MalScore
100/100
MalFamily
Malicious

ded.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 18/68 Related 2805
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 511.50 KB (523776 bytes)
Compile time: 2017-05-09 03:08:14
MD5: 41057f7a3e365110d2745ab516083c21
SHA1: fa97b39d1d2df15f4bd08c509a7de2c1bbf85528
SHA256: e48a428d548d886ace54bcc0dab3f3926d2d250633ca8c66dd49930ad42defd9
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 5 V.kA|!q< .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-02-16 18:37:48
Last submission: 2018-02-16 18:37:48
Filename detected: - ded.exe (1)
URL file hosting
hXXp://prosciuttiamo.it/ice/ded.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-02-16 06:01:34 [18/68] VirusTotal
PE Sections 4 suspicious
Name VAddress VSize Size MD5 SHA1
V.kA|!q< 0x2000 0xda7c 56320 b13e1526763e35344e325c690fc5a7db a55e987ee8b41c57efea86c7f09dc9cdb8c132b9
.text 0x10000 0x3dd40 253440 9ea3e15b39afe929b4077a799e10004c 0d81dc215edbf5cdefcb67bd263afda9d007d3ef
.rsrc 0x4e000 0x33a18 211968 c8f4ec0816efe16e795166c4d361253d d61fd4bdf6e71773a24947a7d8dce0f38595dbb4
.reloc 0x82000 0xc 512 4e4a67c1ffad72c688ad19cfcdc4fd13 d14eeb3fb7574ba336983085b070684b350f4b1d
0x84000 0x10 512 da8c3884b98792b6bef8967fcff539d0 68e0303f596b209249acb6097527889af6738d8b
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x4e130 209740 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x8147c 20 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_VERSION 0x81490 920 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_MANIFEST 0x81828 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: Copyright \xa9 2018 Northeast Utilities System
Assembly Version: 0.0.0.0
InternalName: ded.exe
FileVersion: 14.2.22.1
CompanyName: Northeast Utilities System
Comments: idebuqos
ProductName: LightCycler\xae Master Mixes
ProductVersion: 14.2.22.1
FileDescription: LightCycler\xae Master Mixes
Translation: 0x0000 0x04b0
OriginalFilename: ded.exe
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
No packers found for this file
File found
FIle type: Library
KERNEL32.dll
mscoree.dll
IP Found
14.2.22.1
URL(s)
No URL found
Assembly Version
Northeast Utilities System
idebuqos
$#+*,*.-102054647484
14.2.22.1
VarFileInfo
FileDescription
a9292ade-657d-6e38
Comments
ProductName
InternalName
ded.exe
Copyright
a9292ade-657d-6e39
0.0.0.0
a9292ade-657d-6e11
a9292ade-657d-6e10
a9292ade-657d-6e13
a9292ade-657d-6e12
a9292ade-657d-6e15
a9292ade-657d-6e14
a9292ade-657d-6e17
a9292ade-657d-6e16
a9292ade-657d-6e19
a9292ade-657d-6e18
a9292ade-657d-6e31
a9292ade-657d-6e30
a9292ade-657d-6e37
a9292ade-657d-6e36
a9292ade-657d-6e35
a9292ade-657d-6e34
LegalCopyright
FileVersion
%q^
VS_VERSION_INFO
a9292ade-657d-6e8
StringFileInfo
a9292ade-657d-6e33
000004b0
LightCycler
ProductVersion
a9292ade-657d-6e32
Translation
OriginalFilename
a9292ade-657d-6e1
a9292ade-657d-6e0
a9292ade-657d-6e3
a9292ade-657d-6e2
a9292ade-657d-6e5
a9292ade-657d-6e4
a9292ade-657d-6e7
a9292ade-657d-6e6
a9292ade-657d-6e9
a9292ade-657d-6e42
CompanyName
c69bb940-dd8d-b8
Master Mixes
a9292ade-657d-6e43
a9292ade-657d-6e24
a9292ade-657d-6e25
a9292ade-657d-6e26
a9292ade-657d-6e27
a9292ade-657d-6e20
a9292ade-657d-6e21
a9292ade-657d-6e22
a9292ade-657d-6e23
2018 Northeast Utilities System
a9292ade-657d-6e44
a9292ade-657d-6e45
a9292ade-657d-6e28
a9292ade-657d-6e29
a9292ade-657d-6e40
a9292ade-657d-6e41
Ips?~
^q,5x
Yz+h
fn!
QsU}
P%1%
rr3U
#Kw9
-|lI\D
]}qQc)/ZMz5,FIq5yM$Hh_Ry2
<?c
]pD
)^*Q
SE,
Int32
>pe.
{Kw[Q
H@-j
.jxG
g|YpM1+=B?$aTyuSEn&KkK!+'
hW!KG
b<X>6
ObjectHandle
Z-^M
6k,V
QD,k
k)0f
Rezq
|\2-]=+EN&Cjmuf/R^``_W]*
G8Eb
bxf{
w{01o
2q_vU
^O|Oc/sJRV[XeI`lZBXikKZ($
ResolveEventHandler
AutoScaleMode
get_Height
19yN3mH8]@TJRfBY,2cZf6Lm
YP=S
MD0?P
)!4=
.$X+
>w@rM
C\~\
iz8y
o~!Hx
vI;z
Rf x
q 4
Data
:4,E
g=%:4@PG(]*I^Bs/W_N[saH:,
m<_c
PaVbL
& t$A
D`v$h+)`^^>;xU{Y*a'yx!P^#
eyVJ
YX|X
|CH>Z
TP`_
n{aj
X!Ji
d *
6{u3
ol }
!4^P
.8=I
}KjY
{^aH
MarshalByRefObject
Rf*F
a Dw
qei)
n39
Version
iA-+5
J}l(2y$Sk:wCSgUafGvA:/<|!
I$ L
d g x d
o] v
zQU^
aWLW
X (+
yT2O
%paA
5jq&(_AT;`V9'VA!eKcio5KR"
J92.
uQiKq
"dt|
TN>S
Da2*
k}b
a>Ke
{hiOuZ
AK(>w
c {
m1xlV
h})6
/}!du>#GA-H%N^A4kAOq0(u0"
| d
PNG
AssemblyTitleAttribute
wjIQ~
/&2unu
6]HV
; 'z|
=YC+u*:DqU+1]`R$N)7V4%88/
y<M
ControlStyles
`*!\F
Marshal
w?;E
5*-0rBC9Fm?41I7-Lb,eUs2<,
O Kb
p>yx=
eoejI
.Z5#OM
J!:=
thL ^
9LEZj
~%9^!
)d"*\9
NhtF
7_Us;
{_.j
D*ph
j<O.$
x{Sy
.\tc
op_Explicit
RuntimeFieldHandle
0<pJSBZ
:82
}IDAThC
O#7;8Y!h
CJ{wtP
!MW(Fa
ZKhi
j>@_
b{5@<0
yLX _f
351YH
2QM<
V["'
7|DF
ukA6&o
N> fb
,YG*:r
x>o.
ZXJX*V
J"^'
pE~:&
ZXJX*J
xWj5
rkBB'
EndInvoke
/u1[
A->#
,GX$-@
:oV{
fY2IU
/_qxD
O%{
*an
`-5<
zqL:
|'21
0Vjy
($'B-
AB]F
7_I(
Lx^@
-yM|
m:2&`
LQ6
,XA+
H;Gj
hnJ:
Oky"
!"+(+
\ICS
ka&X
-Y$lwo8Hz*n%1`saoV]G))6E"
D*od
6#CPf
\sQf,d
bb nH
-6+hE
opiA,
e!:WI
HJA[
KKOk
hXN$
o8xO
set_Alignment
Ik!W
AssemblyCompanyAttribute
#O0~
F-N/PU
i*?l,<Kr5cqIMsF/1x-aCi&l#
s6rw
5$zQZ
lol
v= e
|DdK
&coRA&
jOE)Whax[[*U'OByqYwg|74Q$
'W %
>23 A
~TH\7
B^Q%-
LL%>e
/)$8
q/LI
d.V7"E
Q6#qv^Ft
n!*7
h&Z+
iAdj
Y !
2vpG
sP{N/k'2A!JVKOyHMdMSK,'g$
9|{H
Y3wx,Lpv~/8?"O!4w=U@!(~Z'
qNW"u
Enumerable
t&?
?(@o
sWU\li
l5A1
V ~1R9
|A4lTy
>\x{
a<Viohi
Y3Z i
AppDomain
Mv}>
,siL"_
i|;=!
3B.fa
Fh|tT+
TV!5
"n.x
get_CurrentDomain
_R8y7
,!s@
m.x
Zf.o9
lY)a
WVaQ[
=L.1
(E8P[
bq2B5L
q"MHG0VsQV`Tqb4!!rGti K9&
&tZ=
|R9<`
tG >
']R@
@ :`z
rn9rY
>GfM
F89Wx
p u7S
a]Q{
ZL]b
: y?
]U1e
q[)
!eRYDD
e60#JMa+Y*4=$~?NsO;gr=\-&
0|&(
1J6XU_
{2zR
$3r#^
j_Z}
{!*Y
FPBi
BXgf
Uey7
{T^S\K"HlA ]i_%g%{{=v/K&!
Sx7L
}:jJ
8Q7N
0,]z"c^7n
AssemblyTrademarkAttribute
$Z{m
xmD[J>
f*#J_PQ
Ul"?
:-Jf
xp8x
URsd^I
YeL/
|)Oc
<_[zn
=*4e^Z
k`u|
4o@>
Vf[{)
keYl4Yd
-4@wY/x@v2A!"4%y936[U7Tv&
|#tKWn
Xp} |>
O8n"~
EG({
IK6
JbwF
}LYr
BLrx
S}}'
d^ f_
)Py5
x*CH
}oq3
Control
GetFunctionPointerForDelegate
!'fS'vrq
s. $
E+~^
YG~d
b+p<
= "# }
)_SJ
PZN'^
QnY-c
!bhr
_TR&
29)R
.gmG
<V43
Ics
IG0,[
"`?N
zq *
tc ~Y
ctw*
y}~2F
t 2Q
BindingFlags
[@eS
YF+NbD
5RAa
EqyT
Type
1'Mm
fpS
?Ccn
!o=l
ev)]P
~lz
=Z_d
)M05
qdFA
- "q
y/{pzZ=(?YT"CiCxU${og~P=
btA6O
System.Text
@Kc:
oJ?C
vn(j
M H^
PQ*=t
L,^Q
#ac;hO4,DaZN$ m'4pBMiwO''
'N<)
ea_7awHa'Qb"BA)^ TI@6G:,
e9mn!
^kP!3
D 5
Cursor
bik.
b\:-
~S4x,
w;]+ylRE ypp}x?IJHNarg;J!
}T|!
E[]P y
WOqXn
A_w1w
