MalScore
100/100

idi.exe

Is DLL Packer Anti Debug Anti VM Signed XOR Related 2600
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 510.50 KB (522752 bytes)
Compile time: 2017-05-09 03:05:46
MD5: 5ca5658dfc3caab33c85b45024b9a3e8
SHA1: b96a521996ebb974081c557f6aedbce024614339
SHA256: 1db8c54976418b0e79665381a08b96876280e94f75ef2efea737c92be577b4ff
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 5 hqt~leF .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-02-16 18:38:58
Last submission: 2018-02-16 18:38:58
Filename detected: - idi.exe (1)
URL file hosting
hXXp://prosciuttiamo.it/ice/idi.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
No report available
PE Sections 4 suspicious
Name VAddress VSize Size MD5 SHA1
hqt~leF 0x2000 0xd6c4 55296 2690179693e5361ec4879514e4e66858 2120676986545f73a5fe9745d866bf40d16ffec9
.text 0x10000 0x3dd88 253440 87408d89e519194120d77c26492cf2e2 45371faa2b25fc74f503ffb458102e6369a3d8f4
.rsrc 0x4e000 0x33a18 211968 0122cc95d9c3c3519f04ff35358a3277 b46995ad25af523497138017344d9e49a7cde8a2
.reloc 0x82000 0xc 512 4e4a67c1ffad72c688ad19cfcdc4fd13 d14eeb3fb7574ba336983085b070684b350f4b1d
0x84000 0x10 512 da8c3884b98792b6bef8967fcff539d0 68e0303f596b209249acb6097527889af6738d8b
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x4e130 209740 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x8147c 20 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_VERSION 0x81490 920 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_MANIFEST 0x81828 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: Copyright \xa9 2018 Northeast Utilities System
Assembly Version: 0.0.0.0
InternalName: idi.exe
FileVersion: 14.2.22.1
CompanyName: Northeast Utilities System
Comments: idebuqos
ProductName: LightCycler\xae Master Mixes
ProductVersion: 14.2.22.1
FileDescription: LightCycler\xae Master Mixes
Translation: 0x0000 0x04b0
OriginalFilename: idi.exe
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
No packers found for this file
File found
FIle type: Library
KERNEL32.dll
mscoree.dll
IP Found
14.2.22.1
URL(s)
No URL found
Assembly Version
Northeast Utilities System
idebuqos
14.2.22.1
VarFileInfo
Comments
36ab96d9-9a28-a930
195edbb8-ac8d-91
36ab96d9-9a28-a92
36ab96d9-9a28-a91
36ab96d9-9a28-a90
36ab96d9-9a28-a97
36ab96d9-9a28-a96
36ab96d9-9a28-a95
36ab96d9-9a28-a94
36ab96d9-9a28-a99
36ab96d9-9a28-a98
36ab96d9-9a28-a922
36ab96d9-9a28-a923
36ab96d9-9a28-a920
36ab96d9-9a28-a921
36ab96d9-9a28-a926
36ab96d9-9a28-a927
36ab96d9-9a28-a924
36ab96d9-9a28-a925
CompanyName
36ab96d9-9a28-a928
36ab96d9-9a28-a929
Copyright
36ab96d9-9a28-a940
36ab96d9-9a28-a941
36ab96d9-9a28-a942
36ab96d9-9a28-a943
36ab96d9-9a28-a944
36ab96d9-9a28-a945
StringFileInfo
Translation
Master Mixes
idi.exe
InternalName
FileVersion
%q^
VS_VERSION_INFO
LegalCopyright
36ab96d9-9a28-a933
"!%$&$-,/.2154647484
000004b0
36ab96d9-9a28-a932
ProductName
FileDescription
0.0.0.0
OriginalFilename
36ab96d9-9a28-a931
36ab96d9-9a28-a93
36ab96d9-9a28-a919
36ab96d9-9a28-a918
36ab96d9-9a28-a935
36ab96d9-9a28-a934
36ab96d9-9a28-a937
36ab96d9-9a28-a936
36ab96d9-9a28-a913
36ab96d9-9a28-a912
36ab96d9-9a28-a911
36ab96d9-9a28-a910
36ab96d9-9a28-a917
36ab96d9-9a28-a916
36ab96d9-9a28-a915
36ab96d9-9a28-a914
36ab96d9-9a28-a939
LightCycler
36ab96d9-9a28-a938
2018 Northeast Utilities System
ProductVersion
=^/4k)f_l?[!'ixN-zwlR;xS"
6mUC
Venn\`
+ Dd
RA8Y
^Ok/
#?)ct0[&&?b*aeq9HRcot,?O"
>lVv
SNwM?c
cw2W}H^,TA[t-X)88Kx7*u#x
Is|\&
("cdbHH
ZmB4T
sb_K
PNG
m,H}
f#qf~
^!,/b?
