqd
E5iN9]YAm6msA:07?hC9`JNO%
BBAE
h5(xpPlMu<UC<S%S=/)Eq%*7!
w($g
Tq(=qeafq_;N|_z9Q*W4vrDt"
fb5f
<~\r6
System.Drawing
W7F|a>8>;i>a&%OoUA~99!VO'
`}]@Fd
1q~X
Zy}[`I,"tJ>KrA:SO)K@}D&T)
Xo/FVP
get_FullName
!| NO
ywC?
Q/o=
96\b
y>m;
x+6r
0uBDT89`u~:Eje,O~Ycya0"u"
tVm
0^Zw[8kv*6L{;e#]~N}c[_I%%
BeginInvoke
| O`2
9edx
^0'UF
|qvu
bjA7V
/Qf
~IB[D
x ql
j>+sXrn
D 8C
i %T f
#D)?
}AX
W*D(@|
.=t W
'|04f
Z(8YN<
AXDvPK
?t/w
2NO!
F9(
phO8%3
Y_T
r)/(h
.rEte
/Z '
X4,q
D M`
,[\%t
K~|-5>j
Z$[]
t8nL]
H2_c0Q_"~qq"\gJe&Yq! Sq'$
VW s
bG`_
~E A:k
iF<w
${F.
ln[e
- 1
'U$S
zS]'
I8b !
n&Q^
RuntimeHelpers
@^)SJ1[J\~[)ME&VS+M$]a0W%
c[yqg5Ng]~d3Uf2i1s[y{~Pr'
<m/J$/
JE!d
LRgz
1A:S
u J g
n(uH
UserControl
*0Iv?
get_Enabled
%yiv^
%85{=
~nIEeIKV{l9efC6|#D2%>\GV"
>A`6
\iAo
[E" 6
j95/
bh&vC
xaOGC$k{(& {-Rq!)CYA\UTu%
.s+[B
OT vl
PqU^
+nSD
}JMq
}|-9F3mIm8")-(!%}-lu6u3y(
35 Si
dF3,:
oe={
9<X1
|'>v
VQrzi>865G[Xu9V$}OqYC#Jx$
Object
.\ D
Mi:5
KLub
gpJ,6I
&{ni
-dHT
#Pj3
=BiOkw
<yIG
UEtS+
Rubp
ComVisibleAttribute
}|eVA`
F0 >
EI[&w
CO= < < < < < < < < < < < < < < <
]uN;
Ox7P
siVL BK'+nX)xj|Mk''L09|Z!
yuMZB;HY-!\\!+,JBeT<jzZb$
|:bK
vJ?H
GGbb
]03k$$
UIs+
M4Gc
1hnF
\I)y-
{L#[
JF3&d
+?s|W
3q~~
o`Z9
hkG'@
rl7|
'}LL
pT q
Z>]0-ex|b
;,~7-
:>FCi
V]gQ
} >
3oJZ|KEkU5)-&dIXXJf!}L6b"
e&DL
/)ob=M+5(%JzgN}M=5$LV{-E
5t"n
KB#_
~K1%
8'rF\
\XC8
Ikpo
AssemblyConfigurationAttribute
& /C:
k m)<f0;s^"@#xn/~| xoE{X"
zK]G
'Nwmn
W3~ WJ
fe"3M
OUEX
M)~27]iAm^f'8JcYyGA[40\:!
EojD
wN[s-
qey5
[ uK
o5D[Jg
YChq
OnMouseLeave
THKm
1.0.0.0
;5=_
,%8zq
9`pC
;^1E
#ri +
&L#pjo
U??Ip6
vj_y^
/ XC
+n(+
mq]f@t
ZG 7
@Q<_
8*/x
[ r+
wx`1Oxk
~{yz
bZ{J
Y?0WYFAKDXN|7|!*u'1(6W[R"
3/8jp
T1F=
7L87DF
mV "
Stream
17G9
tjyR
x0H?S
KdKh_
HZW`L
klyU:
KpMYhv
sRGB
?lAk
[y"v
b^R/b7j3]3Z K8a74#Tb*]$i
, qzR
M~{8
#vtn
CreateInstanceAndUnwrap
HJ d
zqZ7zz
'Fqs1
-Fa3#QI0PIP8&KGQ8Qa3p57Z"
\9Td
+-",
t*_o
kuGO
o{O/;P
op5~ssPQL,/RUN"i`D=MdBJ7$
D*tw
{YF\
tq)m
L&q5
bvwn
dAd7
[n!<
get_Control
Td(y
V"(:=LE
*=hV
ID%*w
m`5!/
d!+I{
i*{a
}0HJ^UC-TA'8`KQX`py(UUHe)
qb9E
3X,hZZjkS#56S?C2q|B1nYHY
H'f;[
edE+
n/b
K)V)
Z<y0
hVA/
#k lK
M.e0
A,JajbYWrlV0x4~?<cgKK{:Z#
Hs#xI
ZM,H
<ee:#
J^;,
}\e$G
ip5fq
Lv>B
Pg5V7
s5YmJ
JQ*s
hHAK
Q;4l
1Lgtv
&_$ >#F
DyZ?
je0Y
YN<]?
xycC
GQ%j
YwV"
L&""_
`u-7
\S ]
(vZ\
N6\V
QPe gm
!)^ s
RWbcH
!]n(
) Eb
set_ServiceName
d\h?
-0-]DHTIh,X4YoI]Q?~:Ki##
>x7
Ci/u
tuW]
,jPU
wo=!}
Yhq-
9:DP8
5]JNI@,CF&'#o0tk4+Bhk{=y*
Jy1zN
6k/3
_B<U
<F#h
'KTUo
0uQq85
5=#p
MwOM7gL
^u?0
\~W;