j%Yrny$n?*,9AfQ@<?LFxx9e#
CW=S
yZwN
?G&}
)XwG
a]%K
Char
IIi$%:*dE 9LeE%G49(ox1ry
"S:YP2cV:o/ZNRo"o[2zr2V|"
u'p'p'p'p'p'p'p'p'p'p'p'p'p'p'p'
SJ{Y
uvKi
>W0V#
`15xYcqo3Jm2)umReFeCO5 =$
$f{
pNv+
[K}!5Q9yL4U:NF0Wo(Qx*o/K"
Rtf%
Lr>D.](W
ZgNR
kDlf
g=?%
%f'2
GetValue
cBl6,
}},*Q?
srU\|
p$UC
:BJDaVj;J}f3$<Ix_NQa`lbR&
8Nuj@W8
&[?$]
tpq:
X,WW
]t}[
get_X
get_Y
3F842
"]9v
-[O)<$Zb0;B ibz>7uEPj&;d+
BM;'
mz$M
x{@\
? &{
m:#B
FQy[
VirtualProtectEx
We.0HB
P$ml'
lxo
get_FullyQualifiedName
= < < < < < < < < < < < < < < <
{U1U
u<bD
} <JO
<ud=
(U$t
kIt~:
=iS~y
e]BcN&2\2sx[RyibJ_QzZH8G$
C|cHg
2A`s
x5&@
j.Vm
~!!@i
== $
|UylBB,
WFeb
7{ 3h
E.
y(*A_[
7-:
KOhHe
|\d<
4 /2F
[E_ \
cT/DA|O
UkrIvh
W1Rz
LNHP
>}],!
`^SD
+rP^
{{*S
(N[&
|(@}
j =v
f&3Cq
P[G]D
@0w;
rW Q
ui2 >
o@v:
&E`E
m%$R
fEZ(
Roz Y
x& 7=
.q+
@$G&
/Wo1
[=@9M
^+jw
4*tau
lm^q
5 E*
SKbHBrnqaEB?QHey:2J3fXI=!
W /
.text
GKz(7
`x~
hle#^GjW!&69@|c0/58dHH:;$
GetString
u\O1
lcS&
g! !
Component
x}Z[Kq
O$F<
+4eZ
)=7T
euz,
Mq _bsx__3`
Urml
U ,
P)S]@
lc;hf skP}bdh)f3W6<_QWWS'
wOS+gS
b 2&
qSn{
,nOU
8|U|
vSo <
3{i.
TBBRGwJw7
object
K N@X
ABH.%
Svt
fpzwC
.t^:GT.{
kiyU
-:@
3>sC
r<Cv{8
&zpE
G =~
nCKm
F#e8 R:5N%%i^B[f$KusoGz%'
CZ\4
(5?s,Xx<4vku+W%T+JXN 1e-#
yZ#$QC
( yO
] )2;
w(wS
l;stu#
9.L
j.UL
cMgiq
2U_T
{G&87
1<gU
@ Kd
BL0wRT
H^2(#
%i,U
"Hw7
%E|
N(
zkRO
e8b9
3j?e88
j^29
xQe"
t (
%*/*
[duu
Kt 9
uT/v
]#3g~>L9
set_EnabledCalc
\,C
e&]Ujl
_^cb
G"9
%fTz
r;-@$}
V_p%N_
v7|@V'
g4M>H
t@gMW72hO>%"038d8zKZNwJ4$
;9gbQzt
b0KNEu
CO_Q
[W;
6x$s
>xeO
1<CT
tK)
KRu/%
&;M
4zp|
WJP?h
E=rYz
z{id%HbA-c%0p&4`OQfQCk&w&
-rYU
~uokGp
yS;cj
Fp1
Fg[?
Mw )yw
E@<:
{H>'B
XD;
!uIN=Q5[!iO-3Rn5?#|#4k9u!
/qQ9
a8%
k'eT
{&("iO
Qv5iI
V&u2?!
7q:J
7]z/
&*' )
6$tU
Q }X
?*n/
QMe~
`.rsrc
o.ws
Si+:
PMYtjrovn'/"1m-(E-cg>ds7!
*To`
&&6"
v9 *
fcM0!
a Xl5
S?gs
<'*J @@++
c g
get_Default
\[hAh
%zB;
=J?0
M!Y?
kernel32.dll
Y j6s
I!J<
result
}M)n-
#\-}
"1h_
P:&r
y Ss
Va^x{`
oO_f&
HF+2
.ctor
PE=
F`Vm
x]qK
I?'ip
vU`+(cAq;2FSVN"UVFE,qTW*
GEBDB
NA[y
5d0*
-%D<
!0FN
}~O|=
.']D
WYpR0%
{t{C^z
3[+<u
T^*$
Sv>
noYg
/ffy
f^R1
^iKc7
_h5yzD
'U[d
Yl,,
"7~w
M5@(
LIe]#
7I2o
M%=Mk
5J
Y\vgH
|-CQE>UKR}^Z+XXF^i8b*ceY$
` Gx
8kZl
,:RU
| +;
rqP~%y
bg(5
\5t`
YEmg
B n"-,
|^?~
~.UB
G2]g(
BR_Z
d2AY\
?U Q
? >K
=d2#
o j8
#\+\f&r
P2ID{Rjde8"JjAO'?BE5|&0q#
oET+
ASS
M ss
jhkl
QWlz>
MouseEventArgs
x)ZW
Container
pAkV
MI:n#
KQ1y
p'@1
=7>Ui~=-<O3:M+\e<E=IQm|t!
5x/k
;3X|
Zlw %+
#'*^
M$V(
eVP]
ViJ|y
\P8;HDRD
BLQM
ZE&
m`#6
jbs"3
>aL&
KdIm
L@n>
Jd\2
`-Et
+'>`
B$UYt
yaY,h
u+(_
?!?i5h
?v2
tz.-;
EpyzII
(
wLG5
B~{h
V$3Q
RF"v
'$t
U{j+g|%R<Jcn5th$((G"/UYW"
`|q7
<k]Y
LBVW
%TQF
o}H ;R
TWr5lhui`{=b,`J!*MhRe,Ab
MRTLh
91[)
<p;
#Ec[:e#0uwt6m<j~\)L1{o_&'
F~@=
r1lXM,
FG:T@
$,35{
&`|!
/Ns?
>e^0
Z>C=
XJX*V
|/f|t&O
xO/M
{ kg
C.+P
Write
e?wy9i
V18t
OnMouseMove
]Pm;
9m~Y
J`aO
Rr0h
[%!)
zECBW
$7{
e#f
s(FZ@/
%ZU*|
get_Assembly
o h^4B
pB#P
sS19
v4\/
|kIN
qzl!
)A~q>
%ijHQ
9&o)>{
i8Rk
dL|1_
qQgg
4g}Ns
"%Gpq=
e%:MG
;=]&
AR's
gRj]%Iz*F_#{s%gA9=,p44F'/
O[bK
qsd0
@/ V
4rs<
$\c7[
pZ
D`~<
2^o9
C9@5p
K%9:
IFO.
ub}9
4I[%uz3
;R1)
$w Z8
g$KY
System.IO
z`m6
|KK
WrapNonExceptionThrows
/u{@
8plZ
i+/*
7:d y
Q"s2f
K3_B
qrg\
K n?]C
mY>2ZR r/4#:Qi23!+~{2b;3'
L9^? %
t g
T|A$+]
Console
xjSBb #
Z<[112"s,88/:igHU' NoM-o&
`sqQ
Q]
DV6c
bS{:
dNNX:};R3~d?[ {!OB{gB4XG!
?F~|
U[5
;k )v+
>.wv
r}q4
%02h
?Bt{X
r6N6T
\]4G*
zKGK(gRa<u;@u%[alb&}!rO)"
rB0Ssyekr:wMV\5-rCOSk}~A"
aJr4
Dp`?xLU`-&1)l!-[g>Mnd!QO#
aPVF
T08!
6Z X
ehu8:
S|.2
+Gd_K
6\-99H%}&)jQl{Bk?kX!lF1e'
1Esk
td1
=!Jb
5Yk
lpO|
^YW
~(YTE
b`Oq
#1m{
IHDR
=T$1
+SMa
xfnxS}
^>!dLK(:d=1x]z~xC5wHQ]cS$
KYNr
8i$/4+WVtxm%S=V<_^iQ<~Pi!
r!A7.
<R70)w
`vK@
]$gn
Ue"-\
*>00
v"<69-lxjL*`ZGKU3rkL2Wy?"
h,}S
L 1Y
h Z m
lxt)+;,5f(}IBR/`D*'*VL5h%
4Zre{iV{%gzW/b^5):2kA1e:(
9U_x
x$gD
k63s
LDf<0_
0G3Gwu
xUt1
lsX^=zRBK2$=7CX_(_R'H[AU"
n; Z5
:,"n
wN!c
)ECE
System
EventArgs
Azq
>/aum&E
79xz-
V!LWqa0o^
{ \6&
=t1mT
R#
68|by
Y'aKc{/O-0=ga~{m@i,N5OY0
|z#2Z
\*mf
)Q4Y8
T5.
Q~_1c
&KLE"`
VS)4Y
-7fJNf3
*d?+
072dhqT'JCU2T56MZrVS/eUq
T/r.{
ZSKX
M.aa
& G6
m}Tb
Qy=Ho
CreateInstance
'yPp
@ S.
gWbG
$`7,
,wgJF
ohPv
M(YM
IqTa]qX};I*FP\GC^a=c]:1\!
oGK#
m?R
MethodBase
#Strings
x#k;
[4<_
:' e
uQa5fH3
O63so^
2j1w
z7hG
ZXM(!
sG?G
Wonf
cp?MOZ
} Rr&
?{gh
5gY6^
Q3J
MqA%~
\9`M
}nA_{
lz"{_?-n-r&s6IQV4&]0OoJ'/
xYH@
"?63
.JCH
EY)|s
h-Es[
`_].
.Ags*
YUh?
Environment
U $7
get_EnabledCalc
Xk 7
t<(b>m=a
VirtualProtect
/uL2
%i"{
%lVG
nAps:U
y?0b m
bcJ:x
K+c[b
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
m( ,K
r{Kt9yW)q>!;9;I?t{tI{=#e"
dc^O5
d(-cJ
_xjg8"B
v1:_gtp:JB[^Cw%6XB}cF`)p
JBLx
D3ui
3`` dJ*
W;'@
b}Xe
get_EntryPoint
XGz}
7GULG
ADZm [
KRFw
nu9
6PPU
} 8n x
*A-=
b'tj!
7.NG
@Jr
xwz
CN l~
PC_@
n!Z
d?U[
z2l
\r&0Uu\
W<(KAXA4ww29jWP)mb9XS:1t!
] >tI'
HvT{
~n#
B?|K
GetType
,L\]t{
1d2'
RRZR
g !xR:
add_AssemblyResolve
3] )
?4Mz
IDAThC
:asu_bE
@K80
$TT=n
pZ \b
wY 1M
Lh}K
LChV
eTYz
~vV^ Ts h
HZy? .
k @dkov
set_OverIndex
BJCf
\:n"7
_FT
kft@W
:Idj
W,7 ~?
(.f
Z|n
*rvok2)G6v;J7)"^Z#0S&M}1%
'R[o9u
uM-}
~;>
t&cO
B~7O^
zX(Owd
vb ~
H2(Ifc
t-A@
iD)\)>^`
}m,ro!
K_fg
`Y*~
TabControl
<}RQg
#GL)
rse=-
BC$N
P.Qa
8"83
%Z,|
b~&E
G:p?
SrY@0
jM0ak'
3:8se("R
.yEP-XY$
bS'(R
]V_?+N2)53''C(`pp6IKl_}U!
W)+ 0M
{z -`k _
~g"!
%SW'c=G[:xR[!yWz]=C|^L{L!
aD"^
p' b
U!{3-
:j 1
Color
6 +P
1>,.
FE$I
%+D3
Intern
Zafv
G0F
A?^Qq
.4de
S91)
u=Oj
#e&C
vau.I
l*mYj
OIZm
u@b~I
01v=
Zs{>
p(.Z
-Q)3
M]EU
K(n
get_UTF8
5[]$
+Y".
11wsS
t BS
get_Width
a?;xF
j}-v
m:?C
M)$YCv#aqgbY3<9i=zZLyEZ+
I[[4
K}]=
)b8m
hOet %
O&pQ
ZX {`
v 2
}*Z -3
~D{IUV
pn`g
^V5i
aoj2\
j!:
get_Revision
zl4 ha
qo"\%
K<-K
fG-Q
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
[phb
1X_TAS $IC$'NxxCI_IHQ?{C
w-%9
;f88
W"#J
D"_, W
Tvt
r=Rr
t30'#9-pf^apNilb`^]Jtwha
0{;X ^
H(J=J
qqFC;
$WN#
>YX
IT|U
qJl9B
Eci'
sHl?
EJ p
s+3:
J|W?
Ji0R
.D!%
STK
GE|
cKL@ 2
^wN5a
C>=}
H?bs
EInC
OhBW
(XD r%
OrZx[
r ),;A
?+utDs:
:3R
"]\*
VWn?
dsUQ
S^V)
vDH!c
q"xI
Ng[Ljdc
y{7
xiM<
QV1= ~
]quE
HOXD
o2\nJ1?
}BW3
nO_)
TOnA
HVuu\
'Ao~
T-v
_Oq kL
_>1 l
>ZaWU
"_MX
I~/VI T
1 4<
]AK,
cQ#S
HIPVQu
R<3{I
System.Core
xDk2
|X$[
+U9
lJ*F
2NtYe);e(y-xrvBH'K-u(0,i,
pHMfi6
<.S3%
5DBp
6q_ b
Z-Q0]
K"c?UU
P. .
EZw^C
Delegate
"0,w
O3HydGK
4_s9h
G{O
ExEk
?RR:x\j
>j,M
CJ|>
1eal
""mE
`k-D
}IbRm
_w1?T
I B
^:gxwF
!)SO
/$HUzG-
{vOz
tZ v
g1L:04K9
CC8B
y#X1
9jgq
WzS#j
>V4k
jsj_
sIru@0
X +4(+
:e0C9 N29
k_aeZu
QHdKar
O h`!>u,^K[v{u*A9P2r}lPJ
}_r
*oT0
X~Z$