qF8A
ObjectHandle
UZ`]
yKa2
y;+
o{$n
5z!|eI
0%{W
TBm{~
[Bv+
N>E,
hEs
J'UJ
F;\x
ResolveEventHandler
9&N3
!`;HP
tjFx
yY:x
M~#nX1+38@2mEk1B3e:[fe}R"
cS&H
z}>4s
(4[:
^gDE|
7y >Bo
=5v7
{|Zm
1/6U>L
!awq g
_tU^
ZKA T
?[f(0kP";RG(3$bhzV_xujZu"
&hq.rs
W5Kz
=<v_Bo^Gb4w33La2#H5}B2)!%
kF6>
)L@:1$
=}Yd
SeEA
N/4
w]I^
1ULd
8S6*
><9o$lI
qW1gQU]M'@K24q18#=x~(1om$
-Dkt
?z_[
C*Qk~k
= < < < < < < < < < < < < < < <
_ +_
Y|2FUB
Version
+E^
SW N
8_]J8 m
V([0
KtdI
TM!O
amFGS
?."e
>L};
~M*`9
dRc}C
X (+
_Ht $`\
8o"sB/
Mhl
Copyright
1~.S
set_EnabledCalc
j}q!4vz8q
Psy%
=%k`$
1ol9
Xc
}/uD
R}h9
o0;*
System
V^kx
|CHOY
7.q2
AssemblyTitleAttribute
S"%r;![
;Mi&]
[y]f
>z'3Hpr
=+kLF
9QL8I-
wg(m
$ pv
'[G2
MM.Q
ControlStyles
Marshal
v$Iw
u sa
? Vy
Ycl^
^FtC
Ch<gA
4MfT
zMxG
M|3*=%
f<,&
pd(=
?NC'kKUp=lh>Uj\DZh(Kz4c<!
(7ED
?_K:
|/P_*
/7}lJC3z,Tkc B@v0PFoC6Y~$
kKx}
qs3/G
o:V*X
op_Explicit
RuntimeFieldHandle
SDxr+m
Z~i8
}IDAThC
402!~b0%D
2J0=
35/sD
7d1
*>g*
nZ&Z
\f|g
Qmi=
cy~L
k| op
BBb4Z
hco
K`^
xSdP
. k(
ZXJX*V
bD`f
ZXJX*J
EndInvoke
BPd`?T
bw%~
S(54Bk
CX}1
dT&U
z7H_KP
##i`
i@6S
F (q
I _L
r>L7e
G}mr
p$7I
U<En
+s#_yRc
N+?'-
?+Y6
&+D=
i]Qz
,:$L;_p~aFh@/Zc(?ckBid%b"
CMpn
Lkk HO
e "r2w
mB+=U
#QDh
\ m'Pq."
PhpG
(Pl/u:9E
]lr+,G5V K3P^xv$~DkVQf2*!
