MalScore
100/100

som.exe

Is DLL Packer Anti Debug Anti VM Signed XOR Related 2476
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 511.00 KB (523264 bytes)
Compile time: 2017-05-09 03:07:03
MD5: 312c628d449048cfe6d7779abcc45c86
SHA1: 12c9943293cfb290b7ccaa09d05c1a478f136c9f
SHA256: 671335a7af0295c26a243181c0030e8d9c335fe64da3f1435cc9981780aae167
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 5 h):{< ; .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-02-16 18:40:55
Last submission: 2018-02-16 18:40:55
Filename detected: - som.exe (1)
URL file hosting
hXXp://prosciuttiamo.it/ice/som.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
No report available
PE Sections 4 suspicious
Name VAddress VSize Size MD5 SHA1
h):{< ; 0x2000 0xd9ec 55808 9a2d8161e74ebeea0f46ae69f203101d 4a55e326a87cfea7c38efea8783125a74ca337cd
.text 0x10000 0x3dce8 253440 2a53e2d8f68a1b9f5bc7f001d26d9bd5 bbb7964e07dae5a7af7610db0b6fed1c7e42b0a1
.rsrc 0x4e000 0x33a18 211968 ac622f47d7375cd7cb655f9494694f5d 33006e99ca8d7aa2da434fbf925aa7b6bcc47dcf
.reloc 0x82000 0xc 512 4e4a67c1ffad72c688ad19cfcdc4fd13 d14eeb3fb7574ba336983085b070684b350f4b1d
0x84000 0x10 512 da8c3884b98792b6bef8967fcff539d0 68e0303f596b209249acb6097527889af6738d8b
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x4e130 209740 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x8147c 20 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_VERSION 0x81490 920 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_MANIFEST 0x81828 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: Copyright \xa9 2018 Northeast Utilities System
Assembly Version: 0.0.0.0
InternalName: som.exe
FileVersion: 14.2.22.1
CompanyName: Northeast Utilities System
Comments: idebuqos
ProductName: LightCycler\xae Master Mixes
ProductVersion: 14.2.22.1
FileDescription: LightCycler\xae Master Mixes
Translation: 0x0000 0x04b0
OriginalFilename: som.exe
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
No packers found for this file
File found
FIle type: Library
KERNEL32.dll
mscoree.dll
IP Found
14.2.22.1
URL(s)
No URL found
6f6ae05b-ffd2-0b4
6f6ae05b-ffd2-0b5
6f6ae05b-ffd2-0b6
6f6ae05b-ffd2-0b7
6f6ae05b-ffd2-0b0
6f6ae05b-ffd2-0b1
6f6ae05b-ffd2-0b2
6f6ae05b-ffd2-0b3
14.2.22.1
VarFileInfo
6f6ae05b-ffd2-0b8
6f6ae05b-ffd2-0b9
Comments
Northeast Utilities System
6f6ae05b-ffd2-0b18
6f6ae05b-ffd2-0b19
6f6ae05b-ffd2-0b16
6f6ae05b-ffd2-0b17
6f6ae05b-ffd2-0b14
6f6ae05b-ffd2-0b15
6f6ae05b-ffd2-0b12
6f6ae05b-ffd2-0b13
6f6ae05b-ffd2-0b10
6f6ae05b-ffd2-0b11
6f6ae05b-ffd2-0b27
6f6ae05b-ffd2-0b26
6f6ae05b-ffd2-0b25
6f6ae05b-ffd2-0b24
6f6ae05b-ffd2-0b23
6f6ae05b-ffd2-0b22
6f6ae05b-ffd2-0b21
6f6ae05b-ffd2-0b20
Assembly Version
Copyright
6f6ae05b-ffd2-0b29
6f6ae05b-ffd2-0b28
Master Mixes
StringFileInfo
Translation
LegalCopyright
idebuqos
FileVersion
%q^
VS_VERSION_INFO
InternalName
6f6ae05b-ffd2-0b41
6f6ae05b-ffd2-0b40
6f6ae05b-ffd2-0b43
6f6ae05b-ffd2-0b42
6f6ae05b-ffd2-0b45
6f6ae05b-ffd2-0b44
som.exe
FileDescription
799cac92-55ff-8a
,+.-0/3242526272
0.0.0.0
OriginalFilename
6f6ae05b-ffd2-0b30
6f6ae05b-ffd2-0b31
6f6ae05b-ffd2-0b32
6f6ae05b-ffd2-0b33
6f6ae05b-ffd2-0b34
6f6ae05b-ffd2-0b35
6f6ae05b-ffd2-0b36
6f6ae05b-ffd2-0b37
6f6ae05b-ffd2-0b38
6f6ae05b-ffd2-0b39
CompanyName
000004b0
ProductName
LightCycler
2018 Northeast Utilities System
ProductVersion
Dt?
f*\nO
yW#rCH>3qw]E<Py \6#phFIS%
M=+l
DIw4
KrD:
P~I@Gy
8D!L
H | %q
bhGL
ut 3
d)1)+
KM`v
t0MZ
YH5;WqQ\sL44,gN\i lHlV q$
kx!6VJ9"SfCJ{Y3f|[VJS1S>!
a UaOQ
uwd8
3 G T ] l w
}t~&c
IV!{M
P%\Y
80Og
7O2M
BbE_E/SDm?prfcftH,ft1Qt|
@(n%
@;>J
-ze
D4QNapQU9O?s5,t|`mr;2%R
)Qj5
<7Lt
yj84
9yT`
ju`
qGc/
~ nc
G5NI
GB5nXh
kfJM
u5KGUw=CwiH9icGveQc~9SP1
ResolveEventHandler
t-U)
get_Height
M;9Q
*eh|
e: !
H,&<
"jp/
*S`i
#W M)
DT%]
f]tN
xtd=?=?q'SZ'cb(|/@'#x~>o$
8@KD&7k]YTk"k'Xk/PvQva(Z"
v4z
ibywK
Jmj3
~KpMF
E]5rX
DbJW
!S '
7o N
>zeR
LmQ`
0rwO
8D?7
:bImG
N{O8
8dFFo
_%gb
.Pvb
Ki,W
\{#Qw$t[5Czfkew&ew4MUmYC
rp~Wy{K/!O-gE;9N0U!'*\&9"
i5m$6'![<lM6"eL6@'eDK?`7&
,Hv(
dH O
NG
UT}o
X (+
:B:X
h?Bpk
)gJ
] DY
@RgE
set_EnabledCalc
\+H^i
^HL`Y
Rm+,:
1o7R
_~&V
K%Ck
E6rJ
Int32
RVk)
yO~!
9)_C
I =
4}/lTD,<Oz%`~9WxC,An=+XP
CI$x
nI# .F
C_QG
ControlStyles
J?WW
r e69
Marshal
~a9"
Zof+
KC^<
^s7,>
&?z6
D[P7?
,LkY{c
G^AuU
T6O13
/*6^
i'><=
Du^,
Qzp~
w"%e@g
U]fWXQ
op_Explicit
#%*&
$ $3\"
>RTw
QV 7F
System.Security
mjWd
}IDAThC
Qg'V
*@*xK
T*}C&
Afr
yN\G
ObjectHandle
#{j
Ay]C
NT.nW
[(uCk
`6
6@RU
at ,3RdC
f(Gt
AQBNN]5
ZXJX*V
ZXJX*J
DIIm
b -M
EndInvoke
8-1,,OxSxy%T>@"/A3cpa17B'
Z` ?
^fB
{7 /
$YXj
7wc.J
W38ME_
^&:Dp
\$Z:
)7eE
/6?Q
[Y&x
*Ej/Xi
a\'A
Y)nB%y!
ePv5
yMD^
T|Xo
ELX#s(q
Z~5'
K"mnUI1[<UiN+~N9|Pf'7&&9"
tXwh
n;lg
%fJR
'[T!
'Oj4zsX
u /m
Lcuf
]%m/y
#c4O
3q4Gw;L
wB[mW\
fX|)
Bm{X0
m`M]
I/Dw
LU}p
set_Alignment
lLDT
a]_
?OgNI^
AssemblyCompanyAttribute
>s<bZ
wdxTj%
rS`B
7gQO
w]w3b
K\H)
mF <
,LvE=
qS,W
A.%;
aA|RK
Q_Uh
`.A'
wd)7qKAuD_;a"#|TbNGa*{MM$
}6Pa
s$E[6JF
O(>
?(+I8v^)^HQ$GT;Vg$)}|,#2!
2*08
lK
=`E`W
f[Xq>
=7{wJ1:~jAA/"QG~@;8$8e:2!
.m'G
o0E[
hh{n
\}ZMPz
3hU
Enumerable
jo 7
jnY:x
`Dw=~
&vhh
Z nz
AppDomain
(m\SN%E
r*Nz
/0BI
U(6
{{lG
3rc!oF_0,AGvP g1E99HP)w<"
{zjy
=BC
Q;NqlF`V9yHc-*P~?ZPl;S/<!
z>s
p8Pz)z^i
JW{@
p=,
-xoX87
RhW
\O]I
0^KM%
~=K9
Wq^3
;:wt
B.URcf
gw7~7
J 5X
Di9jhO
V"GK
+M{N
9 u6Z
'K OE
>H_"&u)6pbvD qld&mYG/wQ7'
P>_Z,G\#4@tXf#SF^$plUEq[!
4-2e
FwJHRQH1[
[r.RV
5\'I
FzKU
Z #_{
n .H
1)IAm[
yJ;
yUpba
VC:l
;=@9/
5jrT
WT_Pd
[;suvNleQz~:U8X"a,Jc^;`+&
w]
<K s
AssemblyTrademarkAttribute
PqKa(
^IV1qV
^IEW
s.nVK
0@GP
]HP`p[
^oYa=E^N+`QjWK&nh7eJ"=_K"
9?;$
#m=1U
nr|>R6!s{AX%AV1~?$7bu3Si!
^ ehw_
=@8i
Fez/.
.|Gk
r%,vwiG`c3x=*!A%(C,6bPur!
wbi:
(?7'm
|i+}
Q/H>u
{Y[<53=6^Y#$y)7,%zip|VC<)
!=c>
"QLm
?PVV,L
*EZ 4
ah$,t
Sk0
#Blob
R,##
vb7Z
DEQBn^pGd3;FZHDY'mSJqN%m%
x`H4,
Ft f:5s wW
'P N
GetFunctionPointerForDelegate
9Qr{
dlpx
8H/{
vRQu
9"X=C(;P(s!w3Y5SG5K%iZmI&
G e:
!3c_B
vit
u1ax
Z3\W]O
u0N-:Ib4:w;&Jhf//Sxv+ 7E'
=YGX
]wv8
Ti6f'
Z_as
[8WJ0CCoA2e=Xg7W):1Dc8c%,
dKW1D
s65i
0IK;I9Jf+xidbYG,|]mr0AY3#
u @t
WsEy
XO F
TU_?
p6o^
=`sh
>7'V
&u?)
BindingFlags
&Abb
~SY9
Type
KSqL_
)&OQf
20yy
M?Au