wOR%4B-~(Zm~8g&} W%xB&ML#
hu<YVO:9
4.k<
< $O
+%+Tq+_WNXH/<9o9bVb4%N}#"
`E%}Uf
{xBxlhL
ModuleHandle
:;9@7
|4]
U=_T
|} *
R?CZm
QK7K+>
BdR:
gApg=&!&
)5U
yi
f"y q
xiC(
`fg-~
{IDAThC
UB99<9
8M^f
T,bS
c1x5^
> wG
dz;[
~J|z
?9r
=a,s
TXFe!
Y6W_}
2 S'2l
2;M]
xGm,
=E>0
3[4j!
a<kw
%it[l
4P h
91lw
nGz*
UD|JR
set_DoubleBuffered
W~H
l uxp
K<;c*
get_Length
@sJ )%rzk[!?'_"=|YG5YD?*%
l'P
wo3.X
Q,=1wXD1~g/yj^@_dp$I+#7O
AeV@
pO+M
|Aox
dR}?
qj2`
System.Collections
I@T;]6
:j;f2
ZPGCO
Zw)cD.
?rAA7I3+N|A}]|8Z92LjI?O$!
hfJ
: Y0-Z'oT
sA0P
'3`
KaB|
!,h
?h2[u
gIV8sG&
mq+)gT
_ Xv
QN<
nX#9
Jl^R
w%+U
<>IS
NbC~\
Pglj
ZP@#I;
u^qJ
`&\t
=~M]
/%qz{
n7e7
xw+|
+DT&
pJ>s
<l!If5m8 Yk8{W,eifI$A[QL!
ValueType
-mI$-
c+ko
WAk4x
GuidAttribute
uH5]S
dkB?P
|; bz*+
Y,fH
^MG4
B| j;
Xa+(:"`>h;hobwddM~-p;</$"
1~W^b-\2`4Iq\n-5V+aH2))8"
Hf?u
+Z2>?
PZIj(
;%mY[
@^Tg`
x%Y=
C<$s
$\3#>E#
-9jy
System.Runtime.CompilerServices
,gO&
h%![f>mLpWo_(f0~_[7wg>aT!
cSx#h
z(s;l
get_Count
7''=
4B e
<"CL5
^.t81
,$SSl3
8ux 2
5Bj4
S<%]
8#w,
K>.3
@-~B
nT S
`)D@9:_!CQ$GL@8qKxi\T0I$/
B[FF
NBA5;P
Xfu|0
{j|4
U"XS
2w)+e
ds!~f
L:"R
_=W#
)<(
4CXN
j/#u
GetField
s^rf
?')
\NPr-
b!@N I
@ H!bt
b@HD
6.W
;fIw
/o^5
y~N8
+T|Q
O.96*
X3} fKb%'efqtR;j$x}eItU{%
Z8a-
TS#l
8g@WP
f~?^O
jcIv
nFd53+
|K2snp
` ..q
Z '9)
LWu2
Z9K"
O2v1
@KakZ
OAd\
|OJO
UInt32
@P M
o{ b#h
J9\~
YLR$R
1]M4
"[!eY"3
e Y9
C5|%5H
get_Version
<Icdz
$+Jv
]c.@
QkOj$x/+T[sk?gdmF^&Py86"
ToString
%h*L]/I@}/'lV[tbU`AA{&Bi#
m&>E
~W5
edf9hrF
,FZ%
AjI!
}F~c
QH#Q
\6mb
\X/I
uvr2
` :Z
Y5o
g<Rw
3eQx
X
&huCz
+.M}M
3J4^
%*S.
y4'?
I NN9
U?|s
rpW.
{lAJ
aOTs
BL~.
Fc:
!B+Q
i~D!)clV&`9jtKdD7:-#I&d!
SAT
n ;m
RGha
M$Zj
F {%N
!+G
sgRadN
wa<+D
1w<W
hL"RY
GetTabRect
y_V<
s>e.5
f`wk
}P0%
1sg~
l+Y
##uo~
\{QOf
#mzy
/-8{
\E()o
v~'$
lvx|
Vn|SK
r&K)
Pzx
<H_{
m_WY^DgGiks!_n015+,Q@&aM+
]S[is
+V"t
2A.I
6kO%Z
vCnO{Ww{AH?<Qw;U2L+O6KfU
2^0r
0{t8
!2|=
(;!m-
nV$
b7>y
A~a4x
XeF^G=>~+QuI(T"aM<DgJxYt'
l:3
LzV
sAE)b~{
z:Hh
pP[$
BPl|
q? |L
70%=
R=6z
wGmY
djbi
]]fo
}(bN21Bj sP"--?#KME=l"1p"
&A$ #
gl6x
lKq
`ti4
O&2,
Ln6n
aU4U
yVs^
Wkt&H
\'PG
h,K:
h|eZ
n<@:|WU)~2rb;!LFII<CV=/"-
yXiK
^ 5^
Kinyv
`) |AXr7
I|hLr
<R97
c8$V
lQvt
_.4Z
]QAVId
3lx 3
|'o4
sGfI
Cia=
Mz0M
q<iU
6\=/
B%+#
M& fw
!,Y`;
Enabled
foH~
ZG"Hb
3#g
rZjc9
/ZR|g
ZhsP
C`*o
M[W-Mw@V=c70@N@P U_v**]r!
x]-
`1S8
;^lz
=;VQ
gW`I
ct-:
$ #=
B24[
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD@
\,QD
RM<gaK
'Krs
pHYs
\}j4x
-Ul0M
D; J
(5h
ryg[>
9FQ<
get_SelectedIndex
WVj ?
get_Message
0>cA/
B Tu
`5$S
YM%&P6q
F8&sJF!s72|V B9\a:4lx4&P-
nhxI
E$%$
uI@O
+-q/g6i)
E,U`
g k_
gf0BY4'7n@6kB3Ln 2~47Z%|!
#goS
(#29
Main
.e%;hE
)JhE
tH}78
8I:]Q\
fGOP
-N3z
Invoke
callback
17243341-60f4-ee.Resources.resources
YVzsz
9=m$
ZXJX*
kl U
@K:g
9+r!
Xe\Y\~
xJL3
Y 9?cJQA@E-,1&V_$J$v-q?q%
qn78
7LrByBLi"j6GyU2sZ3E'=CBh'
?KG|T
9(LK
&#dXP
dI&[1q}
6 ?
+hJ_
$$@#M
c~s,
,@K&
<Hu
b/`%
r9Oi$,
;'D=,Y{>QA;m,R`n|XjO7(1W"
@| <
D%f{Jx
*c}o
/c l}
90y$
Dflk
F5 M
p17$
bYeV
h0JH$
v,7:
x5KJ5
eB?\l:
$jjxX
Module
E9sX
]Gz*
@8%_ZOAqPF*(C}yjv1u~=$Jd0
I; u B
ddXq
"XT W
.U=S
FK<9
Array
*f#x
9l3m:@Zl]jAR(r$-;5/'~5xG,
, _0
R.b<)t-<
KRpz
a@(=y
[@XD
$G}xh
? "[
.`[er4[
@.reloc
uKa3x
:Oh4
3/,z
6(9Q$0
TonX
1T7Mp(bddgfZ7BEGR_FOMP}H!
{O`zZ-wl$jqktV;GD!0/^5B7#
veZ~'
6^d5I{4Rt_K&Q,$p[]mJ+mF %
a/"#oTm{oWi\&;b2G@8HS7{6%
?jcHw
ul)`gt`N&i?%m0tg/%TZeL[n$
P) j
.y+"
O7#2
TabSizeMode
'ZN8
]v47
5atUO
Byte
get_Chars
2G2mZ<d"3s8Kzs&]&&{Hf_,B$
hM2js%
;v( vAr&
G,Jf
6&;#
#D|D&
MUZe
fknm
?S2d
66eP]
`jhE
E;'9
4 FO$
5=0|q
t$*O
<!+)
,Xn1qO-'8C65&nl+L7$]x;f%-
2V:
!ZlE
k R
fS7
1?g!k\'7F]QB~$C|G<Lyzs)9$
/cjD(4J
Zj1p
#&M"%
:Xql
/vS}|
)@+@D
Ia Hw#H3Z:G
!&xw
2Yb[
9rF1q)
Y#YN<0
fOH@
$5Tc
T5w
Nc_t
+Iij
fF`[
|;3'3g'^?`}JWyU)T-MBq[i!!
~=/MnE
0j%,
T:-2
oba_ll[
BpbT
j?[X
:hAk
i#Dy
GT2^
c #v
ff#}
8;S<
\7[z
Wu/BQ
get_Location
-hgV
A$~5MDkQR#KQ[?>l_ISyzIt"
x|ts
&Eb -
]mQ)
Bu[0;p|
Wh [
jg Z)<
bz$`
^ow!D
RBAm
`1NL
7=+,
9U#NH
l&
-MX '[k07~se<//wtJ6=kX6p"
$E)
#u*x
jo&?2
tHwIw
N_-(
G [3
o Se
FreeHGlobal
4!78
#yA,Q{Yt`E$?/*\r(`+ohh k
wxJuV13o~t0yn^C%2gp["}j#
K; A<hXX|
<n1wD
D!`BAY6#pKV\fo^SoR![J[@{$
^koQ&I
,<\;8
.oy!
+E=JRZxux{;6-QES`K[~wA[V"
-:]P
Bv}ct
N1!;
E%m
IrEM
&% a
4E2BE99140D24066CADC84F74FA899FEE5976B68
*X"
MPh u
! -N
p,>h94lO-`}pr%ZEQA'sYCNQ"
kd_8W
GK89
j'%%
iE
%>J$no
p'_k
|oD7
@F,pv
RuntimeCompatibilityAttribute
&fK9XP-X+
.KXa
+R(+
X:ns
i)%)w-csk{shVH~}^Y-{*S *%
1nq4
ow23
Assembly
Irl-UDFroNI->kMcM@K]5QFb&
Et3$
6A-02U1s7>+"8OZ'dQI-kyE^-
mp>9
`bvI
sqU1
p8@_
(M*-
gJPJ
{)J^5
lPX
*|&_
\tqM~pw$ \lS\"|ie#4aQR5!
/4SR
16Je
rA*)
IPpu
Q'T!J
1}a@
qM`,
_N*z
TyD,
?&)&
L2%~
r \m
1eg\
*7ljH
Invalidate
|(Li
j)Bw
zh&f8vO`(BcR*|"J"z6wSh\,$
}8 M
fiQv
cMfl8
suI<7-7gY/jeY)*/g;94^h/n"
m {%
)1W"C
vr{
J.Qv&Y
!f wa
!< B
U2Kx
`D46
Size
^|-`2
1;s'
Io8+
+]|y
? o"
nCUgM
NewGuid
\)DP
RQyo
\1mR
P_5x
~aj[
w;@]
Uc-xuEa(J2(1!VT[DSBY,KJ5"
2@gu
gX aA'0R'P&(/4ZN\|*4JU-[%
NDaoD_&7h40/}s|x$R%=i4D01
g"k+
,ue "
?qW?Vf8^-49R_zk=e3aI)9<M"
>8=]
nIC0
<Lt~
yOO3C
]) $
&a5xd
W/V{W@EYshthD00*%=0}&7Xi*
e n1
;;Fq
c]gzJ=NC~)#$@!'>Bcr?m]JT0
ODaj
%@#X8
v Icv
+1PA
IContainer
Y>}U
dL).
46ez-tQ<,ati<5$p|0=dw#F%
s[wQM
d#$O
FvJr}
/&Z7e
hZZS
N6)LY*
%=wYYn
U|W~
l\>;5
08)S
4h ^
HT%
Bq3 )'
E F(
Bj- <
l^g
sD3Y
KoKS
,W;wtk ,g<B+BAX/(a~'#a*K"
zYxu@If/<:~`&Dl,*",|aQr&
f;Lz
ISerializable
>i9{
c}pK
["J3d
> *To~
?S5&'u
Bd|Y
,h:k
% W?V
Z(1
\dXx?
i5Jj &H
Edx3
eG L
/B>/a
\ R}\:oD-mcKmD&v9j>yP*W1$
k2q{f
F(f+Ym+
rD]!H
7|>!O
xB`Jg(`1fXW!/fDH:_KOu&0I%
^U1f
\Q)Gm
SHL`
#Blob
/9H >[
=eXq
PV4y!$k
Nts|
fA%cv
get_OverIndex
4}B'@
;v@jT
k-zQ7fcI
ni}*
]N5k
V~],
+ qM
)9*X
cj ,
X8rx
XLQ
\4Go
VL?tF
B*7 Q
\2T/7
|55As'vpd
GZ-8
<0-5
}ONK
Df{9
QZ ~
)
2wfXx
]Qk?P
)|t~o
{qk:
VnoE
>@<q
93m
~Aw3.
emj^
#FN<
U gKe
5*`)
v&J>o9D*Oh9d3zhQg-V0tgqV!
%!n^%
ti#g
lR v
OX a
s7t:Y
xpum
'~9x
hf2\
^R ACS!"\}tR=??j?egGKb;o%
/o*xu
r?I7
jz(
Z{_n
[Y\c
k4F#
L}H=
ReadByte
ru*'`T}Kr8\-7"]*3T2LXa%?%
~TgmU3
3Mq=
P*BV
DCS$Es$W)_:i?8'_8z%0uM`q
Jgb0<
{H&|
CtC T
6hc
x)Lm
(#q"
3F1764884A245F1B3FA91DEC2E25339F23787561
Lu=nE
eK'Z%M
:v~+
V?#L2eGn*"'aC7&z?:e8"S#}$
;'a?bO=?wXn8"dK[qfSp;eb_#
D >f@
:c9e-
Z7 '
/Rx3H
G6p~"a@
d6!V
zW+$
&695
xm*0<
a\ zJ4[
_=YI
H& ;0
SSfd
> OUY4
^^mL
CfM(
lk[*)Z
U,E5(
Bbjy
' 9&
l95y#.
AssemblyCopyrightAttribute
ir3|a5
jm"-e
:)w/mhbJP86H;JYK0<fg'^/R%
]h.gd
UE8WF
KpA{Ap7_dd["?P1y4H'#JgJ;&
9*t'
t<c
#xw@
wi8
v-/>&
gm L
n/a>
7qp
D-<J
Mh, v
a 5a
~G">N{
[JCi
M 0
dO^@
MjIm
dH0]z
YDu:%