K"/}n
ax[{
YpJ=
'pkc
3y[9
\[={
4u{kU
.%"mj
AP+{t
6; }
EB:;Y
D|=#r
woi<
C9Hm
i~\
TF5q
=`18O
=E7O
set_ItemSize
E+li
4$f=.
FYBB
;Q|!
7;#)
<z%z
,V?"R,`W6HQ_C]RRa#H l<zg$
wJ q
^`s4{UE%`19w+sk|a+OM8""|"
|'Z,0 |%zh&aNSvgY5[`fj$*!
HTLCM
A3Wk
P!a
<3e0
dc";x
;jwo2i
Wd&t
dEX/
q7iO
m;.A
*_aFM-
7Gfv
z$9b
b4Wnv
u%1@#ku
b+Hx@
zjD@
WbB3s
)'XEx
GetHINSTANCE
qt?iHd
SspvW
w"o
@%+`
y D>
34Saz%J
g&}[3
Nc?#a
JHTu
M%R'
j4j`
p AM
\(i1
1YdT
T25f
yx
6%>E
nIsn
6\#:S
I6C
j}s%4:@
2J:D
dt#
4",]v
zi-<
S? \
%*l{
ecR1
U5SpU^_/
za ~
',b$
($O&
}+=o
*k6$
a|g$<
h B
RXnO
yZW$
2!\&Wl@;
0"bT
K cEL
~~ %
&XV
jfC1
}ak@
7 FJ
(60Q
{{c
[ |;
uQaE
Ymos
d[z=@+tX6_o OP ~Q`G((*Ep"
w&cs
V<;/J
`E xt
d {t}S
cgj)
faU.
O8$13
M^f
]ZH
-{X[
WWt^
@.89N
hx+,
in:!
LRL<
dK,
nb~a/8"K6D1& !j?na~6hO!_&
k="rba
v1_VhKKd/R}~1DC7/b4/x(`*#
%4JVGlPV1vyF*4ztCgo=jwoF
i T7
32kK
yX"A
|<a(}b
3P2K<9
*)cI
s/p/p/p/p/p/p/p/p/p/p/p/p/p/p/p/
eBO[I
xO0!
Copyright
N+n
ArgumentNullException
get_Major
?Sc&
bFiE
{p_}"
[N!X26VF=c5=r05JKW(&VUZE'
.lb2"_e
B9W^
Point
,J(+
| w{
Q Eh
-]/
v*8 Q
MxR\ nI)ke
lS/v>"@^iw0LQ73_69!!623/"
?V;;D
<|@e
o (}
v2.0.50727
\AK'
H0$-
%\@d
.*<o0
X[m~
-M5 9m
2gn?
P"8 }
&`;m
~!69}ur
K$o&ib
sUvyD+&V'I+\zOZ]Q*QJnZOv+
<u:O
HrUz
*Q``
QQ:Lgo
o8W9
< zD
r3] e|
8"|6qEOB~IFIRq"auM`Gvfwd"
R+t-
XG&Q
-myk
;6D
Z1M(
Exception
Fo#;
ti]F
k07<p
>T@R
ao|Ny )
8zy'
!bSy
U,Dec
E$Np~s
U`f/
]Q,-]
k>g1Z
5\0K
OH6*
eK^s,~E
r+u*
A*f:
NPyS
}& 4y
_>HR
`;Pq
GetTypeFromHandle
IAsyncResult
{bNX
kw\@
R NP
L.D> {;%
lm~
P.x
/0@n
#6Ow
Z6=:
W5}#
QJ\(fQ2tpO
QBr%kc
"& 1\=a
>+BC
{sRu
~cCG
GetDelegateForFunctionPointer
%ysf_jAo
va3
~s}cJr
kbo2
FcsEHV
lFu;
$,_PGW
xCg_
hdJ4
br:\G@
H7x|B
37U2/F_&Ks (d|x56rrfvXrJ,
]4>q
cvJp
jo"E
y5"_
t!r?
yknS{
#g dONT[iK +QQ3-B:4'ON"X#
h. T
5 &_
yg-j
tkr
h22wCk
klr^
| uhNZ
B42
/1 4
8:`5*
V:*^C
kmg
$I_Hrz
}r@z
R#0?
System.Runtime.Serialization
m &%
Dm*Mv
5RV
~uxi<j;DHuuVT1)%- ]'ERY8!
} hN
*p '<c
i;Yk
E<T?zi+c
#2rYV
rU8j
Q+|Yc'M3_A[6O2Nw7rh1R{JO"
8uY JsxK
/JK(
+'bpr
4 L%
lCLl
JU6hABL_Iam**>"!ew<xk+`;!
y qz
MKN&S
SW >
"a~d
]m4I
.z ^l
ft#:
) > N b
XK(.
{+qC1-=O'9;nkPU})6_Co#&s#
DOnJ
"2!^
System.Runtime.InteropServices
0Nx_!
?%q?
pdFC#Us
8f>j
:&su|U4Mf<p"&n1Y_:#C@u`C!
u8Cy]~
~ gsK
$}W)
@^*C
y<kA}
,r(@
I&fj
Math
dV:Z
[$ym
]36<<%3
TZ5
&x2@a
^hV-
o^ 1
%NM
/Q`7
jv36,lYt
Cw>z
23^#
_ +=[
fjMOc6$(I#aF0{>+Xss=A]&R&
2Q{v
n30al
iQkA
i~f`
c@Io
;XH#
Z.YW0?
vN$$
=?AL
/+q;
^ =dnBN
System.Runtime.CompilerServices
~TZ$
^yx
W@lu
SuppressIldasmAttribute