}Y2^
DKwR
@5 1-
MAXs,
q} yX
-N64
[IG
N{8e
-v=
F .6C#
$BBJ
6<}_E 3X
c9pN
WoQ
PbQ=
9 f"m!
1w\E
]; q
//.~b
pEfY
pRz(
ca$j
^u%'
G7F/9
0jmU
gTf!n
87yJ
g)iP
a)_#
m7p"%
Vb-
C=)4pr
ZxZD
(flJ
t3Yb
Char
?C af
)S:w
h>%9g
QaCsdr
D\J
eZ=Y
^6\4OdeugaG>vIzd3Lr6@PDP%
q?O+
{MyL;
P?E<
Un^n=U
AUKl`
#vM5`H
I}3
R9;@
{0/g
P{
7MUI
2i"%cXw];z}Hjr, E6W-pi/,'
GetValue
+>Pj
SI!U3f
ZWb.n
3Nss
t7}-X
:"|B
->&_5
Q_T)yQO
{ Y:m
#^a
*qD
get_X
get_Y
c4)^"@FjZXZ'4_+M0[|yw%v?!
$iv?Q
Vs t
3P-L
yyvDAS[hDb]#T~Wix]CFv=v[!
.~@5T
Gs5~
5^<``
6\JgLI
P`]5
84ac
i|6"S
`!d@N
VirtualProtectEx
\gKL
^PGs1
get_FullyQualifiedName
= < < < < < < < < < < < < < < <
!HJ]n
)ZE4;am_,RZ=7W[n6n(I/3~"!
"^ _^w
?N6+
@sv3.
N}X28
*-
?3>/
CWq*Ov
-CErB!4u:bV,An$3,z3UbOZ4#
o5aB
:71XS
Y50/=bnE8 <H?lM}FXs@D;(Q"
GBq|
(:,DIU
ypZ
$j@[~
_oE$x
)8$$V<
+jfl<QHn1X!^~YngI_Z $f8V
n+R&
xvG>
Version
o Y 7
v=E5
`o70
PQG7i
)ogvX[J!@[>`Ktc2+LVl?fXR#
yYsJ@
>*,d
j\[5
E'iEn
O~<A
g(q}
AG,f
;l\${X
+qq`\3nDk6YjyFQ}#`Xx;zA3
K1D d
n _Z
qV*=
Zz5g
AlEG\
+|JVm
E_Rx
.text
Y#5|
TDxV
^yo5
GetString
_=wow=@f<Uwx$N_W+im0I^ /$
I\ux!&To>E=EM;3VL$P4v3pR'
Component
xi!=5
}~x]
_f.R*=M
5wGD>
rDBX
iN6+B
n;an
:p6"/n
ft3]|
$ksM!v/%
5l 3
kqK]
::l=
object
Y$ePNERD]<#"Y(`m3rj/^PZ]!
yP6N*NilO%ch?9XhrZEoJI+B
OxJc!
kX8>c
tm}Z
p!sP_
$Q@7
[ s2L6(
}4Ey
03dy
"@ r
oSLuA!Rt j$8v{f[IVVO1-w+#
tUn;
z 52P
h^*XN
yNpga`RZW&=r(f'I'2+l2JF?"
[>w
Y) .
UaWlJ
b+P["8
/YeqP4QG$nS/Quw1#;yeucG !
zj/
4FTD!
rX[ d
NQwk
f4p\
?jnz
eJOAGk
W!5O,$
Q%)1`(e:c6x0DIY_^p9AEp" "
Pf:k
mZl|
`&f
= } M/C
K~dY
J/2T5
AaZf
j_+K
1aG3#7
DV9;
$kFf
7{3z:
d*Q.
ipe,
eW7xO
y,/L
:r~es
l3LT`
r+q{
l)wq<5
qCF<
T2a ^~%
j^GE
^^f_j
2V^p
jjpb
5Y<m-d1zv2IVv%$xt(9T]eJ{"
D26zl
M'^1
e%zfQ
RuntimeTypeHandle
(#3n
_9er3
N9O)
1. %/
V^#)6
N+]pbUe-pPH4l
Control
'/|H
~thUY
1_xN
xJ\7k
l)>B
+ZN<
`.rsrc
*w?9egUxMu-$S`Or%A($Ku3>#
1#{}
Gg'g
+Nml
1^Y-
#{dG
" )t
El.0S
1J>
G"Id
Yc8:
get_Default
xddM
F#(x
TYpI
_]O8
kernel32.dll
[+kX
result
XV|o5KUY&lIuxZB#//DGq=x\!
/%D1'd
zO:t(f
;zjG
f:<N
o$5(r
J}dS#3@KUhZ^Td;/P)dhu,]>"
hK_]D
{@eW
/T/
0cK
?M$]3
|glC
Ge l
}(b&
n s4gg
}]*s
p8&Z@
U'{P
c?~9
|5&")
x?RL
"kV0"
"CFQ+ NpX>sF9~4#;ar>!W|[#
8,c[
?1U5_U
tjDc
T[;W
JOw48
`[h
Vi&Z*n
`]m N<)L0)! E73%IJ*5%@lM?
72]d\7xbdf;@bORPBPdVK6K<$
bXxc
I1PH(
XGIM
(^mp
:8c
:% l
qx9r$L?axq"-L\y$j#O&w,v;2
Nax@K
pU)F
QQD[t>BhYW-x*;yH0f%%UQ<z(
?UV6
<1AA(I
c0mb@
Xnmp4
w:3
@W '
]yc1*#
r\?]
}/B[q
FE9M
tsGe
7!)b vt
/BB@g
`A] d' \
/9a{
8Oge
NvXy
)O{&Lt
QY8sZM-
(eeMw+D;,Jf*G!5<_K@u8=X %
Pm6
i[3%
N~nthV
D$Z
$zo^
"6 +
>b[8
42^!r
*C {z
?^ax
M,4Z[
U_V;
fi-Qtd
i;a
@@@r
|vte
(KyQW;gO*
-o g}
O'CY
1WT2
GUaI$w
waic!
,!.`m
t?c^
yXQ=
+OOVb
,-Mj<bNprHR
t^jp
(
QnCh/
MT)M
4B(NV
-i(
ZdUe
wNp{_
sF-o
-k%B
uNQlJ
v&@,t
,j>7
F OtT
ARkS,Pa|<M0WK#MmQ+Xkj+vv(
KU I
/$%h
Mupn
&9V)X
: S!
/_$'
RLf\
XJX*V
_a=<
h~\B
1A~?z
07hd
>aPI
Write
?Pkl0,,QeD*h5|%0<eC@RlPO
{&H0
OnMouseMove
M]Do
)Fed
V`C|N|TM
Z;x>ag
Z|WoH)
Z{(PF
>o%?
:YTF!
m LT
get_Assembly
;R1e
WJ/n
ej;u
NXWhu>}$&
^<t$
P:1z
7E2
w@rZ
YWQBY
&O|3M
t$cY][
b;8
L:IR@
R9cTI
T"DV
JC~6
V<t%
rf->
I_=Y
I'Llydy
#O=9
"0w%R
.;R}0o
6|`$
_Fo)
.?d
p%Dh>e
IM74!
ui&Ju
$w=e
jGiJ
~W3
DA-2
System.IO
FnD~d
WrapNonExceptionThrows
U0G8
TQ5!
Wf;/!;Gk5@b8[RpQDq0ok,0'$
5"?jnAM^`WXI+4nxY lK)kXo
&gv'
b V{,}
>&Rl
7=d~PJr*/` m?7Oq`RQ85zo8#
M/9
0.,l|1y?I
BfV5_P6dzW5[+v#N2|tW;?L8!
OrmA
:0zpj
aAUo
Console
^Hl6h
L"xq
!kG
:='q
A3y'
u}BpN
xK@B
e5k>
XOl
Lo:TM Y;
v?1*
V4D)
jA6E
E5qx
K_.[
B_O
3p2t
IObjectHandle
3MJfJ4(bIfo`G/X5HBe^N(^#-
f,|
b#/46/
*;r
hbV<gZtfn$*DUs9]OD=,q#!O
<Z=2X^f
{5 l
[irH
=DkQ
:}2%Uir1
97}8
F84P
*0Rg
;|WX
2N+`
kq9!E
aChPCG
IHDR
Szod
YC9s
Gq .
i4 5
#!{5
=*M I
7P?r)
jWj(F_
mU~A
C8UI
5yw=3
?@`c
W006
'|>C
r# Pk
CH*IP's$OF\@E9Pv1h*"G848!
~| c
"3U)
9EQ8\'saRE2ylMr},U7zE,Gh#
2g>+6
!9>s$0~vuI9jZp$[&3xF0bF8#
f$.:
~E Q 6
d/6u6
z?M6|K
}><
"-!~x
WX~Dq
"x{-
5vZl
A,_ @V
System
EventArgs
&3_RE
T C`
% Qf
R;\_X
)=ic7
Pdx=l!
.${
WngBK
kL3AA;l
tr+~FM'W,6g_8)?=*D#@w?o-+
L{a-7Q
THS
)vV0
.Q)@
y@7bu
G28!#$
SY$-
Htat?Ui
aKl
kGI#
Qthz
{e|j1x"=O[01&FhKl<|Lvz$\$
] }3
OmU;
62<I
?bR4M
,vR|#
*d~.y
$(oe
W"wM6Z
CreateInstance
/:_kr#&)Djh+ze0$YlZE1&oX&
M<S-
^gFF
}ylj>
i~F
f\Dy
P1t{8
po[}b1
!n @9|V
' //
MethodBase
#Strings
o|J$
d2}U
='Ivjmo
K*N.
1Rtf=2
{c75M
ZXM(!
?XBn
.V%*k
yqjG
,o,
lUH]
]aw~$
{|8J
4 hFEhii
YHopY.
\ rj
:X gx]2
7kfRY
t nS
rDhh
+^7y
V>%!E\v5)Z%{%^vKB)M<)F~U*
P? R:
vo/3g{y g!F14G7->Z89_4=c$
%7D{rBb
G 8k
}?mvbFY:t;|Mu0usZ#v*#'*3&
Environment
get_EnabledCalc
k>NrG
pw4S
\_^'^
3={V
VirtualProtect
!cW4_;
p c
G sU
:S0s
^!HK
Va{^'/F^
"})
+7P:
CJoR
nvg:f
t"g#
BKO+
#+_{
_gbi
VYSJX
get_EntryPoint
uw;G
GAe:
;Coo
P,`6hd
"~U
\xP|
ZoGIo
Syc3
A /YR
A.W
] %,OE
;\+
h}O&
qB,W
_9pP
!MYy=
$1HJ
z~|*
9(JX
=G>I=/t]a\C1mL)5&~!8k1FH$
,pVe@X>n7wF&
C*=d
At\0.
g Vl
8EE"
wjyt,;9vDUBL-g>'6"pkR%$x(
nfKk'{
K*1O
"A3s
AY3eU
IE KS
[)1{qD*?l:IS@,!NOC;|zA)@&
'Ojb
GetType
fZ*_
kve+
b%P'q
MSNA
yF&./
add_AssemblyResolve
zJY#
px=w
IDAThC
C#P>g
trFk^
E5Rp
L9G5
"e +s+&
Soq
,Y`g
k;$ A
g3t~
~]{g
\gMs
H+;u;~Qj6ui1LB:mGBT]#&SN$
(xj
Nf#^
M
set_OverIndex
{edYo<7UE?*Z#0X[QvtYH-f1-
PJ)+i
*nUs
[=t
>rci
< qoezb[
9$ d"j
v`Q3whA4
_)j}
7(ptBMHx!z27%pd'a9ElM~lz
&pD"
fpn`
{\`[
pgo1
Stpm
H^VX@%$yq7Nvk-muo*ySt*"q#
dv3Bi
#8`@Z
y1$iu
pf\H
]',G
TabControl
6^g=
7r@H
>E05
fmq,8
,4w[VT
si?C
7WIH
=^{]_
vT5J
w~-V1
6z"
Gkb5
S#*
$ njg
6.:y`G
6;|[
}<Aw`
,59*%Z
YTAs
nZi;y
T4(3
Dqk
Color
' a:n{CF"QcC\mU$L'lAXu]5$
`Y)MT
Intern
(;1Z/~
5e&8?.
#)eGS1
6^g
/K&a
ysPK
//N?,F}H#r$i0'Lum0V@OsuL#
O^[`"}uFgN@eR?%J;8+%m}b+"
{s[{@
set_BackColor
`Ars
T@s}
p/]Xj
]?O
r(Mk
S'|c!
-%-t
"]M=
get_UTF8
[[3W
4U9\<
get_Width
j4ho
9xw0
~'x2csN{hBw5_h9X7hI+[&b,"
l]6$
~70Cf
fYQ\
ZX {`
@5)
}|L,
F B
O[42
get_Revision
2l43
>SE|l
6Lw3
OZ)a
6$3e
ug_o3|1
m(X
23:[*=y0ac& C,j-QZcumvj4,
.5m+ p
a>YM
uTaJ
D>a7
H_{j
;EL'HmsU
h7]O
w00t
pBun@11zF3Md0<2m{#!,OBY'*
uh-|
]E=+|_
v$?$
cCK_`
Rk\C
p/9d
t2zdD,
HR!k
@GC
~{ ]
Y6vq
|P^ P
cHxYe
B^);q
UP3b
~&jdGn
ZE1tI
xUs
A{F
>`@?
#u\iRN
6ms8No
rC~?c
O5po
17O{
216q;P`VlN9^\/oDeQ<Z*J;p#
8<S
:f8:
K6AW
YI/DI,u
MMw3'wb
Rx:=CL
>(=nO
78S19mRww[IP`c(ZTEsIm5aw#
Wa/B<?
7_y/s
)Nt7
8#!w
)Q"S
<PhTip
!z&;
System.Core
U5 3a
Ky1T
{$%\
P5F|HO
I*}-~c~
"J98
Yu4<xi
72.J
hjtI
GW{4
I.88
=)9c
z7+qd
}Iml+
lb8Qu;-QG|
\N.3