+<=
n9zE
. u
q_2(mO
(Z<8
<w2F
">3r
0~:a
T?Kt
U!wJ
Q@w%I
Q>~5
]R 1
*?)G
h%ln
/#}^
YEN7U
4<;}=
/efs
+Qz-
5\dWuB
Cr(m
D4q
oeG4
ZjhSa=L
|-1%6Qp
dX5LcvH
b81Up
tIwJ
Rh0jET
T0<"M-KNQZ{R3}/0_:mZ$?Jk%
vqh.
J'HrZ7|~4:Zpl-nc}>r#Ta*W#
d2c4
x]%P
\dx"
[ Ad
Y>+ %
x>%1K,1e
KK8p
GR# ;
^X_e
@EJ?uD
9aa z
3~:z
E* z
kn=*
@a/V
8q". uKIt
4oCB/p7ig~1[rI{*!h<6ppi
(rE/
5MetY
ControlEventArgs
#6% c
a\K%
GJKuO|
D&r 8
KA6A
nya&/
b!BC
|1"R
cN#.S
V.kA|!q<|
}$1x7n%fVt}/:3z'!qK`tq/O%
9nbU
q,62
set_Enabled
5n<~
UKYW
S+;~
oZ4
'`t`
vHvnG
^s_J
(a+G
si' ;
Read
D{lv
]hbg
{HXC
\u <
8,wF
w O|
&vp-|
v6'f
z~zo
<gj
3U"8C
c CT
D|^=5l
d,1t
6fsE
!'XE
G!dR
o i>
0y.x
YmO5
~ I0
D#j
get_Value
Dp('@D&
,]4w
HO@M
{)L>to,
!H(1A
&[xf[
-xB5?If
#:6-Xq
{h6I#
\m]ne_FMt}wzq+`~1XR5+ZqX!
2wJa
gLsd(
6&Fqc[
aU%
C(
'^zS
R}_Y
5LON
_rS,%y
;$
Dbvpg
gKi@
+N 3
cpQ +
^.O"
Z*KB
v,~
G1.,E
gAMA
xv>P
q9r
-52g
Wibc
e;.q
t2V~8(,,3
{.wl
Q]pk
X}oc~m#
set_BackColor
"#}J
$M #
7f](
@7ug
7wCL+
*w.s
QZ5[lCvdJE[|=je'T-Ni(z#k!
.cctor
x8ww
~!~bo
AsyncCallback
-tCch
Q"YQ
"zC3
K1*b
5}6[
mscorlib
Ys5
F1Tfg
[aJ3
-a3.~
8Q#"M$3_A9LAkaaZ3W@u{Q/)!
gT(%
_XTT
13dR)+[ InYSsxgF7}il$hgU$
H#)z
~Q0=c
eWlb8
VA/NrW,/e@an"e v1i/*`$!x,
G} NM
:WX
T].1
&#Ue
m Jl
3j1;nj
iD'o=
.D&a]E.3
5J+&n
get_TabPages
3Z5a
\+D42
(x]8
m JU
(A+*
tI'`
I)E.
*> .
gTe@Z"CGfA:Vj';\O6\*@s-M%
<"<|J7
1 ZCW+
~.Rw
q$7AVS<@$)=KZ#nF<JJ)kFo)'
Guid
1_av
*PaMY!'04%)3Efes _RGw(i!!
? T7
eN3Fg
gwn=
~m>w
qM''W6
2IXL
~]pL
R`n
qJ)g
8Qp[
kHFB
)[vJ0Z3
]/m_
#b?H
eGB3Dn'9;z4:4]@BO|),F92K
x ,B
~gib
tEY7
_ Z
cec|Z
System.Reflection
i%ht
/efn !
des .
sSA7
~#t$
uCHAI
_G[O
YRk:
GP&
RuntimeTypeHandle
8m{u l
([$|
&-WJ
4s~#
9mmy
*Dc66K
OW3leq
6%&
DBrz
eMD%
MW96
'bS-V
:G6T
n Z-
t4IZ
>X&{z
3WA}
f18C
1p[a5
hqCD6&
ZZBQueSE""E*r)oG'lXAFiBB$
W CM
|d[v\
$dr`
k3)$
)Xccl
Yd#/O
PjU~5AWBaf`Hs6etc6`Qkj0S&
<i7E
fc5(
sender
%(i1)
S]:/
>IRO
Y '<
-sa0<
S\#
.v09
H@_t
f{ B
[b@w
m~ktw~
Append
91(Mz
Object
i-~t
G ~"
)U<`
<b"c
?zKG>
+L.H
#m6s
System.ServiceProcess
op_Equality
s7!Do
XcO}
y{ ;
r0\s@
U5a`E
tGdWD
#*]#
t%0M
Tcj{
tA>
qMKPM
["m|
mNj?(
m1[e4;
|1Es
P<wz
QD dhMY
\~<3
'IYq
?8Ie>
1<-wIgv
XvWITB
HKR
AssemblyDescriptionAttribute
zJqW
&|$o
D 8r
Fy,
1/e=
c 9aI<
2d )
twwstLwm
RR 8
4\%?
dtt%
[+/k6{
7UUR
O1\lS
icqI"S,eMp1`u_~@0*v,+0kw!
2I'
e 9~
2F M
O|WO
%t'z 61
;yI00Z|
X >iH
A4CR|
:}Tn
2 +
, *
BA m
*}%(7
7vUi
e }]B$J#4
set_AutoScaleMode
-FQNn0 |hKO\ w%l_x-qrK/U%
r]Si
L0y5
@7^6
dt&s
f-"o
d?F~
,]WK9
;MA7Z
= ek
%+g k&|
4;x2
xgB[
K ?9B
\\))
An|
@XD7
(@PgGXuNxcPKQUqL )@;ZlDq#
"9ey(
e9"jHRr
EAkkWF)+~PD-txbnZ,Ow"w1s#
`(WBb.
\UW`P@
l99)e
;&Y+Rly'AdB@yO5>jeb+e O:
T>,l&Z
!z(@
j7V%m
p:N,@
uf`L
|gR$
K>?W
o'M}o
PiMRL
|T~d
#qhW
b^@B
5tJZ
xwc?
6]^/
Q-M7;EH
_OKH,p
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
Qt>\xA
i}C {+{O
[LZl
G>X|IzL_lp@3ZGjBKC/aClWP#
TWMQ
<M bciW
4}>
C;ov
7dYON}*?Z-S|4<%P<HLD$vM8"
sd+<+CMn_cH8 3SG7zy3)]Z0#
D?3fNI
b?
8c\
!4 U
\h%lcNZ R31Y/mm{~{sO,7V~
{; U2L
m,l*
mscoree.dll
!This program cannot be run in DOS mode. $
kl]>
g<VT3dytN0IZY[;!ITyL]P6<
^C4I
]|Y=
2/sb
@$ O
RGmI
IHt\}!8y2VyQBal$MTSAeA4'"
uo v
, -
);a2
2|1i
y2H
_ Wh_
E 5t
?y0f
i!t3{YMp|TV;@*a0'xK"1&qn'
/(5-$
7ikw
l`.H
Dispose
7{\G8Q
dvBSo
=/#U
D-'Y
9.MQ
)W$0
DNh`
+H$io
AB '7
3X)#
: Se1
|^9
6D8a
L\qQ
v8g[9)jW,^ooM\! mP^/vRq"
F^$%
b*.8
uc J
!o=*[
GO]CZ
>C}/
SJy%rq?B7Q/Z)%HJ3AS`yp3($
?i Ga
c7r1@
0uTa.k^%4h
, > L j {
*|@_
n.>
aCUP>5
)~5j
Ph?C,'S5h_sN#u6QAi@72b+c
r!u7
ZQ(r1m
dzz>M
8 ;j_
^Fm,y
ukZU*);UeP26`c%7&{nj-`x=>
kM%
[M/l
y9Me#
VnFY
r/a:
*+l-
ch[
Cijt
6FxnW
< r
AhMR{1$D3n@6ui,*3gEt0K1q#
-<X>v
O O
x/(1nLV,09b|qxhB^M3sPQI "
u.ax4B
w1jq
}YF :
*_{zXU
va 8
fJ}R9
JJZ
9Ta.
l #_
mzy8r
i#o.k+
hT\}^
Y0O,,
QW8>
tw7'
pK`y
Fyp]
i/n9
PdQW7!"9k=!W4SikeO|J;=GF$
m-b
#wt# ,\oyY@ -
Z~Qb?
BSJB
HMM0
RrXc
Q>&x(
#c; C
z9"o
![#Ql'^
Uz&NFB|c"c-i{?1P&+CbJ4WE(
>0rh
mqv}Z)#e"_82JW_sC/>+X"[v+
q1T>
moM6
55~)J{
14mc
]"Lu
Z0="
smVpy
FC`4
3"&;
94LL
sNLP8
n.(5
4D4E
xj',(
Q_d
s?~*m
!ec9D
get_ModuleHandle
Q8*c
Gmd)A
y/;\vWi,3p&IFdY/G7B,47NV#
DQ2w
RHdP
a)5J
>>%k
d jM
"ye5
<9O&
X:F(
)'_;
7pN*q
IntPtr
_]{0$
h3<6
Sl{/
<VH'
x#9#i
<*tN
>i<s'0h53q#DnV]#H#)5r]533
>l^a
>UkC
>$-W
@q
('0|
q#"n
,,:`T
WQ84S
]$T\
o!<hD
Cth[
|GI<
4B2u
_AppDomain
-_cN
_ .d=
'ed9;9g
e"4m
5 )k/
:=5t
ZsD
eJN
7u1>(
P\$@
|l'/
LLQlu '
5=84ykKu
System.Linq
eE,_
Ap
evS
"B]d
C708234F139063BBE3CBE2208BB6ACFACBC50333
aJt4;
F@Xy
N`k"
InvalidOperationException
]zhu
lfU-
)Aha"
FG6
_=8
ZKrr
oS[E
'q6|i_B
-g53i
% V
8IF`
X<k,
SL&?
#g%|
?5#c
XmGx]
c _::
7Lv|
Q3Y_
=gXT
}ao?
q)79{m
_1> 2T
=^&|
mket0
}D2k
M4$
%mi=
df$hb
f/[
r46M
3Y a
@@8Q
85]'
bp3:U
BlockCopy
Px.F*
5aD p"H
n.e4
`h)h .\
fa:$,V
ok 7-qHvg7 JjQE)B'-5=IW;"
VM>v
lS4>0
vBh
D}j|
MdPE;
gv8#{
TVVss
C7\6u|NM|8Q>S ?!c4c7Bt)(%
8g9V!
gi~e
nOZEsBAr_KGCHmRqj(M3>lRA#
*,D1
r`7_
c$%$
+imS
BYg@
# "E
(a3Jo0
g<P
pFCu
<9($ViS*` W/ay*,VTS"9F|2!
D}D/N
#pe6
R`)$L
rL=?M
D9*$>^ZLYLSUX(EQ>#2IDT;f"
Tw >
s+.y"
{ lY
?m[D
_`'?
uvm3aRN
HAT7
99xi
u"\~0
!O}$
^Qvc
AwS
IAM\
!_$&
,-NH
176]
$<0>
XMQI
\3
a8_t
K:Zy
1dDpY
=]h,*
DPvG
Wl3{
VQAGi
<uBo,e>
S.=\
jBxQ
#qi\Q&"h=$xXv'@fKcvbrPYH&
)# .ATw
+76
Jxn&
53~^R)
W~J5rL"l`>XA`WhtIeSf&7(U!
^%Y)w
ei,k
[nD(
@u\kv
G`N
L&) Py
!7$K
nq{Lz
HFOq
<`J*
5|$ O
0WJZL24
'Pp9b>
> XM :
d8fBY(}Lx@M44nLeirV}9[8D
'q?
MethodInfo
hZq[
4s:N
iN|`
HJ6'
C)Zd
:,OLh
:l$"
DR= P6W#
CompilationRelaxationsAttribute
N&F +
<nej4
H[ ]<n{rx[TLkC2=np|_%2<{
P>It>
28"K
TabPageCollection
<* 0R-@pm-yz5w`&CC|Mjc/f$
tu!3u*ykqURJz+z1,)\u47/,*
Ix%./*
02yY
Yc"@{UP
$io'
MemoryStream
~| ^ <<
~!f)
|TAh-8# TVf=;E[=Nz>q9'32$
tfO,
4&Dv
\pp]
e0XQM>W4
K=VkM
ResolveEventArgs
;=?P
$H9~
l_!z
SL&
L%X4
_Pb)
IQEu32'!yl_8' =~r}f2z`\O
'91c%F^
#?Y|
QhR?
r]vj
:O@mI
OnControlAdded
>p=kk
M$@-
2?)?-
<o i
Z`W&##
/1<*
Otx*
J tNSM
6#ce1
f-H(P
qj-Ph>:
[6Ba
XF>8
i) y
O<Jn@
#<e3^v
cRHc
6i"~l
*}.[
Q2C.L
YHam\wE)Xk*0|Z&;nk%WIs&|"
'F=\R^!
HA{6Nd
mq rI
ePPTf
&{og
09dE
w()5:J[
oAL;.
/)e<
(7 %.
`!)^w7' b
Co;y
\#!u(6r32^W"4fI|_rs#;W>_$
Ke& c
3E7"
59xz
Uo'j
a:tT
,(Z,
g!3Z
&ej~=^
wjs&
eGV5
IEND
[\MG
Tu~c^
_MtquA
^uF 9
/7ng3
zUuL
#NB _
M9C BA(
JDu9
= < < < < < < < < < < < < < < <
rAae
w)E)
t;q>^
qnQ }
PLl ;(
_>2v
Vp|.
4(b0
kWV.
(_%S)#?lNW;xnN/7_+o:n9H8$
(=DEq
S\C
?ejNHMofd,kVv^w[im6~F-_'"
MUz^
fST1
'Qm2dz l
y/On
4&])X:
#;B^f
:M$E
p=%=<
D"fi
<g#Jc
uG MRM<o
6p(r
hv3{oV
awm0;7
FKb[9"
A?'
.?C"
)e t6\
+b LI
[ EB
@u`ZO
Tz|3
,D9z
9e*8,
JA>.
7Q'P
9 yVL
nFl!
B,PD
R"*
BRi7
g~D&
Z]02S