,hex
?Zf r
:{6<
_x|O
7 _0
_u}CF
{M&]ZQjJ
wMwD
$W8dH
[M"pB
d(fl=
bVrqP*
*LoW
p~ \!f
8`,'
%j7-
W2_"
<+BO
X$N]
Jk^O
&tx7
tt@"
@.{{q\
w8}+
bn.\F`
4 r
9poc
FCW,Z
hK]i
=mjL
=(S_
\y/kgYSo
};{t
K)bD
VA -
zIpcsR
^jSoK
R5O?
9!(/8-
8u+I
#?w`
aF>j2
('<Z
set_Font
F6 4
?AR @
iSO!IX%Oy^L}'BjiZ//1(T+7!
%N~V
F[8+
(L@~}ANFB(
w@^)
ai,h2
8~SV
}{WT2
~,'/
sjx4
q=m%
UAL(N
/d`3
!sO
%g0b
bcI
A5Mi
Bn}wcBX@jw*DdEvGi/v,mB=[#
VKx@Y
I~0
Vy5f
Yo|D
\O*D
k.nZ
5kZ05)
Z!'(65>/yPi$9zjSQ>K[22?<!
fsw_&t
2(t#'N
(#I1
iJ
|Y$6i
@u UA
N=%!QV(tZFyJyN}r-#|iw0Wp'
dU|B
ntC-hm
m+9u
T=GmCY+
Wt~J
-G-sT
0 P<_q
V[[|y
'fBBHIfZe:d0{{xl>]Td~YY%%
Wz7@
:UN8];}!3+
s9Rhk
f3"{MeX
AssemblyProductAttribute
9hw
OA%N
c&in
brPO
|6:lc
Fdo
!)H7
rDgKZ#
O#!S
i;i6
<Module>
g;K5]u(l~S(;Uk`tuX--N9P3
?f#A}
^3 qf8
twwM _q3
]S'%
;xco
WRoaL1
61vag
Y36;*
7Qw<R#""/D_?jGJXyW5~>+1?"
MulticastDelegate
+j_
]r D
y1t1j,R9]I!A~R-`V}mm$?WH#
,Zb9m
Z$eK
?z5{
S4s\
P!<GC4bMpMv:$ejw"tPY:E1h
i|%2
!m_pData
/$kS
pfPc6
value
%r';
E[:$
B@H_E
~3sPVn'>wvBY~MAr ,n:?-y-(
{Du 'k
W:4(
q/3R
(7cr
.@>X
$\gr=
3}
Dt2K
}r_v
2Iz5
rHDx"
>i~c
UN1h
7NV*E
)\?T
`x=T
J \h
SSC7
4pPV
OnMouseUp
+HVz
I K&Yk
>NIBo
l_o`
u?5Xo
4~Q?h
40ry
@z.(
quq
r(pI
dXH3PZZGJ
wO=x1+>$;b$|oH52abf%qeVl"
HDEO
h0X~
4R7h
FPB]
Ey<&'+!v {G<5TIw>(&[:sL$'
+MV}V
d-9U
`xKI
]bu<
->y:
un(eu ?
K\R7Em
N\E?
*8Ero
set_SizeMode
!T+x
}u26c
1')B
8UT7
ksvBQ8
[apx
A&,7
KHl
Fc.%R
a0Ht
H+]}
:`G&
*[ul
ADw9s
)q$^NRy6I^(i:?Fhr!08nFz!%
KEA+
bie%i
`B1r
<`b(
I{@S
Q,Drml
Ao ^
k\YH
T],b{%w? N2,C2|4kDd=j-C&"
TZ]J
)Sm>
&\b4o/
}voc9
}I{le
w.x3=
0 _f
AjeL
zAk?6
0U}G
X +U
4HP7 :
4l:H oXo-CSbJkzP`}p?JgJW!
(8==n
@g?%o
Nullable`1
R7'>v
e&QY
;1ek0CS>;*&Bo\8$]Q<CEUuK-
5UIe
69=1
\-F3Q
b7|Z
pY`A
WC$i-
}Rt-
aifU
H}/
get_HasValue
i#U2[[
DaXZ
~]6
Vs,?
ex#M?
ZayQ)
sS{d
ZohP
j3OB1hJ
GE4t
T0u2{
U`iW,
gqn{0G&-Y?=T38{:UN>D1-{S#
)>O^