=(YP
KQ4
K~6y7
q{4
)S`>y
,K1u
Ajz
a' '
@"PjYB`
}1zY
dHwH
$n @#>
iFb?
bes\aO
Gc;>
=IaQw
WuQcv
`FAi
~[I*L
I`O#:*,e
9`{7?n
=%9ks@ZC6j(=qLQ8`hyW|U~u0
X +4(+
vY1D
_GQ^v:
z hc
O9SJvj
~:n
*0ivXd
eHc
4 n5Z
)kAX
\d^fq
%lX
6;ABN\
PdDq
ModuleHandle
NrP(Z={V
0aw1
3CU
Ww*j
g;H0iz{H;>
!*:>b
y+<C
XVQ`
Ds5s
gio
{IDAThC
~:@[
: bo
B>WL
Oq'd
b\ Q
S Ed
j|'>X
6%MNePu<h%0r\%6ryg0{|NUI
p QO
8%KF
U^8nA>!
DPVJ
cH!H
E,19!
13`hj|
-L w
IGeY
1J]52
zm$`
$Ol1t[u/
Q4L-
t{-.3r
ZqLF.nuw
set_DoubleBuffered
|a N;
8g=
pS'/
sUs:
3@1L
%F\Y
l+ Kw
Q,(0
p&$Ce=lTcX%q5d`hLt{Y6*+x'
CG&C"
(=^Y
2zA$
&P.tq
}EQ$
=1a+
Ew\`
X=70WU
f~=0
1$50n
oaje
2Lh';M
<TvKVEkc6`#FmJiWr9>`S$5M"
Contains
U_I}e~X
lGt
v|Z[F
;^aPj
~J@`
zT>!
I[jl
IEvidenceFactory
]Xl;)
"{21
"\ 6
6 RQ'8
V4X.Z
46Anb6
bgwz
%%)D
X"jL
@@Bj
4FT#
ValueType
d&Ri
)py+U_
th'Zx5E,LFG%E"WB)t3CgScx"
Y`zg
GuidAttribute
&'|G>I
>@J'EW&uKO|8j7~dM}:lmp(4'
?5M_,
]= 01Mq
LH@W
RlN9
\oiV]
R 7G
7'Je
>t@<
0mE)o}Pkg<8=%j_*X*R>x:1@%
Ds'
[ l e
zvm|
/I79
"+<!0L!
~hRDp
p"[ikR 2
sgxiZ
m ,q
V#:Z
%}n~
get_Count
Q+l~$
(#kv
'B_
9h !
knT]:
Pe:n
@3&;1
5LW~3w
?iM^ n
System.Runtime.Remoting
s?inO#
a,.8
)g=H
15|_
Y5xW
sX-q
oon Y
mb1UP9h,al8$ccPD<#*]ds]I%
9dUy
*@ W
odBn
b%#O?1[
IEquatable`1
c8f<
GetField
=tLAC&-bI0q[Y6h+spX>J0og
*y0d
l[;X
{ahY2\
8o+U}L
-=s9+JqPB_R!Fp>k[COca:$D
SuppressIldasmAttribute
"GC;
}`Y`
.e"k
)zUqI"R)?ZfG|s=Su%&o7+#s
reCo
;CH8
5gFi
iq\i
U>Uh
O-s2
.O)t)G
A<@\iJsZ61y0\Z%hbU<"uTt %
$hi_
x0jYi$
@M3c
$ )g
CSe1
UInt32
R7R
epGiEuW
b3}3cs
6l#Y
+6?
l=qC
get_Version
5d8T
W* Wu
~@8
Z^P+
":aJ
&OsZ
ToString
q&~$
A1m(`DwNbQf/j6]bLMWf{` n'
;%_v
fTRz
wliJ5
*Fk(@
)uq|
{Q>4
%A30 Id
`^d2
_*9Ah
wanK,
p]{U
V(H5
CDfs
<n
X
n pz
z9 *UgZ6#
:pj
UTSqB="L=y]Q-'(h}B(1by*o#
9YUCd
q;x{
AVnD_ n
FQ]x
N7,'E
b "u
#l{]
OG&K
02R@ul
#.{PWG
7m#~
_6IP
"rIJ
/>^o
ServiceBase
g(Obi
hE%U
N)y8
52#~
uFrx
*vN Er
g1oK
A]BAkH{z5}HOm6Z>e*Z,bN_!&
7R/F
<bL>WM>
8>\YeW`NPCM@9]YXo2uqRUFn
?n_V
i}J+
5r4>
(bU1
GetTabRect
c@[|7
:8Z{{
\sFu
v]o<2
;ZJ!h
r.=d~
=.bG
h"ZvA#
=Q-K}
4G7
*Ay6
I=zi
>9 K
Z62!I
3ow:
i`n*K
V$y)
W]6/
~%<Z;
wz]}
My#6
rLP/Ld
F7>Oj
fgH~
Bs$U
+Xp#Q
A$rj
?nQ3k<
j?/%
rbHhP
I Ssmm
#l4<O
9_@R'
Ev FF9_
"7$t
~ 6Iy
}.6[
5gH^
5$?0R
b^`7~-F'r^p1@^Zz2b,j^/g:%
UDnY
5nnq
jG_[
xV*0
qXC
m4lu|
<CmT
;oXub[3o'+;[$)[j3>ub{3N^
x<Qgk
Tb=8>0
YWH
-wH.]S
_$|[
/AdX
EK0Q
<W$ g
p+S$
&PMm
R]?N
;u 9
>2$0XVtoZ-X7x$R#C$#%_:#Q+
Y0/l
A^XZ
+._i
Y3q5
get_CurrentDomain
Data
J=3
CjI6&$uQ/$+C+BB!cP<Zf&P`'
6i$i6
g0p{
|VR
kmJj
sT}O
) 1Ax"
Enabled
#SnI
ri=V o
<@UK
%_^
`#/d
t08Cvo$Y
nxF
JH,dZ
dLY=M}_4@wjUA'cO/Ypc$5a<!
> }:
TQNx
jJj)
DqacxCnFaK($1"f0kn[9DA(M$
\+G gj1X
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPADA
L{Gc
x !;
@V#H
pHYs
.ctor
[3K,7
E"\3@SYMG!z^*Szz%q!:<+d?
?q -w
3F4H
Rh<N
-c
3(Ok
~o @e3
get_SelectedIndex
8~8zj:
ox8Lu!JC7y"xNi^;]z}i)')@0
<8D&
get_Message
Container
Z`('
AJ c(3.1
=WDk
s~|
e7/;
WOa+ciU
A-Z6utg
uFDx
e~J>
@joNf
x*{f
O[a<
k_WG
Main
W8yr
~?.,u
cg!TE
O?5 i
-\F`
'F*"#
k+GJ
Invoke
K! B
e),~rBs<;929{Pe0uT6]h-}k
0.&{
|a 7
abc'
ZXJX*
')<
1kI_"K:$!/#GFP#8=wk?|&R #
- PfS
VA<rOjl
,t}sX
:key
y:m
%z"T
OvJ]
R,$)7egT7GQ/HAC\s$~zFz42!
-i657
Qj/
}j~
nk*=f
$^8KY90
XG)[
K"$*)2DA-Zs%2a\*+/OxIbb-
5m/3M(g
bOS*
by
bXyni
7Z)7
tt Rr
tVb.
vepK
8>J(t
BiXEr/[8u!S` {Wa@020+-,r%
?]J%=
mdVx.
f,vf
G?"w
_"HVw
(\DYL
JG<[,a_YW8s'`>pj"-_Wr,3G
Module
fcD
zr?u
;2_t
AJB:
ANjU
oLTdJT
lDsk*
Array
K&z5
b>K\ x3y)E@<04IMPZHG"n0{!
a<-T
Zv `J
j!:
4q4X&c
!OTzV
@.reloc
`Y} Q
liQV
s&_s
R4uO
W=[I
PqHF
&u53
p&(Qp
}Ts
j qj
]8EA
M4-
(&O pr?
r{ :
<lai5WK(dp
]h'>e>
H-%v
UX4lh^,njg80t!<*p4F]Z`Fp!
ei9t=
&n5U
H{F7|>q
7{-|
79\T
e<V;
9L1Jd
TabSizeMode
sR E
Byte
get_Chars
#,^WTi
R!c
CCOKNCR=Q7Juj72AD;`pa7G=%
H ?c/R
w4 k
80 =
RC42_
z&x-
,[a"
NNww
C8)%
(2xY?-
r/=HI
7tw<F
vc?@L
p]'V#,
k.g#
j9<$
~ }#
PH0\
1{vWQ
6/2\
o*({
]5*I
Nf-5
fU)w
DA7kA
4 Y
^+Wy
Ot#I
x *$
o!,&A=W
F_pz
|),
ZR33
,a=8Ux
TQMnQ
77CM
kuYL
l-(5
DSy
^_xr'
Mf29
?;.lB
m% F
9:%Q 8
<^/OqQ9o-#8J25:vwb|Q_gh?"
e\Z,Y@R}P$t?gB^\?}*~,4DH$
@5x0uq
sQaZfA
wLe< b
'>G'
U_f1
]YY_
PHS/
$n U
$9"
ayXf
*.p}`^!
DI2)|
gm_Mu
D<Vv
get_Location
`}c_
u|b`u;H`ftTV9Zn!CX*/2#A[#
\nP
EXhG3|)h/p3,278"VqLc+wEN!
18h90
F,1y+n$
SQUh1
6'"8
!b.:
e'}/E
iO$GI
uJ]`
LHZZ
cC#<O*
9t;~f
9]%5l
`:pr
!.#/
iwz&~
remT$#
-2/1t
1P2f
FreeHGlobal
q EL
u:Z?
?XQ%
ooPU<
@eKV{6|
mL1ls
pU~1
H1reX
rH=V+4b"B
^f`R
wefQh
F<\,B
'}4"
AH0RT
XP&Tk
j#J-
%i'm
4E2BE99140D24066CADC84F74FA899FEE5976B68
'2k
x8Nj
x~(E
JDrAo
Q7gx
h4&}
ekvk
QrH0~B
O f4x
gLN.
UiC
s*pzv#y\`z?Zs~J|'[a>7\&A&
FNXfl
vSt>
)i,_
RuntimeCompatibilityAttribute
J/H8m
k$iqoSty
:UNoA m{!Y<9!}eA#LYnFS<T!
$roM
KpqU
0VAd
+R(+
@(AP!9:l"d-^A7p$lXs5KR>z/
NIQ K
Assembly
paQ$
cNYhs
;2lG
ICloneable
yM%u O
!1g?
:K H}
[YdotBn,|Y@d5_/k5mK4A?2D&
Lmw9
[qxr
37x*Q
<4L#
N-(E
HYsR
yY =
_`]7
>m?pR
RZ!s64R"True)hn*=d:8Hl?P
(M8"
''x _
hQn!
o`_W
+iz!r
?{1p
kx/x9
Invalidate
1Qti
^[|F
_z_CLSd8/@&<&<Fe#dL#w5Y''
= E<
}6Q
+-^>
/jj+O6
4tqfXxO=?["<,i?0DMUBjquQ!
hMqEX
jWpzi
AS5u
Size
:@H\
oWir
rQU5hGGuPsd^%2m!}0"HZ:;D%
yc=b
NewGuid
x/H`+xHAk s]:}PR/%-k,R!(%
EE5
%[JW
Bs?6
_Ias*
set_AutoScaleMode
$I3r%U
2I X
]d6WqgW_
;~nR
%'Hr<Gu^:$ EJ0 #@>G&8tA)#
h=;&I
?C-%
*UO[3
_bk`
RGsN
k:c/%
f+*q_
C4{"Hz
~%Ge
n7-z
XjV!J8<#Wg9a@%yT7j=H!!|@,
f>-D*
(H?z
M&,<
JhnW
.?#H
V[`|
6SB4#]j=NZs^Jd9[-S7Gp}@7"
BlockCopy
|#7D
Oh*h
IContainer
ix a
VFR^X
"cCr
D6;u
3ECV
=x5(
y/EO
n"a,
b%Y dbSV
z62(
Z2{A
Y s_
niT4k
qh[V
x>1*n
` U+
>.{R
aqCl
sd)
x'l}
Q`:sT
GocI
RuntimeFieldHandle
xnA$
?K'5}T
qg >
75WJ?
hqWu
:TFwD}Xq
N^_t9
fW7!3
0u+F
06r3M
8<7w
@6Jo
>,O~
bOY}G7N
| }"
Aml-@
Z(1
{DMi
0=+j!Z
j4&E#
$3qfTSJz[ &TsTdBgusa`#k@#
^ FC
Jdm
!e"~
_YbYA/B&
Q9N\%8#Z; o$ L):"iT%WtoB
}$@(;
24 g~
v4rf
$nLLN;
Ml=X8EA
3:(1
(Q!}
-(Bp`XI
o`lX2{(
PILC|
s3s]
6XVm
;b5XD]
AssemblyTitleAttribute
)A2&
get_OverIndex
O'e#4
37j,
>mh
:T4@
sOTs
q0`S
a@osk
4ba[
|-b
F6f
WJ9+
(GbL
'-=M
\_,Z
+O>\
]* v[
3>;Gj'qd
h):{
`"l]
Z1sD
Dy P
-.*[
b3#LG:'mxuc:]V&HBs?Ik3wv#
~EoZ
"f)M
;;xe
~>Dh
\Ul`
SoY,
o2Vl8
w -{
pbrB
gb9PSP!N2w]-c:E}J5kX&_W*
OrV0^7R
|Y %_K
}$Ui{`r%//|wgK}EPBvm(iy:
T|ac
4Dvh
ContainerControl
A[|S
YI-+
OY1
t +V
J<n*B
'g^xd>
U5_y~
kYee5
EB 1l
41 $
ks+)
NZt4
F*Qr
A>O3
GHDsP<('4_z28#nx,}3 ;#T*%
=} \
09,kf
dB?l
7 pU
1Fq*4
}dAa:8]@>;-<QFc)>40sJKHc#