`!yaWz
Mutation
3-_[
zuIZ*
)\_c
ujU@t#
ysN632
Rectangle
B #2O
K<)/
LOi5
` X
1 lq
get_White
okmZ|
*xPo
~ O'v
',gBOu!&r>,,_ft[u$9hHb!D
X1P4
`x
) ^oI-
sEyB*#
Concat
L`<T
8l^%>
'fFz
%`Ok>@fW!m^Vs`jbA6{ZBH7J"
y;)_|=?g"XZF5dvPLd| \@91
k}(,j
P5Y^Y
StringBuilder
[&W
qh]v
/'%[
-&2'm
P|@Qd
Xqjat
V=>>;
'))Fv'y*
\pOrzb
j+<m
>q0T4U
ZJAX
u z+
:N3<EC,]~)kH?D~@cz<Sqo]F&
C?&S3ZAx5Y(Kn3o#t#4-L:p$"
]iEb
mT}"
Fk*r
U S.
QFM U
91EK
E-soD
;sTk1NsD_>T|i#EU2^rUd}/i
/>&j
jrZ~+Ut
uy [
#B
(]6 ?
vE:*
;[`ncP
.1 J
Zlx]n
L`d)
%F "1iFHH3
48&Y
get_Hand
>~*w
S$09
D{S,
]"l\\4
uM4[gF
# k
?yE
5TyU
,u
n;iq
NvBZ
"'i4,
PP \
12hP
7jp7
d\atq'')wTK)Sg>8Ao[(pVPV!
o`c/
>frJq
jr(LW
B0BI
Y8j3
|[,"s |{y
wUH|
uqq*>;:X\L#QT=@6f$Vza0:V(
UIYHdk
n`{6
\nc^
J|JiRz6
IhEP
_},!
AssemblyFileVersionAttribute
Kj>Z
a+xVD(y$ZzyoLBV4'(qc+4$h$
J?I[
Z fuH
!`u:
E3nKF
G zo~0
P `j
\bzo
CFR.
?yEJ
>:s<
~;j!
L'{3
+p:iQ
5Q=z
'm%G)&Ge6JdWY+S#s_{O{& u
k5AP6
?|Vg%
f@S&Ryfe/
c=`EIC
Tu(
w^YR
\|2u
v#Wh|l
Lm '
QP y
z`/k
u s>
:)O%gxU1O38^K(ja{cyl6kcy
$H/s
\7 1 5
,BQO
p|5_
Vvs"$
GetElementType
ZcB
FP:=
y+?ld
$7adfcabe-e982-43c7-b315-9eae93d19eec
e)aI
e.#(7R
lR[I
(jZ|naD
"#0V
(+
TV]w
tTVp
-pDUx
}=LyH
y~6~
2.#G
?86k Ki.
%BKf
4^:^\
dKF[*
NCKhjj
"X}=
xYji
}VS
o z_
77]n)?
Z=f9H&\a +p6|Vs,_Xfq"R#W"
?8)%S8
xPy~
Ay@J
rD J%
m/dCF
K2zA
/~76xi
pB,tg
uW-4
SPV''Il'-`(2q^%vs9M?P<9r&
+7XfVh2&
mRM;S
Cb2
F=h=
6'I/
=$Q<9@~
\ 2q
yJ#~
&u=Y
Ub w]
C6a3
8,<p
?Pk 1
J]x0
l3!"d
8@;
i2T7v
kJy`
Jvq,
Mrg'_E
FieldInfo
d9vv^w
Font
OvmL
CN)N
iQdh
0@vV
p _'
I2?i+M%vSI[C(xp]PMN$Zjws$
#P;"
Y*62
0
[\^c
|q,c
sa;P
ST/n
,N`(
sMi ce
,*Jec,6njg}`b(isK2`h_T},!
k)*n
xU/3
b<
P+W6
`s |
Jz1H
String
)+
uQa=9
w|9/
ICollection
_CorExeMain
s$ l
v_,mx]
[!P-BDxc>Va8*Ju:8IJ[W>,_#
5 q p
.QzU
JrxF
*u=ORHB{C'uS^(Kd_T3yZYyg!
c8vX~
mgj8
n91
A,8j[
A.WG
6^f]"k
d-`
bQlV
|6I"
LU1m
6u:)eVe!W;u:\HkqUNhZ5T_m
;kpF
Tf48
#u$
"HH)]
aORb+ X
InitializeArray
TAEQ_
Yx2SS3
>k9z
#k ;
HA8>8
hwX /
-LPXql]z
6hn~
\,%
y0S?
qd:
h' 7%
KeyI0
&OQ
b!T68l7
j6'U>v~=O%y9_YkB0M,Lap9I$
ToArray
y(Fk
*L#q
cSrdP
I_"O
fu6@v
OnCreateControl
S ~6
get_Control
S50(
_!hl])S`RjA ;8sp"?Q)e8g3(
0I1~
m( s
C(Uq
I* 2
|H'X
:m-3wBqk)x>Jv5>"5nu!%&A8!
Cursors
zVJK,
q)nJ4
ContainerControl
QMjsc
=9I]j
'_w+
Cs/j f
0s=O,|S \w@0<D>A=NmbIP!2!
get_Hovering
|X[c
>K r p
'o4
OcA{
S^wmE
Q o
b?%Y+v
'lRG
t/x.
RZZ)
At[0
zE2;,
{ a{
*Vl
&X`@`X
Confuser.Runtime
.OHu
|Uyt[
0cwinPfF/^
z2 "UZ
},yc
Load
0{z?SIC
0lw)
'0j I
BA^P};5BG1EDA/Wx%HC90w^S
=]VSPVCtohZY<TZ(4(T iO^w"
eqH`n
Rme3
8qlujF@
System.Drawing
vy$|^
Ih>\W MymQQV9gG1-U}7m {,%
yf"=
M{,!q5
&T*>*
get_FullName
B-@y
8?B 2
[70
@<x!
f( )h
ch*;2XQ1
,-$NS^dM
~3Ix
'co4Q
lbp')
[\D;#
BeginInvoke
0uu`7#IT1%:'^I*zk&S&z5)S,
7eJ
aAxrf
IJb{
pAf/o
sv_$m
*j\;
zcA.
p,;
!3n=
yv&3
;EB8
)kpX=n[2iSoSYEWS+/49u_EO"
1Y,9
^Wa
P!eYX'h m
X;b=
)KNl
oF'Oa
y=XgW`=<"gtBZvC'l_w:u,*M
WxZ0j^nEnEJy,:qYamEnJGm\!
xwK?
6%
[dYx
q?MeU_6m\5/vZRJ~fb#]`(#O!
[|\
@}YE
Q$1
=`vVA
c?j{
dJ"a8"h
c Vx]
0#'F;*sUa5<4!Aj2]vO&nqw{
wx?4o
E;u
D|1v
&q&JVA|
0yHNi7K
jc;<l
(:;o
!3ZDa)KX$[u"X|bI/&1jgDA*'
RuntimeHelpers
R%Q_
GNrI
*R\]
`h'Q
E(v$)
/ UmA
05qs
$!o-
JfQk[d
e=^WZ?\
1mUKO
UserControl
c} d&B^
N!4Bu[)Q6;)<)a"H_iOl1c6X)
get_Enabled
PW|EuoOj)nf&R"w/&KP60gBR$
IMHfxu
gfju
nZDTod
*Y~w %
0mb7
Srj-.
` $z
oX
!`t&
bI1
y9XJ
JaK<
SHcNSM,/}
[>"FBa"
+u1CT"a7
beC~
`=&Q
iAf
F[hyN
N @w
h-LGYVH|G_0BF=6Grr%B=31}$
iQ _p|'7p4
E& X
g'V>
8{x
(U [
YTh#@A&K<}*CPYB+*>;_|bo6!
ComVisibleAttribute
%GQ<
;PG{
JkANA"1'@=H)Msl'(pZ,x&oF
''?^$
?5L| [
+>bku
&:/B
|e8 U
|nw. E
DkR'
R>5X
rV ^
VaI:
C7p9
32C[v
hRoem
1BIA
j[ZI
grC(
zphb
lT16
QTptS~CUeS
X'vN
iN]Pr
_Assembly
pR]"
JoJw
f4O*
wrVsa
CF KF
wpLVT
bpFj
-)rS
W1FK
<0q[*
k`}H
S~S^
k\f@
]=)9=
!]D3
uTHq
#Eeph:
AssemblyConfigurationAttribute
(KM
<Qj^
{gV-!
I>xY
dhl}
m_X[X
1-_BEHpVt}2pP(1TwMJN>WTR#
Vk:d6.
lhw?
LOn$
<R,{
z#/;
Z%#m
OnMouseLeave
\\9Cm2zu=-"W^)L;|-b^p,u))
1.0.0.0
!\jp
m s4
y->S&p!}rcEx\VHVB,T%wD"(
TF+Np
7K8*
"k)W
@]f-
0+Z~
t|>;Mq
7E+ |
+s m
t^g'
@~ZE)
eb]n
|*!=
$ttf4
F>}kI
W|B
JB)L{
~h?)U[a
Iul'
Ej<#N$x[X_$1vOey<-Dd62kf!
j6sP
PNj
m+?,
*8 Q
Y#Ka=
,SG
l">D
Po%
Stream
wO#{
6`}
RdYzK
Z!?_fd {jW9=R|su,AtG4t,}
< f"
Y.iAO
sRGB
\ Qz
7[zm
k:jC
6IZ.
V %
[tPD
(S=p
3S~&
6-c*
qhE2c7%
{e-J
9c.-
HOS
CreateInstanceAndUnwrap
ClN
pbM\ [
K7Y]y
7l]
?iBb
5T%W
`A#zxyIxBYxY[-EW1]LS4(eM
l cCf
AZ=E
[E}!
z)z.
q nl
U)J1
Aw&Z
1}2$
8E_>
94]'r'
[9
o/pO
.re[
|=77*/;v^bMVQg~D\A~SOvSA
>9{k
!(jX
A 01
& 3
H-7.x)
=nq)
RWfo,rA
cv}*,2]7/Rh\Xe^`M@@P]N#,"
hZmb
` l;D
#n<]
lj!
Ob+5d
v?W}e
NwL
/UNL
cf#a
CSEy
E=gJ
ZA]
z-VI
*B\_
ZRC$
~XvR
mGxK
=1E@ "
a:q8
AllocHGlobal
GC{]
"#y;;
f0 L2
*# r
/bLS
-~3a;y
8P ^
^p V#
|5ug
(9D;d
%K2%.
7Sg
<>}bN=9PL/0%EOd9;I)C9*w`I
($Yqn]b>M+(p~m,9Md-<C>d"*
tv|;95/
7:C+Te@
#=3X
n&r)
l:GO=
set_ServiceName
O od
!>Q@
iUDy
+!\i
[y]b
crQ J
['P~!
4@+g
t8]=
BLP(c
]8ozbE
/PM)
IM@p
? 9Y
;? r
wsxMYB
`#Gi
YJ|T
O@I@
zIDAThC
Wwl?T:
t9sF
RseD
3 ~=
Hzp ^
:!t
gVA\HB,=l
R[?/
,zqzO#)
jxGZ
y*:f
?)1
l\S:
n18
&*x+c
(xPvp
=I3E5R
mc?'
&m;b
0;N+sx
V@o)tZzO8(,Dn5Vh2Cj@|h[@&
Zk)|
-]QD+
M[#:nY
3M$+
BA;P#
set_ItemSize
B6$2g
A5NhR
>6"c
(Www
g.n0Z
(Th
Lm2^7=c
\,t:
8n`l
9v5c
SPS~
)X6-{A
OB1E}CK_MEg*$-'oBWX)niA&#
*:7=
SZ{hdv
oY`]
,i|&T;
t4a@
BG\
YX&A
b'@_H
Z*zv2"
,Nd8P
5coM
njl59>
}}N:
eI~<
\M%gb
GetHINSTANCE
Ywrt
lJ<c
e2~f
Buffer
,kwC
J4u9f
LZO6
pLveb
Y}cVqh\
:3_T
: =*
o/T=lr
1H'x
-JF
|}u9
/xpq
Fj`V
!mY*
0dRl
OXbp
?~m-
vKu2l
0IC 3^
0"<6
85Lww7
H`M%
+)p
2VZ:aI
$8#
0(ts
_"D 0
[ ]&
a-R{
k"}p[b
um0m
7G0x7
mQ5;B
)B9l
EwS4
+p; >
gvXCIq"qvaVTQzIKQAd-[^9w#
vYlu
,)irKH
eM#XH-X^X`C%d/~b`wXHQoB0&
l8KKM
W*p
TsC<J
=uW*a
'MYD
Mcg1
z&l&
ETp%a
1gC.
sI:!
BlmBn+
v/Zkl
%;8v
E3/j
H E!
?NaK
=;}uH
[S$aV
P |d
,,?}
^C:aVCi8][r)R6}95+xz"F! &
M&ch
ZU/<
P9s2
xv-.
1N"C
Re"
r_WyA
A>V2
m|7:( fu$&"z4raI>q(%['dJ-
< -fb
`0@IAB
b-nAn
#kp-
.!6;
_ z2,`
|%dn
3BV/0
IeZ|s% !z@
_xb
lAd,+
&k;?
K[z
l@8*
tqY-
QTz]
7hp4
sB/I
$iVbF
U<%fX
}& T
yZ%f
mS.3
Q},?
6Vyo
T&I:
Copyright
N: }
mB[3
ArgumentNullException
e7(4]h
2r~5\
`qB;,
fb5 (z
get_Major
:`UGe
LwNlz
-niXo6mjCnq<J_'E1OD*`kPv%
"z?ay
9OwO!
|_1
8PN%A
8/7C
1s j
Point
R=1\
,J(+
,iMD!
%\N*
:(8x{
QQpk
+t
USzI
v2.0.50727
; m1
T-{F6
YesfK(EjTMy@`e~1j#-:8%gE
<[#q
`o-
~&7?8uVKs+>y#tq[L%/%Cq/>%
n7q
d>Y7
hEgd
7#+>
T~,5G
E7H7
p5wb
@ '9
e]fsF/,#
6;Q~M
:Te|
H}[B
fYMO
TEV
FLl?@m%
8@*1_a
Sl>g
^GQ7
'<m}
=/'n
^?+
u_%l
'M^S$
Qr
^\1 }
Pr+Wu 6U),J(4)}fEC^#}QA0"
%[@a
f:=>C
I8(LQ
_#Wq^N
t%!'
L&| \
Exception
!Aj#
39D_I$fm{,[(^>cp{OT_'GMp$
MTiW_
Mtpc&
,Z:*
:C"1v3 |
V_-:
Sg)s*
|O{ a
Jh `!
@-yp
&&U[
u@&xc5z?;pjHSZv^'O-&X9"H$
WIb6
Fdbn
a)Dbe}-0p}Y_YPej~<N#%kKO#
m}-i
>KRiW*Q
n%kQ
ugt:
w+}fd!$mdfA/IzAk>bwL?/mP!
=U"'
L-1
Lk4;
B"D~!
GetTypeFromHandle
IAsyncResult
~A[P0
Poco
E 4&
O\f&|@
a-W4
8ko3
9$,pp3_/Ga0cnF7i)}KZk02(!
4<:H
System.Runtime.Remoting
jL0'
gA&8
i4J
]/b
4OrVEYU
`d}|^wH1FWmjB\2qo?|Eb(a$!
GetDelegateForFunctionPointer
B 7 /
<;u9
`r8$n?<+_91c0<}|gJBLs$N|'
PTB-
dw]
7cZR#Y
4*Xy52
L=(
w_eW
n\_`
~Bhp
.y<s$
nI(47;
qPx'#
@M)U
u^2Ud+j~$J[P8VnZJn}5yH1n"
dBu9
+x,lf$W"o`ya_1~L'`pIC"c1&
tv"R
BB} XC
zSX
p`D
dKw*v
DZ6#R-G
>5(Z
rfZus^
E<n7
System.Runtime.Serialization
{ Cq
bF&
< /L
QoIEhC
ix$c
9t]YV(@qC!X9da 7R~Xel@(+%
A4rb
SI n
@}x Q
(/03
LfV7A
d-ypw
}fA9
1MOi
{e0J~,*
lW|c
6QdA
X0hnk81g/|8NL{drAe5)t>'U0
OiP"Z[
igG, Wi
3a$/Q}s
,I8
q)$c
~IDAThC
EiCq
%/yR
(f7V
tD,y:
& 3Z
5[d8
|_{-
XK(.
tZW[
System.Runtime.InteropServices
5zo2~
"6 >V95]VI>|{E'#'Ej]y,6z%
gC]J3
|oT$S
'=rZ85uPyMn}Z4HU&'N82yJJ
;Xjm
Math
^'Y.
#mPt
nY;O{
INi
H;S
Kh3T
h$_ (
f`86
pp y
=#? ~2q
kczQa zm|-
F^Xa7;_
@6&
*:Ml{
z ~8
PLH.
zfE&Bp)Op"= y1a{kY0rc{T\"
./ Gn
bz~0
T9_J
aQBG
\iwC
` *mj
HzQ"
n[Rm
$oX@
JRznKXEw}4yWkW7fQ>[\is8@%
BIObU%`wy&SCfZ/(=;)LeU`'(
.)|t
(sl[
`c Q
,>z.
OvWN
SuppressIldasmAttribute