~b?sY
: w5
)6A
3NeH[
Q60^
KaHF2
w6H0+*
c'#x
9"o4
P:ve
F)^}
m?l=
zdX!
sc'
I0\n
&gk8
Hdb%u17K>
IEnumerable`1
p3 =r
hx;3
PY):
+rLr
Imen~
bKGH
"3Vp
=Go4
get_Module
/e 8
TabAlignment
8bR6
1<p
B=j@j
]%6^b
[G*"
y@g)
se!K
q\(i
yY*S
gu^HW
"4C~&l
1*as
(eR!
g|-M
&+W}
vrKt$
V[ 6
t< GE
Q An<
Xj}w ]M70VTPM~cl(RW]C$7%%
bPHEJ
6Vf_
~R-@)
0MWF
mEz{
d?$~
X
uS 9
HC0U
ZGNkTmqh
K4U1
0yrLL
get_Size
Lh$U
I?{O8 |
FDC?%
?K.w
mjl]
X%#F
X6P`
Bt<+^
a@]8
l;`-
QU1"f
iA]~
$9skN
AD4v
>a>a
P"3/
Z!$'|
i)w)
&8R@ _rC~
qhv lf;
System.ComponentModel
8QxN
Ark.exe
^Gee
Pcwz
sI*p
PdsV
436534A617CD86B8557AEAA31D433ECFF38B112F
):(.
h^bs
:i|Yd c
=0gX
5\!e>x%@
IDAThCc``
!t8=
\&e0
y?*]`
?^4mg_fw
t89U
DisplayNameAttribute
EP=5
a[Tn
|^@9m
y[$z
2ABr
_KIA
SnLY
El_#n
_&-,
NR6o /
ozj|l2I'BJPBBn?:CC9~r%k_
w_3a
LK$ZT? ?ZAZ+B2fAfTCQs((y!
IZ3;
gG$~
M Bo
d{C/
E|)/
F20/*]tOFZ)s|lqsM3(nUzB3
?Ca
\>O)Gu
,{ ]
k0C~
x,&q
j0[6f
^EMy
@Z(;
h?65A
FS]9?
System.Collections.Generic
t1uk
b1:@
! fB3
#HZ x
KqB"
S ]P
5cA
Bi `
}zrS
$O8
[SN%%[
bS~
AcdYwKECT.F%@
|IDAThC
}?t1
3f:G<~PvO
System.Windows.Forms
!o\sQ*`GF{)oz#Ci9'RJ0 0E#
set_Cursor
:r]v
#?t\
R[yiG
Z|N0
^W-"[
{|'@(Xvae,Z!haz0(vuvW(8+"
"Tm#
{WrC
'JF9J-FM5q}"8x&_Cvtp)K}'#
_/3^@
lOZU
Wf,U
XiO
\$sj!
J8,6
WriteLine
WD5hM(
AZop
({eD
G!`h
System.Drawing.Bitmap
tQM]0
E3|A
oLfH
C,WL3!Kqv"[n%; Z4K-2Ufe"%
#j|=
3h=U6
]Aej%D
/j8nu
.;SNB
SetStyle
XF=p
-g#?
M>g6`
:.C9
ZZMH"
\C)x
7+SGFz
0]NC
*$#}
disposing
/$9S;
Z%#i
l%Bf
!R>f PP
K(F>f
;Eb4
q G%
OR6
PX\;
Gz8<~VI,t&^hjRpkC%"O%4\E%
Kxd@
n>j_
zH3Lyn\Z=F45%zR KEZu+E`~#
I(0%
Cl^ll9``3Ebd`)p@+w\&9+wW#
.cH \
L1TZ
rEZp_{r
B7 <
LUP/
Zy,:
(xjjX-e2u6wLc'\XY@n+y2Aw%
2|)nl
K?r@h-
U Nm
)E O
&)\+^G
jK+i
-07F
x>K9
f_q
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven02b_64 Seven02b_64 VirtualBox 2018-02-16 18:37:07 2018-02-16 18:39:59 172