9066dc11-73bc-5e.Resources.resources
H{`m=G
) / `
X*;
^Jc%/
$W^
rf>\F
1TX
9$`g
>.NFs
0Xr=
3F1764884A245F1B3FA91DEC2E25339F23787561
Jg9;
F:8s
@ 57
E1IS
%f~Z
WPKJ
INHGoYb
{j'3
IComparable
,=n2
PjqSd>E'g^Q+kWqj\}kn;[<i&
RKPj
PM58
p)U|G
+>Rk
Yj:2:
I[H:k0
AllocHGlobal
B`f15
H]|6
E&tD
pg,
QJVB
AssemblyCopyrightAttribute
jhow
lBW\$
&Ic,2
C[|e
CRy\71\z
b?7}$j9bNi
SCV`uI
kg&
&D 3
eV3\{
wnrc&
${z4Vq
L}*Uu
*i`}
oGkN
Zk/k\@t}\'j+bD36d\]]R0{/
LU(/
Z= 3
|m`n
;h ?a#' Y
0}=wQn?CH80#ZwjEx*mK%^}d!
h#=H$"
\^AxC
g 3R
K1Y)A
/CR
{IMjQ+1,L)WirWaNN8]MBK$C$
7S6;d
=,; p"
{SGP
[eGa
Kxs#>%wyrz ZKBk;?>k :/A+
S~K
1t26S
#a u
;(6oN
ihuLx
ybr5g
ucSx
<3ND n
nO\2
V/Bz>$ZSo3Iu*@JM/ ,07iBs&
A b#
$EL/u^
]hMN
cd&Z
V/.
2v S
c4{:Y
7O {
m,{M
V:L@
4nzw5h
k1z+]0
hh _
d^;[i$Zwz|M?YHih4:*)j)tD)
".#Z
=Y{Mo
kk a
[FTSS
1&L*
[sG[
ControlEventArgs
jHl/
lbIq
m(6\M^
r+ y
^Zl0 pK
,e/ D
:FS9<
#ML6
G*PW
eFy^
wB5]
set_Enabled
>NnI
\'7U
GB?#
").m
6G^v
PU}S
rIe1j
a<dI
Read
OG_M
_]Vi(
C_1/
LDzI~
kt|n1
VE9thZry/L[^m&2bNz`jW&ac$
Q3\!
lIVe
CCm}QE(
mNX:
]n_!
?%RUn
@}}o
'? s
{ F
y X8<
.^RK
Z&Pu*MRT8q{ ^+a6vJo"J,\g!
'oEb
aE^J
get_Value
Dw#>
\j?D
7I"&
9.@x
rm d
t7Jp
&E4a
vQMo
s)NE
B,[VV-
+%.6q
j \Fm
!?}o~V.u
sOJcf](
,p3-
7,)b
N{yi
!sY J|?
gAMA
m?AQ
KGKG
w"L
2B ^
U ,Dw
aF";C<
B||s
vw;J
Jlj8+y
i1t}_ ><
A{oX
KBQ&
gkc!P
lj5u
AutoScaleMode
ZSqx
I6X
'6X/
zS&$
aTn/Jr
tl Mku
vl@'K
MarshalByRefObject
!S40
y'TM
fkIf>
{@BCI
)*o D
9>uD
:_.l
= [I
nDjt
%u|GR
.cctor
<?)pL
AsyncCallback
O~i(
niJG
1c?#a
Y<;q
mscorlib
iwf 68
0 bi
V6sAZq(f
[v1?
v$pZ
~u(0
Wo}XJ
(z'&#{Nl
v>y<
Yfqf
`!#e
~T5Y?{
j}S<
jx1e
*"KX7#Jm^@(*0~ ,|UIR:5oS1
S'x(
Cgx;F>:*dXlSAi<663AEJQ5O$
EGY
se5)4
f_Qf5
'(QW
u95F
LOOw
(8vk
cKw06pR>K!W&^b)9D*2+pikS"
X!<
b0f
get_TabPages
;<9;
X}S
~|cXO
O.$n
>AH)l
ZK0TN
:T>
@`Lx
hcgAA<k`/D @1Hu</(qx8-P`:
Guid
%4!,M
Xw=lu
/gq`f
Ol`
[|W(F
f=R&GfNnOXf%,+F&=PK,z 8R,
/&k R
0bHP
53nh
`;`;n
PEQ'v
Y<K~>Mk2%H dFu:$;]^gb'/D6
_F?h9
~>tZ7+
B (V
|kzo
BmQ%
@UjX
System.Reflection
43s82e_r1BY_aboj1'=@r!>3#
-j E
"nu 4
ZQ+5
-[x4
e]>GO
(?X 2
kA*{
HD>mx
TLjr@j|
8)x
/VM]
'q _
z^;6=?Slb19~t|00%^_f2B- !
~u?
L0 4
4o|"q
WWO
R8 s
G=78-
W|Qr
CP>A
<W*V"
Cursor
*i z@W
jv`(r,dp9_b[0CB|$m?v2{1:
sender
Qr$W
9 ;8
pM4D
0 #x
!(/ik
V 8|7
L/GX
Tg6p@V
k pM
_*,&WhV_qS8YnB12Im1J;be?!
t xg
'z J
&iS8
VSg
"X~R#
Ac(a
Append
\ nq'O
1dS&
-~ A
Object
w3]G]0|~l7M'(@EHrwDLp2>\#
\hc?!
{FyG
System.ServiceProcess
op_Equality
MzfG
<Ku3;
v:+\YG
O-;S2`I
tstp
WV'F?g
VoN@4
]zaZ8`
X?8t
]hgfU
&N|
_ 0~
("]"%
9RJ9
"T&!
:x@2]d;
5t=H
_ZkMas
Shr<
ifvZ
AssemblyDescriptionAttribute
mAm:
d=yN
{l
dm@G 9
D788[
[=?y
k0UQA
]%AO
j@[_*S
U;gGpT
V:M:
MS/~
~()
Z3+G
Jfic
, ZiD
.z8^
xL`D
%~J
t7H#
afX
7MRd
&q)I
!R%j,
[~CE
iFy:
>CY/
\d)I]
u% {#
|-rm
[V0h
lRa;
8"et
!isJ
)?HB
-e1(c
o(#b
v(mR
kI@#r-sQaF4l={b'{U,"e3u $
0"m
{n+ [
+OTg
:[J+"
RwtTKT
MPcH
wq<[
C#z)
(6r15
o4HWI1BIJO(B;b)AOu(S'8\}+
2Wicw
Eq!x8g
wxdt
oiY5Q
!;&:x
=Bz(~
I?WE
0/Q3
DsCMM>,8{2e&'A71/HN+5%(&!
ojSC
':PE
5M>z|?
);K#I
b(Z!(
SxrW
h1-F
F\!.
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
wb,Nq=
&0fCd
iLBUn
&w "z
K~2]
LgoM-
c'aA
hN U
]9n
u0pH'
_/Z@
TAjr
cE\6h ?4<mt3"T}GS[J|m&gK"
-_FJ
dZG0
I/. n
mscoree.dll
!This program cannot be run in DOS mode. $
Qkx:
jM[-
d&|pw
callback
5EUE*w
5)gM2
l"~^+
i 8
Kqh<M
^``R
^Ue!
J_d2
D5P2
Dispose
5H;&E
!Rmq
o-.%8
fHt
]BJ\?g
437*
4T z
Ul-/
8er
H^17
h `y
zn48
oc}X:}&5Pv}b^XNb3NE}vI$~!
Sn F
lyZL
kb B
D3xDKrEtw*<Cq>Q8y3bgq(7b#
Sb#U
5Ol=
'S|vL`
D!_#
/#Va
"RHbm
- 0 d
uPw?
._CyT
DQ]S
F]O[
6YBc9y
^'`^
=5y>
}W/6j
}C16
%fI0
cv3D6iRLQ~vdd'&DC"8tVU[K
M*S;~
Cb"h
R RN
vhaOM
f7jg
i;cc
! @,
\G6;
\Rz/
Q=GYK
X2 #
iv,s
pM~M
I]x#
}4VH~
LVoq
tbr (#
<R)r
=Ig;
!}KBLtU
[v0!
zIDAThC
mN-W
[{w
Ws{[
6 l@
u4c4&
918
%| f
rCjz
,aKj
_RZb
S7Qfpe(&Kc::O6W]&bv[u@Tb(
,H&M E
un./
q3Jp
eWFE
h-N"k3
6\am"<%oE-jV\rH33p#}i!~2+
XBP?9
^ z-
TUp0
fn/c
PG/
o2@7]
BSJB
>*Ol
o `T
K#5yh
1}5?%W<}]gN4:KqWO\FMdy4t
e92=
^L ~
.@1+[
! F
= Qu
Kz:M
H"@lM,EmC52NJCa5PC*eg1(;"
BL5q
vP.x
GvW{<
va xLIy
get_ModuleHandle
b&.H
%UQ2
^>BB
8/s;
l6{O
\J2
MT`uM
ffUl
( Q
Z,:.`H
1<|4k
^(\8Zw@Kqh+@D-<&R)AOzt{%!
qPj^X+zGUihU'CMKmb1-*Lw0$
6d G
IntPtr
dG <
l4.Q<
~JI0kDFqI_&$|c4yU:rqQ1OA%
wRY
0-y=HQ
OQ#2
czF
n} |
:UDb
L*>ah
)4-P<
ktC.&
System.Linq
l4Qmoij
}6# T]
&gpl
Iw7/9i
@:'9b
<C6t
!@ )
zSA*
Vx$W
ge%u
$/Gq
}$Sk
_gUfs
P;9Y
VQ; 6Wf"(Hh@6!|i;c5X~Kw+"
Ed
Q c
)#$Y
8T]%
r'Z o
H("L
n^I+
_i qMc
Ncddw#?84Ik9AjEl@~;pZ~K !
pD)\
A$iI~Qe
$E4T-xzVAf3Q6`Jw^0-s+{-)!
r oH
x -7
KY<%
Kk6
9v:p
C708234F139063BBE3CBE2208BB6ACFACBC50333
|`xKf
;Bll
InvalidOperationException
*F*6.
{2Yt
/%MY
Ltt
bR_L
tL77}6
8 }'
Y=]6
*/9J
dK;
#n$
e?G&5reg2PK+QeB/nO]ozd[X!
(.iFn
^5/~
f_ RX
ltuOr(y#I
5&^D
y-r2S
n&>
i!C3U
%?ZBc
vaj`
w>p%?
z6,6y
C ?
3S Eu
YK[-
N=;/C
3xV7QF
qR%WW
I_lZ67#e@UEIxy@t{%;Rek//"
oj3(Z)<,Lx#K>$7Z75UZEp4!#
mL3}&
bE y^
w].P
~$?X
%%w
Dh>{
s6X%mx
,Z#c
C&_?
zA]kfO{JS++-Y+Pd%q4][3N`%
<N~'2
}h<r
4e5H
gf:o
;O9:
W+xC'
$bXCaC
C<<si
pF0Lh
iT>;
m?HU
DXu7
"QZP
KN }
TSsL
c``qU87ni!e+3;0:NE^f&7'L,
aFtz
/saR
?1xy1]!kAphY]R8a/FN| _DO$
0P %?
z:VB
9"hKT4L
"}1s9QJ
u]%p&
ulLUUG
2L$1
z b
'{z |w&A*'e)guHZV|tY=?e!
/r}O
kl>#
0|svW
HL
UF 2
XF$/q)
.71ox=
k}C<
7 A
NyTz
%"|{pH<'@ 0Zy$03)tR#,{!]'
%Ll,
~#O`
?Bt3
hPX'Tu
"bTx
I.{9b
<%:6
W$<!
WlP|
yP,~
a4_6
4H i
L[8t
Psh2
a&
G y*
f=4xY
lX^M4
;'YpO
fmnV
p:,>
q3CA3
8<AR{
JciL
6eAk
y,KK
CdQcq
V>8!R
MethodInfo
3G3d
Hg6
Ix^A
$NJ!
"^bx
)(:(
\ o)2
A2m ,TW:c|0+>Z!Jy_>(Wf-w!
Y(tF
4xpw@
<Ct}C'{`7+U ZkLy0N@p\p>?%
CompilationRelaxationsAttribute
d; p
q+_=uA
W\J4
OMZuAB
m%d\
TabPageCollection
Vh7d
(ADr
~>0N
HCc2
`5{s{
MemoryStream
A9mD
#(!h
D y&
7[)
ajy0
ResolveEventArgs
TW#w
j^+3
C8I
bx$c
GbL!
3'{'
72" ~kA
-#j>
dNc7
s2Z`
dLis
0]U<
QTrO9
bkxn/
I07{gOv;8Fi>z{<<L1PqV#?>#
'5&v+K
e?.>\i
:[Q"a1 n/
{|_n
>Krd
HYQ
Bv?ze
Ml52de
kjx,Z
MM+ S
q?i+
cT^'
R"m4
-G"q"'
.n";
Y;AtF
*7$c
8;,&"?!hSBzZO#QR^#<v)hlz"
K[%{45
JLn,
CV/Qg(
'xm~
[+b
6f ,
=fp`
?MT{
k(<d
9 V
7b_"
nLJ7
IEND
E xY
6[P&h1J<cC<?CmG=239o!`&t!
tk&(
$cV0
*k^| U.N
GUzf
7kLx
<~I'
#<.
^'N=
2}(l
O2V[]1
Fcsc.&
d0q}
1o-g6T
$T$xJ
RV/uR
yCM38
1k0(
-E9 8
6S8.
/jde
$]zB
N[NN
39<iq,p`|YJR(l$=GrA~`8{F$
~1|
fK}|
[?e}ed
R3oQi
)N>U[]$
.!{.
?7(c
],ys6%
9IZ X {X\u[g aol#tn6g uy,
D w!
^K8n
BJ<C