_l=|y
OxW;
-9W(i
$lUP#n
R?(;
uSEO
7K27-*
/ZZ3
Ipwt
Di"9&\
;">l
/k/!
@A1'
CiSe
d `}
i]~f9
kp^X
J1cM
XOZC
^[BZ%Xz_:[l`=C7Yo_->@J=h"
Sb]
^ bs
Dk2:
=Gwg
D 1@ m
x33TY
bk|NsG
mNLL
gF*{-
%(V
_~}i
KW0@3
9cC)E)<eK
!!!-
v,6A'
|w&#O)
|IDAThC
dnkT/(
,W7m |
7o=D$
nXUG
oF?*(E
^2N!It
r\Vn
n6PP
mPZ#
:[J T@>J$
;{Ad
Pc0a5b8a@0;#Xb]So}=Yz}S8
gq+P
set_Font
hxgxGD
ETnKJ
[C@Q>0
(*n:
m[8G
#xkE
%P|(>
s,T(
Qo}.
d9"-8
enFjIIFe<#2w|x9\uBm9T'Wa"
]%58
hNcg$5{
t=0`
h ex
!U|{
IDisposable
"K:R
3!e>,
ys-W
'uTfr%R
!2-'\sU\\
q1RFfS
o!nT
CWqj
C \ :
q60k
ez{[
=3SPGbW2<Mh:?<XAAi 3Zf{*%
Jb
tv)ub
x7E4
.6U s
:@O7
pV\Vv
Nk-
Ge$Z
tH<'3
}*BC{zH$6n;<iN48'"TmNEeQ!
uv1_
"HIwK
=X}.V
@GY
vnr
8w53
JzItD
8L9!Zl
BeM>
TU2G
9~ 2
4'y$,
7? j
B\?5
AssemblyProductAttribute
K+cLkKW~}n-"t}qyKD)15nLd!
=R,k
"(xLs-
C$$@
-s>L
^8&'"
V8q+XEK
QKA:s
kKU\
<Module>
(MTY
^)i)
^Fk9 X=
Z6AC "
'2.x[
X+`Y
^ P9
5Ig$Na[MYEVT~{e!9'n@N}os!
RR"'
E;6nt
)LT\c
d&dPp
MulticastDelegate
~Nv4
LIFXB
<s|oa
#!u^
-cD"
HH:x
e 7(
Q}Dgf
!m_pData
lB3N
-0Q3
,C{\
value
:4.y
1IoT
ppNz
Q =E
2018
IM#Jj
QZ$%
<Z TkD
9^,7
q9^/>~
"z,o
Q;8a
n1Ih
\8FH
tw^\_C6B>N#/|9,+H)kp8x*'C
\MI
BbD%6PwRy4(W@\&,N :7mO)M
?j;/
NE\Z*
OnMouseUp
t 17
3n!
\FOL_
[.ON
CK5u=
-?/0
>pJ?n
KE{g
#& V
'&-:K
5 <UA
S5Qkv
y7ff
`YOEHk
O~sD
I)2^
vin0M
#GUID
QcIQ
1zb$(
l5e1
!_Lh
xdGwfT`
?w6
=]aV
set_SizeMode
8^b-a
{}jz
mSK6
[Hj$k%
El2@*
^8!O
$Z c
@Pq}
=H>g
E+5^
FxU+
tq7;
-@*I
c3L{['?41d]_B9X?,38jQ;F0&
5}g3
p6ET
>Q.K:.nbUI
'T8QiF@=^W7Yn}'u\1G6Z=rB$
XyZp
$BT:
*(;E
~r-L559=v"Vs6b(5lMN58wWk#
/":J
9{_[
ql0r:]ld{
IDAThCc``
8D2g
T~ j
?K_?
h-I+
2u=v
-(U|V
I(+P1fZ07E)Jd828Ar8j-Ga_K
b{50
oTNc
.2/sa9i
X +U
+.RA
lg)a
G^.s
bV.e
Nullable`1
Zby)
]:5G(
$N1D
[^wk
S}GG
,=|6/
6Y{~
c Z1jC
+p'MP
;E}@
hAb$ro
%ZI
2eW@
s(#{
]
6jE"
R9oND_B(oFF]/N_{V:R^&W&f!
c#qLr)h41#K^e*bWlBVq(2@F!
_e}ki`z;$#00xYHM)`joyssF$
}
6!oN
4f@7
7yk*V
%,pT
g$Hx"
JDAI
get_HasValue
w]zv
GO]x
eF[m.
c} Q
Ty*,fD
^qLk1
}d+{s
Gtb Zft
P<?s4
YBrg
Q)\uU
3ryv
{p>-
8{"J
\(h%
Dw]f
Encoding
iL '
g)f$9
|KuAvwi^jb
Wq *
LT_K%=;oZ|A|"o4q6g<f=|E((
K.$nt
C5I\
=l=yB
|XP
Yx T
"[+h
|XsJ_;4pFT@"4r;-+fa;?0[>'
J^wKvX
/w!%]
lK#o
n uQNODJ
IEnumerable`1
V{ b
-3 &a
6 $6F
get_Module
w!mt
TabAlignment
~i|pO
>A3.e
n~i*P TG
vdoW?
~FZU
{k*i
+Kv&
_ !w
/L4!*
&fY-
E4u/
m)
]jJY
0#TL
V"XW
32|
J*E:
QCV1
(xtN
zfq5
CQ[~
wOnw [
;G,bF
h)O0?!Z)\w>ku>}<]?n;IH %
3;ml
"/81
F$e ([
F u0
vnRD
_tjx
get_Size
WAPm-)#f-sXSskg1S6y<+,Lc+
P&?
Q`Vn'c
wZ.75
y+ h2
,'lP
[{nh
\0jK
0$h(yx^jo?U;kFev7<&,mti"
R0$9
\K-4
66t=
UK/jk+
2<U"
<ac;$
{Pks
System.ComponentModel
3#2m.:
bQ1L
Ark.exe
|<6Zi
0+;#
>_Z!
~:Dw
]C~m9
oxIx
436534A617CD86B8557AEAA31D433ECFF38B112F
5(A(
dsJ;
?k@#-
bw4Y
O^w/
-SFi
agtBo
)aPt
aY&^$s
}#?5-[)8ZHS! DK%:Ck;P3Kz'
d'R+c=8
: Qd
%Xh8
3"v
/5K<
=;#1
{Kr`
cnke
O|:z
I Q;|
Tg&*8OK
f 9]
C648C0E55DD0A71600A3C979FEC05C180303B2F7
4YSM
H7w[
8]Na{S
9gm,
v"%^
.[~NjB
x2Jp
,H.a
2, $
{W|P
8.-L
C9+:d`>;OrK*&1=J$]/j7|[8#
GbY1
Tn>^
u26R
1JDo
FAS3
{O
'6gC
F?2
/XDD
8[vL4
System.Collections.Generic
IYklcu$_CV}GL({dh+[[$U}|!
5VMuE( o
:sT4
0R5g#
AFLP
m&i<
ServiceBase
\gWXz
P^lbkZy:0#!eLe~s1@]7o&~S!
}aultDRt
Yh4
bdy*
LjhX+{*SA2x1@#XO:%s]#eX}$
e PLrQTDzi?2@lKB/4S[^$O+,
$Akr
m: ),
System.Windows.Forms
%~~
set_Cursor
$ "46S
(UI_;
`tHb
_YQ(
5a9L
3mBL
*Q})G'4e"=G}*wkX%9ezU-:A(
{v]^
+ k UD
n2K%
qLww
EUQT
%3AS'!
-r3\T]
;X7nP<
B@89
WriteLine
|73=
System.Drawing.Bitmap
Contains
zb< ]
%4t.
1Lg
[]>Q
}"*{m
:K#E
Z9f[NI
v503
_na!38YnxOllbk;3CPN0uwr["
4Q!%'
[u}Q
SetStyle
mlF!
`9loh
g)!h
5SJz
+e6C
IHZr`
}>"Lri
9}V'
.=w-(
ywOh
/~T]
disposing
%-&$
o e
@ij &Oq[M:'Q/}N=@OB%0`s,
gPXd
M;/s
nTW
jtv6
HoMgS
[HSt
p4R-
F\*P
*)B1|
>3 lJ
|H`
a z
j(*| K@N04#,C2TW$6>bsF}-(
gI*i\#DA-xNQs:/<:TypPTaw"
+t X
iq "
!" >
w,WC
|*$Z
eKuy:
DisplayNameAttribute
<" K
%H{5TPU
T`0+
-jkn36(J~~taBed=X73O?Cu?"
r^Yp
z^rs0iw@||
_ZCmaF=
,g('
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven02_64 Seven02_64 VirtualBox 2018-02-16 18:37:19 2018-02-16 18:40:11 172