8 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven02b_64 Seven02b_64 VirtualBox 2018-02-16 18:37:07 2018-02-16 18:39:59 172

10 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\evo.exe.config
C:\Users\Seven01\AppData\Local\Temp\evo.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\evo.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Users\Seven01\AppData\Local\Temp\evo.config
C:\Users\Seven01\AppData\Local\Temp\evo.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\Globalization\it-it.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.INI
C:\Users\Seven01\AppData\Local\Temp\9b479c23-a649-4d87-bc09-74275c843d8e.dll
C:\Users\Seven01\AppData\Local\Temp\9b479c23-a649-4d87-bc09-74275c843d8e\9b479c23-a649-4d87-bc09-74275c843d8e.dll
C:\Users\Seven01\AppData\Local\Temp\9b479c23-a649-4d87-bc09-74275c843d8e.exe
C:\Users\Seven01\AppData\Local\Temp\9b479c23-a649-4d87-bc09-74275c843d8e\9b479c23-a649-4d87-bc09-74275c843d8e.exe
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.INI
C:\Users\Seven01\AppData\Local\Temp\evo.exe:Zone.Identifier
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources\Ark.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Local\Temp\shell32.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe
\??\MountPointManager
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2524.13250140
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2524.13250140
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2524.13250187
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe.Local\
C:\Users\Seven01\AppData\Roaming
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows
C:\Users\Seven01\AppData\Roaming\Microsoft
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.INI
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\847411df-6fcc-43b0-8e0c-93e856298422.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\847411df-6fcc-43b0-8e0c-93e856298422\847411df-6fcc-43b0-8e0c-93e856298422.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\847411df-6fcc-43b0-8e0c-93e856298422.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\847411df-6fcc-43b0-8e0c-93e856298422\847411df-6fcc-43b0-8e0c-93e856298422.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\shell32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2820.13254468
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2820.13254468
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2820.13254468