;:9]
p3-\
Mutation
u]zQHb[
p<s}
C 9+Fy
Rectangle
AoMZ
p5w<
Gs=L
get_White
eyCn
M.Ze]
xqVzH#'U1?s%\6-q/kD)|lYB&
/-R
m\ Q
v'L9
Xjt<<7rR0HNc)M?;_>]~+gt("
kk: =
3*;[
'!@/o
Concat
{5y
MKf
Ki?
StringBuilder
#cRP*`p(d4FaE~u:jY[0i;D)!
9dZsQ1'QZQXKBH*W0XgvO~0=$
3 45
U|or
*f1X
V\n
w&tuU
jmd
<0FU
b:iT
^`Tt
#m0/
T@<48
o6~u' c
T~j'
yy4%,k
r_8\ ^
M7Y,,
+O|%W[)6%`9[V1tweX,ds*/R$
|ob-M-3
f8wB
{#cJ
#Sq
a=:rH%I
$KZ7
$Nfr
b QE'
P4bu
r^{~@)]1Qkh&@&sB+S9q~4-0!
+Kg\#tjt%6P'=GLmA+VD}4|)"
['0G)
5\{}]
get_Hand
''=b
uE SF
fma\
W_x*
^<&u
v`,t
Qh E
&!ugo
H.1.
r&P
G+Hv
xc .:Dlu
%#>R
(MgCVY
"fXc
lp/=&
/S}#Y
$:mg|U3SpqxY6^EuM8:FSL4z#
B/BO
!R5"T
f#;F
|[BN
U:No
BX[7s
" >s
0AH(
AC_C.
=_"9
DjrTO
J2fK
4[gq/
uk H
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
AssemblyFileVersionAttribute
ABRGJ
$l!b
8M3
System.Text
5.xtP
S !
:E,`
%g=?
.FTZ
liKv
|SvU
wY=E
Z7L~
^sr.+F
AN[-
ZW" a
^r#w
FJbtI*
BbRq
?[
^< f
Delegate
>oBE
U0D{k4
9ouV
RDq\$
aoL99
49z;
KBaJX
} ,[
HWo.
GetElementType
0;7m
lNq2\
;%Y^J~Fc>
D4m(2!'1THx 'F9%]AI+EQY`
wJw~8K2|
wN4L
^R!an
/E|9U
(+
(BVr
|?
G)E4
svIyd M
;E(Lh:rXga$`{k+;Y^HMU:Kx(
B98l
~ kB
iU(I
U*4U,|tof!)%DT!H:-R> K>)"
qRcy
&D93]G
5aj)
]R1M
|E7snk
z>5>
wEv1
MUBC=@R2-?!"U}!&I)5CjFZ%$
_aU/X
bkUi
u_fK
^dFI6
XVMB]
3/oh
k3W
(Z)a
i< @
~tzd7+
/a@ZNPfm6n}ca}}>PCxAW(9h(
8{nHaD
j_ V^
kTS/88
Ocj\
j\{7
f(|w
5J>e
> VYz
;m^~
FE$-I
JzOJ
yS0e
`\=x
zyt^M
IyK.O
HS.=Ac
V$|Yo(R`T{^q4X2G5unCS4 1"
FieldInfo
P[ G+
Font
69mc|5U~
@HBt
y9yB
tA4}
$eZQ
$;qt
=B',LYY|w;f\3Eztik[ZIm|+!
0
@xN;
3Nk&X3rWDfw:6a:Oy"5+^%}_"
$ x9|
n7Ys
,>Rg
P(?O
mK (!
ie@Q
4r3iR&
[Z,=
ZkTiR
n4i:
kV0q
L@6!bWj
- 5}
String
}k)</
`iDq
h_6?e:
_CorExeMain
[JjZ-s`mbWia3de[Dc/M%Io3$
7V8/
90jF
^-`~
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
:b&:F
3C9"N1SkBgDQ,QAr)",:@yo:$
j{Ro
n&@|k
7w-
ZM3 "
}d\K"
<84r
n 7T/d
e.k-2
Ttq6
syBU
hC5H
5*A 1
$tu=
_`W4
j$DK
~6!?G
L73N
-r_Q
`~J
R!Sb
InitializeArray
\>JWx
V^5L-_
&`X/
v/%75
LR.D
XrjDDt
Cv s
]@0
w)D2<s
q0/z
+1 !
L>H+
<]{=
~m-
Uc_bf@T
He1k5( fR
_r(aH _6
KeyI0
0]7L
l=@:k>)X
KzLoYziapk7E|4 [J'!"N$_]"
9"Hh
IEO;
ToArray
"*C
^:/Ou
pJ8`
OnCreateControl
3O6R
B72+
A)H
n7'%
g mdj*Zz;?iX&$2EP!T8BHK*%
IEnumerable`1
q!6p
c ~
0FHA
FG4aY
;be]C
R%7$v]
D':
%^"w
|whm
i2%HWa
G>V&
c.]n
VKDw
p#&V
2R^kc
.Dec
-l2%
get_Hovering
R`$NK
EZO
e8@v
E!VW+#
J"x`
"2 c
bj<i"
7l s*
r\^Xr03MMS\]IUo=$M%1g%-W%
Xn9.
I$<pD`
Or?hd!
Z$n/
a|KSg
aEmFjM}*]U
aa.W
qF^?
u^%Nen
4^Zuz
!4vC
!TJ
Load
'IkKe
HUJ'
.GZU
&]zp
o$'8
# MgNY
Gns.
Y8%
N:Pv7
System.Drawing
(4 p
v|`\
fcmi
uhBe
*V<z]
get_FullName
yO%b\&mku[F>Ua e3?%|ra$5&
id"DlF
\7 b
"m'm9
W}:!SEb0!Rb*yYZ=dL~_O-JY#
.<Vm[
h`Dn
ccfc
W/NE
BeginInvoke
M&}'
7G8{~
nNl?
(d}"
&V xiF]
Z>zH-
fr'R
9e@[=,a#ZkLvAaWZ7CY8b2x^$
CrY_|_Uf
7MPT
1QLp
nwkP/
Q\Gv
*dI9o
O;2d
F&_Fk%
eus@
3)#)
i\s`
cfR@
kg8Q;[
=c[Q:m]HdO|aYvI=X^!?slVB#
FI}YY,CRC3 )*u*pCo7=>&y#
2yPE
Gp<*^#DW!`gMQ)]B&9x[%%k(,
H)+h
=A$S
rwH0=
AK U
2>JXRe
UD -
H $Z
R"[SW@"gv%6w1NS(E7)Idy(y#
s"B
v8T_
F>.c
2VB6
x'Hz
RuntimeHelpers
wLy}>
!?$mF#6?g84mfp)&!G$@TCrA,
+&K
g%+7<ZaTZ1tMOiVur)`S~z@ $
]e(V
'L0ACnK[S
yv&|
b Dx
e[F)_
S:L;
gSn"
yWrb
N<b
q3; *2k
UserControl
c%8l
get_Enabled
G )M
J&97
U_6<<i -vE'#`cgX5A4]4_F~
.&@3:
(J@`'
,~Nl
@h^|
b%d[`h9l
\l`3J
g}G+w
b >?
,rX<
tehZ
@*|_
hvX
H <oS
dcS^
=DIo
}+l%S
G9BOLb5_l?m]Xm8f6\_G%v?4
-`P# `
/8cBYp/
_di.
ReadByte
m)f O
+wV2`
>b&=
vlv$
i(4hr
Y>$|
$1LkoPaJ
!dd)
(-x$
lUD
ComVisibleAttribute
x4]\
_'Vsb
get_Length
fA ffw
haTS
8B) ij
x^C^
t#4]tz
_#gp
[>->
Za[]
M=y>
; uoJ
q3p\
k bj
>VaT
0+: /<
/1b*.
#!a[
0R d
_Assembly
/>Q+
}/BPqF;
x`Hw*
/o?4
*xn
.50h
OV(b&:
xt_d
%Aqw
m^t5X
KFK7
r i1
AssemblyConfigurationAttribute
z-=
IvT*
y#!v
><|
0a4(
q#A(
y*O#q
wzAax
Se{;_v'
]fC I
VS.Wm
OnMouseLeave
4~<*#wb
nION C8a
j8)]G??_wvzVgx#)K-Y!3%K!'
O>qk
C {ap
8&p6
=xE|I
G``{
kEN )
Ik~H
.-:.
x['4
Yu=&
Q%@N
h [g
4X,$\&
&)>f^Lag)iNnjySvLaLY7UH>!
ZX7)UYg
*)`q
o|tm8E#Uq!,ZOi:aZJ[/1RW1
n;L8
wu`)61ts[XjXesW(U`wwi,Y#
Stream
n"gQ
OWI[
~mrL
K}uXk;*aO>WVm\MQm-Kmfo40#
'eWL
K""v
sRGB
&w|*
$/Qv
1!aqt!
UfHg
]xE
*<xC.
g 6c
7"pY"
=L<*
@ YZ
CreateInstanceAndUnwrap
mK%_
pu
}pa
tUO-
/3M\hG]t
.h0^
'm<dw
s~NZ
9EvT
;ti_
zC+d>R4?0Y$;/9Op`VGya2uD)
get_Control
Wf:Hx
~T#D
yB5[
i=IYfhG
m{TS
Q{3=
Confuser.Runtime
rKQj
\+~3Y^
7JKGKd
t#-H(9
Z]8dK'`$/;/LU\Oo3=5_y8jH-
a(/olBD54P3p]G#H^8Kb>o/P'
x{s^
veZ@|_TeH?i(op)t9;&;8qj7%
=a%:
P$|Mn
}XV\
)XZ_X
)_TR{
}7WuA
eNB2
l BE
(U7
{/ M)
G}20
X MX
U8rR
Q~M\
gJE]~
f3 NM~:
1.0.0.0
j,1C
nT2S
mZ(J
m92vPb
XrK\
vu4c
dxdUk
LH/9
tWoS
TQ Ud
wr[_
Mie2*H
|++'
Kn8s
"2{[
IAZt
`+Y
FS '
0G"vl&
H,%H|
set_ServiceName
SNO
H<~f
5u^s
|&o|<
k4Qxn
3)Ai
1q9#_
x`!N
Cqf
u%2S$[{
BGnf
(Z~a
v{~{
-x+q,
;2--n*9fAkUa+2utM;[D$2~Z+
x{GM
.jQ#
sqnXEiA
1d30
W}px
GBJ *eO2\%d|av_!)t1l6n6O#
_#6#+
7r"&|Qo,ng_BXz$p0UtL^vN;&
5" ?
-eT Z
j9U)S-6[p@+A(=#WM>:wSX4o-
\Cz?
,==M
0Jbt7
Js1
&V4v
<jgl
=IX~gk
NqyY n
{,S+
set_ItemSize
Y By_5
0{YQ#
mX4
.{522
gd98O
8.Z'
OQ.v
s/}Y
*noX
Y2lZA@
DmL
e~3rE
i_ 0;
e hY
9IOiz
@N`P
}Lw3m
Zb2jO|;)Y~|QZi~3nPSbU;84
-KQ6
eliv
K;0f.a@NuIi
')PXo
.JlY
$[]l!
K'*0
GetHINSTANCE
A2<,
H )l
[wtn]
Buffer
+1rK
>ZX&h
{Wmj
[whd
n*z%
BCJ{
5
NL*_
, s C~d
TU *
O'^}
=lI6
"4Tzj
L)e53W`B=L
Sb?q
{?*D
+83E3;m$
u OX
p1]x
&&Nu
z\<]jg
[!sIZNM(2!NAEHQDT@RHuCKG"
'X'i
SFX8
7QJTS
r].{Q
K T90cvpi~1Y-zWNp/G4QV(H$
Sc$DvW
,k>g
DN=+
-SYkV
Q+Qo
vVHoT<kd
|b(Y
k53-
5.qUy
~4p,
E?D_:8c
{W{x
T%r6m<kH?xAu,K;]kD00W6CR
*%y
a% o
2-<0
H*<{}n#7g\`/nT7Ql&ve{xA7"
^>K-@
CdpC#
<9^}XW
[J=f8M 2A(ys{CrvU1Vbm&RM!
(fyI
1ZB.U
A($j
nU&v
Si22
9,[d
|oLD
mA?A
V9;N;
'9&l4
7w U
OnControlAdded
&W|*
'w~@AH=ECboGQ Dx0% ^1=s;+
sC82fME
,WF
"x!|R
_4p~:
ZV+l~j:_
-/_7
hdj'a|nt?BTFgeM=Yxb8n'l0
F\KO
k5jO
3s6v
Ce"S!
j?&E
R2 p
3e>R
H~s]i
R[8p
G /T
MuAl'%N;kyS1DE!^s<rlKSM?
\sV# 1m
<4R7
Copyright
V]5awTPxd4]@slwy;/~t;1;r
ArgumentNullException
kC!c=|K
Gtd5u
get_Major
E lq
Mp'1V
UZULv!
nvsK
8Q{g[
bH,j
Vwug
QJJB
-%Me
$ Q$ki
(]uq
^rFV
Do8!+tx/P<4,A%sg6; K34tP&
Point
,J(+
ivZ.i
`Wsk
Wj^t
-:Xy
8IoR
>iP
GC(lF
in6rr*
u,,.
v2.0.50727
=>ljR
KxoB
})V^
YOrD
2*|X
ltNV'=k
n >]
:\i"jy
[W7!
Ci 3Y5O
^$hp
"HH%b
s1^\
)J?{HK6zRk[[gL0s/x~)DOIe"
e!!0;?Qv
^U xY
Trl*C
(-w=`T2D\S/w!:I\;Dk0Z%'n&
Z6I{
o F_
CX,Wk
YD'#Je4j
*{Aq`#K?
&_ BK
uO+c
9~D[
7 O-~
5BP#
~1RkUy
TTk
!TUl
RUG4F
?_/t2
U4}{t
>%,&'
@v)%
R0 M
Exception
B/eGm
zCKB9]lKw8)l;2n^/35e-aV?&
H}>=
+5UHui
u9>-
;7j}
Qc;SkM
YG12!
K8*N{M}YJ|>G%YmTDag^r\Vn
Yd^]2
2p;:
:Lx.L
xrF
92oUBY
Of8j
01bo
&WuS
#Pnj
QW4ZC
GmW
!o"
GetTypeFromHandle
IAsyncResult
<H}
L'Qw
KP-O%pq4}y
22kjx
a.S[
dALp
&wWF
m m]
/C0"Q
q:{ff
dK!|u
Se[1
,5=i7
GetDelegateForFunctionPointer
Y>q;
{;``
_X]-
unQQ
DWvN
zW0p}>
o 2?
9xz b)
=~w'
//bb
1h a6-
oS'2H
Q_D4
O`};
Ij h$w
4l}^HzW
]r?A
#A8!l
&$YDD
tdn#
3=qs
OeF@Ndi
jMmKC
s,~ K
cc1^MR
f-CQ{-H~!ADuu{NkVWO4zAN/
:Ry+O*J
w+^ 8
(U.1
#{4m6hq
0A~q
[o3oG9
?|EUI
0FYkq
$rnK9Vl4!Ec;ME>=Er#T7F~Y
~8i&d
|tf
pj7^X
R}FR
R`h y
UjR>
6Qr!ye
fCb~
#|4A/@
SxHI
_mcr
|AC
7NE~
e yR
~IDAThC
4<7]C6
Jf?7m
uJ;)U
\j"g
Cu}h0
Qw &2
FnnW
AFwt
XK(.
w x%
w ]C
K=k0Bd
System.Runtime.InteropServices
! 4f-
tir[
kw.|
hb ?[
Math
Y5PJ
uB'|Pq
iZ&j
g^+W
>9O1
QP/~
>uf
LI6?*
&GD=^PryUDwekwJ-rO~z[+Np#
L4TE
o. L
TJ8z
c#7sRi
5e#Q
$N<9
mJ#?
%N:@P
!m5E
`S~/5
CO#x
B?o
_Qu ?
N4w
}]5/
`w3w
System.Runtime.CompilerServices
kn^m
7y?FC
b61 |
/uyb
KU6a
;1nY
S]7L
~qu]O(R~wm+%]f'6\c'7'Vq "
L?XP