8 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven02_64 Seven02_64 VirtualBox 2018-02-16 18:37:19 2018-02-16 18:40:11 172

10 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\ded.exe.config
C:\Users\Seven01\AppData\Local\Temp\ded.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\ded.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Users\Seven01\AppData\Local\Temp\ded.config
C:\Users\Seven01\AppData\Local\Temp\ded.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol21.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\Globalization\it-it.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.INI
C:\Users\Seven01\AppData\Local\Temp\35302e83-01b5-4976-b4a7-1505176c22b0.dll
C:\Users\Seven01\AppData\Local\Temp\35302e83-01b5-4976-b4a7-1505176c22b0\35302e83-01b5-4976-b4a7-1505176c22b0.dll
C:\Users\Seven01\AppData\Local\Temp\35302e83-01b5-4976-b4a7-1505176c22b0.exe
C:\Users\Seven01\AppData\Local\Temp\35302e83-01b5-4976-b4a7-1505176c22b0\35302e83-01b5-4976-b4a7-1505176c22b0.exe
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.INI
C:\Users\Seven01\AppData\Local\Temp\ded.exe:Zone.Identifier
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources\Ark.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Local\Temp\shell32.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe
\??\MountPointManager
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2280.10842734
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2280.10842734
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2280.10842781
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe.Local\
C:\Users\Seven01\AppData\Roaming
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows
C:\Users\Seven01\AppData\Roaming\Microsoft
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.INI
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\8125dec6-7c99-44b3-944c-27e16dba35c1.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\8125dec6-7c99-44b3-944c-27e16dba35c1\8125dec6-7c99-44b3-944c-27e16dba35c1.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\8125dec6-7c99-44b3-944c-27e16dba35c1.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\8125dec6-7c99-44b3-944c-27e16dba35c1\8125dec6-7c99-44b3-944c-27e16dba35c1.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\shell32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2560.10846953
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2560.10846953
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2560.10846953