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\evo.exe.config
C:\Users\Seven01\AppData\Local\Temp\evo.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe

Write Files

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe

Delete Files

C:\Users\Seven01\AppData\Local\Temp\evo.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2524.13250140
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2524.13250140
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2524.13250187
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe:Zone.Identifier
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2820.13254468
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2820.13254468
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2820.13254468

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\evo.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3035fc5a\375c7a1a
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|evo.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|evo.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|evo.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.ServiceProcess__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration.Install__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.5.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\337da671\3850e7bd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\337da671\1b71387b
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Namespaces
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msbuild
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msbuild.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|msbuild.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|msbuild.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|msbuild.exe

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msbuild
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Write Keys

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msbuild

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
kernel32.dll.QueryActCtxW
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
kernel32.dll.GetFullPathNameW
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.GetUserDefaultUILanguage
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.VirtualProtect
kernel32.dll.GlobalMemoryStatusEx
ole32.dll.CoCreateGuid
kernel32.dll.GetStdHandle
kernel32.dll.CloseHandle
kernel32.dll.DeleteFileW
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
kernel32.dll.GetCurrentProcess
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
kernel32.dll.WerRegisterMemoryBlock
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipGetImageEncodersSize
kernel32.dll.LocalAlloc
gdiplus.dll.GdipGetImageEncoders
kernel32.dll.RtlMoveMemory
kernel32.dll.LocalFree
gdiplus.dll.GdipSaveImageToStream
oleaut32.dll.#8
oleaut32.dll.#9
oleaut32.dll.#10
gdiplus.dll.GdipCreateBitmapFromStream
gdiplus.dll.GdipBitmapLockBits
gdiplus.dll.GdipBitmapUnlockBits
kernel32.dll.SwitchToThread
gdiplus.dll.GdipDisposeImage
shfolder.dll.SHGetFolderPathW
kernel32.dll.CopyFileW
shell32.dll.ShellExecuteEx
shell32.dll.ShellExecuteExW
setupapi.dll.CM_Get_Device_Interface_List_Size_ExW
setupapi.dll.CM_Get_Device_Interface_List_ExW
comctl32.dll.#386
ole32.dll.CoUninitialize
ole32.dll.CoRevokeInitializeSpy
comctl32.dll.#388
oleaut32.dll.#500
advapi32.dll.RegSetValueExW
kernel32.dll.DeleteAtom
comctl32.dll.#321
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
advapi32.dll.EventUnregister
kernel32.dll.GetProcAddress
kernel32.dll.CreateProcessW
ntdll.dll.NtAlertResumeThread
ntdll.dll.NtGetContextThread
ntdll.dll.NtReadVirtualMemory
ntdll.dll.NtSetContextThread
ntdll.dll.NtWriteVirtualMemory
kernel32.dll.VirtualAllocEx
kernel32.dll.VirtualFreeEx
kernel32.dll.VirtualProtectEx
kernel32.dll.Wow64GetThreadContext
kernel32.dll.Wow64SetThreadContext
ntdll.dll.ZwUnmapViewOfSection

Execute Commands

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe 
"C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe"

Started Services

Nothing to display

Created Services

Nothing to display