rf D
!bX.
EmV4
7T]]CU
>9Qw
>wKl(J`~l%tD~>T4+^ BFda"$
JkBv
:8Hvv
gnfF
UoNW
asi(1
{,hdfkg#zR}2yx/>m<s74LVY!
p<#s"
h?_k
H"6~
;F[u;
hqX]' /
G02i
7jl\cC
6s5iGjBOVu{CA8/c2@''R^%H
AbV$
x`&e9#%@-J| ^`ziJ3>3-Q;`$
GiWeaK
vZP0]I=>+c'V?XVr?/zjW}',&
|CR +
-p G
Oiv+gt
B/g/h(b
6@^b
_=Cb
/dY3
T,<r
q#qs
r< M
n('D^5a
MB!5jq
n;$Dc
59s&
~q =[d'a4dP6jFwi)7gr^#UJ
?wDq:
&?g$T
4m8(,no
;_ m
Ktt
B41v
M/0M
d}IX
lH9
0v Y
|nH5
%pw_
Fj.g#Qo}
set_Font
/'8FPP!{VYrF&Y$o"op_*L`k#
n0hz/E
}kD>(
Vqft
}o77#
/) )0
h@w:
GaO)
ciCZ
K*D3v~KF#SG,2(Fjc w9VeUb
SdqpiMJ1|*mQI,L~BB;JLvI/&
yuj
IDisposable
_|&|5S`
t9V
$W=q%.
s2n
=$&H
G <M
& Mn\0
&I(#
t@S<
9X$}4
&KCQL
A't9
j8>w
yThl '
z>8%
H-ja
\l~=
Sx"Z
`Bjw,G
{1`q
-^j1
Y1Mgh
Y-6]>
xR`LKa
hS %k&p
a.rT,R
B=%,
"l>q
U5YM(
zEBn#@
lfA$O(
yulI
X(1Kq
&f*Y
E?"2
. cE
AssemblyProductAttribute
^a/z
K:~'.S
own"
)Oe>)c
+`ir
2tnp
k4H3
4v@w[i~
,j3q$
[-l~
\_w2
ubU6rv
_xv41
]^I
<Module>
Y?5
I-RgR<b(p+$o'@kb+,SH(X~m+
EEN>
kL+}q6
z|t
sfK"
+kHp6
]+ 8
[R?!
+-e<Q
E`8r
,5X!
MulticastDelegate
P)Ok
RULVP
*f{dhpK>UkiRxYySR )!N>C/!
9-W|>
tpRb
k<S
!m_pData
W^'N
/,Xg
value
U~.h9
[MJM
2018
Xf+s
|uh?
J 3f
D@s<
g>FTmdn,):g+i&y~Y`9!jyS2
M4\>
3*we?
{U)h6
!3,aR
@8_k
a_I9jQ
P8~{
X#_LSc*B1aqY8AJ\urYwD)tq!
)ci6IK# t
>S,f
55e4~II^)_)tbFr:@&Gt-:YB(
c+5R>J&N2AqdF\/B>AMi(*SI+
OnMouseUp
G[d7
G4exu}
\g3#CDt
W#gKax;"l__i)Ys5D`z!HkPM
IC+0
1? fC
:VUvf
{Nt>
.)B$
+m)@C#/ADM00~Lg8[-9]5E> 3
K&831
2_jK_P
#%a8
cM.o
c@N}^py
yUkO
G\
1p/*
#GUID
pjm2
BDj`
}-.g
"{ Yu
RxL +
DI`C
65'%
mb}x
-8}
set_SizeMode
wRQ
1Bad
Fm2~
Oc{8~
;q |
X_~(
Nxbb>
O4L7@S~R8Z?TkI5#}2o?`hN/#
6e%!jyR4Oy%:xkGtxkR>9!d^
yIDAThC
73dQ
"qYy
R&N5!5y`^Ac=Bm8CnpoXv-%c$
^FIex
G|a.T
H/%lSq
V0vQ
YnMU
j5at
:Krhm
_\/4)R
~(]]/;Z($U'A,:t/=,T|DADf
IDAThCc``
~EoJu
@RTs1R
|QtS
n0n
nJT)ao(/'|%epk5bks0+<]co!
}}2T
G|*"
X +U
ny+E
& GO
A;[.d
@Z/[
Nullable`1
n ^
_;b>N
M`[J
'=FLli
udP&I~
/7kraC
'Qr2
M/OA9
up*-|
j"y{j-V
CF[P&
< 1S
lZgD
9)so
lQ'7
ruW7I&~Etk&:G@"Be[RAwBI$"
u9hn~a[3Q
get_HasValue
GHw%
J' 4
d;7ES'YiM)[[`@/^T,'BeUFP'
@:{?
}Y;]
KO4R[d
D1o@
Z(ueEt
}LM=MMGz#a/ZJ;"QF?t HQR%
-5~oJN0^C&gcdtCl8sLSch]X#
G&b$
+ N
U3Yk
lt .
}:oG
n!U^-{
cUb[
]^6 <
#$<34R
6gM!
ZA:qYOw#Kkcq;lg=wks@4K6@!
Encoding
2#I!
uKtO~ [
f.J1
sgh\kv
:{>Q],+mdy^hKR*9qGEJ0m/T#
)&*lb
o`tt
wMlnHh
D P,V
bm{ 2
f Fb8
=:mw!IR
_ Qo^
jj;@`2a'o5]&h<7c'=mj')@H!
MouseEventArgs
x|VcZ
(^'7
CdJ-
p 1+
get_Module
TabAlignment
G$kB
t<p0
R -Y
kpUHP
9=MfJ/1?MkHaDfT``']W3l-|$
~ >
c'WS
QVd.
(;Dn
#U' ;
Jm)%
]a^X
T} 6
%~]65/
552g
b@u<
"K#Km-F
qXok #2
PXk%N%VE]gc:4;Za<aEGRkUj'
Mjxx/?T<j,-P)q30*',s%l"&$
[*(V`
+$XR
=j@_
R_CZ
w<)U
_i@E
8 5. 3
-&ymz"Rb]/!WTDkb-&S'MI#X%
{OBf
+LU-
]j>
_ 97
%RL~
Cursors
[*kc51
XuZ!;U
{ K)
>ro'/l)+G}ABT_512Mae| [{"
XoIyct cE8CK|)5F"7-_**3Q
get_Size
d:5I`;
JYb3
{}h^?
E'EuV
-"Tdf_DYI1]O [z1J+NVkt9q&
rw6_
,[WU
bDl
RVB<
CRUi
U9=i
J7^na
G>v*|{T
EQgX
XT8l
ZHz~V'
WUVY
vcV
System.ComponentModel
,"Y*B
Ark.exe
OTXk
j^)
@D|Zrm~DV!m'>Ox<gd($N[>w#
m9CR
CCwA
436534A617CD86B8557AEAA31D433ECFF38B112F
vo89
YM `}ks
GQ #
),o^
ax87
9#i]
VEWmHV
>,bkh
K]ndk
|v19
]h-~Q02]q
Y3Jq
IyOk
K^(m
2'< U
_2,|@
DisplayNameAttribute
v$_3e
($B
~J6s
eqBl
[)[|
!:1Eo
$a0b39c21-ea5e-43c5-b1bd-86657007c936
dMLn
HbOO(
S|d/
C648C0E55DD0A71600A3C979FEC05C180303B2F7
4^D3
^>2,
~<f+
8usf
+8{*
'AaD
h|@.Gv
[TU8
uN6v
"}A_?NOCeE%th!L+bN`]Z/`<
~KCv
0SH` @N
/TpT,
6p{IE
hs.^
w<b3
W:H ,
&ejzzc
` c1<I
System.Collections.Generic
"[S?
)ubD
:|.:J
~,,U
oK ~B
(:\
\EvU
xAjR
)54<
#r$_~
Tob6z:
* -J
38u/
Via ]/
}/fa
|IDAThC
G X[
E"b8
System.Windows.Forms
NTV6
set_Cursor
SIH\A
=J&Lb
S_64bP:]bN>Av0#I(Iv~[TXs$
C3*u
W=kE
==R~g
3?1Va)S9[=?b0s2I9$3H 2B;"
JG L
:}b3-%
Rigd
7f[-:W
|?5)
~')mE^FZ#cs{_NT\t;:1!gD$$
eDHGB
T# }
WriteLine
5r'3
SLh9
System.Drawing.Bitmap
]t[Ec
gTi~_;'0l92ZsNy=\F)UVj\*&
g=,@!
cx}X
Bvz4>
d@'F
#gv|
IWzs
SetStyle
kI?C
i(
!_MY
ml[[
Z#1^
~]r
! {2Q!q*
KX(oK
@Ai.H
disposing
L08
?|/6
|KiR
M> bd
\ 9[
-:bv
iV%m
>7=+
>)KK
x BQV
njpc
,1XD
;)kOS
wO,o
HU*}
!@+g
Seya
'<f ;
PNG
!K8g
AzJ<4
EV ;
=Tv7
'CKK
=wnK3
ikZP8
47j=
y>(gi9h%4gj^562HO$8ld# -,
<^-W
c.%U_
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05b_64 Seven05b_64 VirtualBox 2018-02-16 18:39:53 2018-02-16 18:42:50 177