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\ded.exe.config
C:\Users\Seven01\AppData\Local\Temp\ded.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol21.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe

Write Files

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe

Delete Files

C:\Users\Seven01\AppData\Local\Temp\ded.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2280.10842734
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2280.10842734
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2280.10842781
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe:Zone.Identifier
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2560.10846953
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2560.10846953
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2560.10846953

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ded.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3035fc5a\375c7a1a
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index21
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|ded.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|ded.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|ded.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.ServiceProcess__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration.Install__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.5.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\337da671\3850e7bd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\337da671\1b71387b
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Namespaces
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msbuild
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msbuild.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|msbuild.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|msbuild.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|msbuild.exe

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index21
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msbuild
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Write Keys

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msbuild

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
kernel32.dll.QueryActCtxW
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
kernel32.dll.GetFullPathNameW
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.GetUserDefaultUILanguage
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.VirtualProtect
kernel32.dll.GlobalMemoryStatusEx
ole32.dll.CoCreateGuid
kernel32.dll.GetStdHandle
kernel32.dll.CloseHandle
kernel32.dll.DeleteFileW
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
kernel32.dll.GetCurrentProcess
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
kernel32.dll.WerRegisterMemoryBlock
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipGetImageEncodersSize
kernel32.dll.LocalAlloc
gdiplus.dll.GdipGetImageEncoders
kernel32.dll.RtlMoveMemory
kernel32.dll.LocalFree
gdiplus.dll.GdipSaveImageToStream
oleaut32.dll.#8
oleaut32.dll.#9
oleaut32.dll.#10
gdiplus.dll.GdipCreateBitmapFromStream
gdiplus.dll.GdipBitmapLockBits
gdiplus.dll.GdipBitmapUnlockBits
kernel32.dll.SwitchToThread
gdiplus.dll.GdipDisposeImage
shfolder.dll.SHGetFolderPathW
kernel32.dll.CopyFileW
shell32.dll.ShellExecuteEx
shell32.dll.ShellExecuteExW
setupapi.dll.CM_Get_Device_Interface_List_Size_ExW
setupapi.dll.CM_Get_Device_Interface_List_ExW
comctl32.dll.#386
ole32.dll.CoUninitialize
ole32.dll.CoRevokeInitializeSpy
comctl32.dll.#388
oleaut32.dll.#500
advapi32.dll.RegSetValueExW
kernel32.dll.DeleteAtom
comctl32.dll.#321
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
advapi32.dll.EventUnregister
kernel32.dll.GetProcAddress
kernel32.dll.CreateProcessW
ntdll.dll.NtAlertResumeThread
ntdll.dll.NtGetContextThread
ntdll.dll.NtReadVirtualMemory
ntdll.dll.NtSetContextThread
ntdll.dll.NtWriteVirtualMemory
kernel32.dll.VirtualAllocEx
kernel32.dll.VirtualFreeEx
kernel32.dll.VirtualProtectEx
kernel32.dll.Wow64GetThreadContext
kernel32.dll.Wow64SetThreadContext
ntdll.dll.ZwUnmapViewOfSection

Execute Commands

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe 
"C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe"

Started Services

Nothing to display

Created Services

Nothing to display

Detected family: #Malicious

TheSystem Itself @ 2018-02-16 18:42:01