9 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05b_64 Seven05b_64 VirtualBox 2018-02-16 18:39:53 2018-02-16 18:42:50 177

10 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\som.exe.config
C:\Users\Seven01\AppData\Local\Temp\som.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\som.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Users\Seven01\AppData\Local\Temp\som.config
C:\Users\Seven01\AppData\Local\Temp\som.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\Globalization\it-it.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.INI
C:\Users\Seven01\AppData\Local\Temp\4d2b0c48-28f2-45cf-9fa9-808c5e95a85d.dll
C:\Users\Seven01\AppData\Local\Temp\4d2b0c48-28f2-45cf-9fa9-808c5e95a85d\4d2b0c48-28f2-45cf-9fa9-808c5e95a85d.dll
C:\Users\Seven01\AppData\Local\Temp\4d2b0c48-28f2-45cf-9fa9-808c5e95a85d.exe
C:\Users\Seven01\AppData\Local\Temp\4d2b0c48-28f2-45cf-9fa9-808c5e95a85d\4d2b0c48-28f2-45cf-9fa9-808c5e95a85d.exe
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.INI
C:\Users\Seven01\AppData\Local\Temp\som.exe:Zone.Identifier
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources\Ark.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Local\Temp\shell32.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe
\??\MountPointManager
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2532.4877921
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2532.4877921
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2532.4877953
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe.Local\
C:\Users\Seven01\AppData\Roaming
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows
C:\Users\Seven01\AppData\Roaming\Microsoft
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.INI
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\2c37607b-b9b5-46d0-bfa6-3c82cf888615.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\2c37607b-b9b5-46d0-bfa6-3c82cf888615\2c37607b-b9b5-46d0-bfa6-3c82cf888615.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\2c37607b-b9b5-46d0-bfa6-3c82cf888615.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\2c37607b-b9b5-46d0-bfa6-3c82cf888615\2c37607b-b9b5-46d0-bfa6-3c82cf888615.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\shell32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2684.4881750
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2684.4881750
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2684.4881750

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\som.exe.config
C:\Users\Seven01\AppData\Local\Temp\som.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\assembly\pubpol23.dat
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe

Write Files

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe

Delete Files

C:\Users\Seven01\AppData\Local\Temp\som.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2532.4877921
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2532.4877921
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2532.4877953
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe:Zone.Identifier
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2684.4881750
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2684.4881750
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2684.4881750

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\som.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3035fc5a\375c7a1a
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|som.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|som.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|som.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.ServiceProcess__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration.Install__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.5.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\337da671\3850e7bd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\337da671\1b71387b
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Namespaces
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msbuild
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msbuild.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|msbuild.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|msbuild.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|msbuild.exe

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msbuild
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Write Keys

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msbuild

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
kernel32.dll.QueryActCtxW
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
kernel32.dll.GetFullPathNameW
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.GetUserDefaultUILanguage
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.VirtualProtect
kernel32.dll.GlobalMemoryStatusEx
ole32.dll.CoCreateGuid
kernel32.dll.GetStdHandle
kernel32.dll.CloseHandle
kernel32.dll.DeleteFileW
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
kernel32.dll.GetCurrentProcess
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
kernel32.dll.WerRegisterMemoryBlock
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipGetImageEncodersSize
kernel32.dll.LocalAlloc
gdiplus.dll.GdipGetImageEncoders
kernel32.dll.RtlMoveMemory
kernel32.dll.LocalFree
gdiplus.dll.GdipSaveImageToStream
oleaut32.dll.#8
oleaut32.dll.#9
oleaut32.dll.#10
gdiplus.dll.GdipCreateBitmapFromStream
gdiplus.dll.GdipBitmapLockBits
gdiplus.dll.GdipBitmapUnlockBits
shfolder.dll.SHGetFolderPathW
kernel32.dll.CopyFileW
kernel32.dll.SwitchToThread
shell32.dll.ShellExecuteEx
shell32.dll.ShellExecuteExW
setupapi.dll.CM_Get_Device_Interface_List_Size_ExW
setupapi.dll.CM_Get_Device_Interface_List_ExW
comctl32.dll.#386
ole32.dll.CoUninitialize
ole32.dll.CoRevokeInitializeSpy
comctl32.dll.#388
oleaut32.dll.#500
advapi32.dll.RegSetValueExW
kernel32.dll.DeleteAtom
comctl32.dll.#321
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
advapi32.dll.EventUnregister
kernel32.dll.GetProcAddress
kernel32.dll.CreateProcessW
ntdll.dll.NtAlertResumeThread
ntdll.dll.NtGetContextThread
ntdll.dll.NtReadVirtualMemory
ntdll.dll.NtSetContextThread
gdiplus.dll.GdipDisposeImage
ntdll.dll.NtWriteVirtualMemory
kernel32.dll.VirtualAllocEx
kernel32.dll.VirtualFreeEx
kernel32.dll.VirtualProtectEx
kernel32.dll.Wow64GetThreadContext
kernel32.dll.Wow64SetThreadContext
ntdll.dll.ZwUnmapViewOfSection

Execute Commands

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe 
"C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe"

Started Services

Nothing to display

Created Services

Nothing to display