N7GG
BO C
mygk
.>=U!x
oKfv/
sPZn <"
set_Alignment
D_Bm_g
% _/
j^Il
AssemblyCompanyAttribute
_= GTq
L5&w
_+,c
@/:o
= Dv{
sy T
BDrL
Z<%3
WpJl
brVb
;~wS
Ds3u
%1RJFH
oLwF
Cik:
gP:[
AQ!+k
$Jjd
~ '4o)
,kb%
&f5
N,%WS'P'iA?,-&kkCFzK4@(G$
bb%]@
v>:7
V498B/4a7q17NX1b4s&^qW~-(
Enumerable
Az5Fl
5k10=*]n}7MD;NB(}bsRN5H9"
#{i[
ILL/4u
n6 VU|L
Fj$a4fBhv
$xeW-g
AppDomain
oR,5
n k\
cukn1UnOLuO&AY3HOJ,Imt'*$
}p X
'_lY]
3 LM
/W_f$Ea
r3;7
~H
get_CurrentDomain
get_Height
xvMc
B`8|
?fn-}F
HV_s
_K#
c~t4p= 2
/@L)
#;u`
Z*&d ME
W]_B
( jH
5_n1@
?bEJFp
Q,p=QD[
fJ9O
;x./l
w";H;A_
$i{c
jTT&3
Aws y
Dw9
A8>a,Z
Xwh
yJ2
#b2[qk
ulg4R"
CY0F
Ptz|r
Dkz9
'HO}
>oA*;n8
&?'"dQ(iUdhr7g?r6k(jTx89&
6J4C
q=+E/
^TOjdep
_ #8
AssemblyTrademarkAttribute
FH]{
YXb3
sdITt[
qCg!TG-a,{PZ>smR^#H'p8S2"
T\,';#_
]HuS
"F%Z$Nj
6~dg
B(?E
}]?s
_UY|g
2^6r
@#N;
3N5(AH
Dn-9wM]bF
V[U:
;NI[
V\mhf
Ig3T
!axy
&x_
7v8K@mc<DJJ
+z{1cA
*n =
0[:A
sz$v
^Zp-
F=b m
x`R%dc
#Blob
Control
&] s
yR&2E
@!J\
K9)>6
|;!Q|
H [R
GetFunctionPointerForDelegate
cT`=
KhNW
|na-/
J%M
u%Ydr
2& ?
_(mZV
b8-Y
xGXwd
#Y-N
pz5Z
;S|J
LhrX
|m$\u
=^I,y
%yg*
G3Qs
ZsV
Jo9,q
BOI3E
6 EL
BindingFlags
Rfqp
x(mX{.
aJBGt?FQ{#3Y-}nm {=F3&Mx)
Type
?CHH
pSA=
UieS
NB#q
v_ T
N@~/
ns?W
}&H~
#Y1V
riX,~
Nm<J
JSRl
Yngg
;hf>
lCzv
cY)O
E[0
T*>t
LTzr
+Q0M
:hk$
uIQ5
Cursor
7Gu!dE(/e~P5{u\B:EaE /M@#
8(m"y
-mFVg"o&u,(-LV\'7$pXDKyv+
c3o>
i\ g
okj(X9'7/3A s0Ngh_[*_/R"
rWR*
<4+a@iU[_93D mSgN$T(*#7V
4kpX
+ai:
~b`P N5$
\"Oh
@njv
JERb
Char
4s}Z
#@n\X
03^T
\@H $5
I7$y
;\@*
x/S(
v&X:
W'Z@d
RM|[w
_wiY5|;4 >aD_2Q}s9 +)qW\!
OlZ#6
CR@l
AyP2W3#f`aAyENWy/&YM+)U(
?Uv
GetValue
dhvIc
BK@?I6<K!)e?GT;f(Ohba{J`
,FwM
(IEi
/U}G
}Ub=9]3
Fl|H
VQ%p
H-<
[SYz
get_X
get_Y
,c'sc
D1=y)8
I$>?
UEvc
\:a:GF_!
~IDAThC
2J4ZRA
gZ$J
$L`3
E`W6
VirtualProtectEx
get_FullyQualifiedName
8E#,
@8g,
(Fz &
McYu#CaM@-Dek"1~$!<>1SFu!
;3{v
53v^
k_a{
dnFT
dI\
ttP\Mx~997K1-=V[O6_*{pl8
=ZxX~
lFT|
Z+/!2(
oIQns
$N}ll
v$12
f-H8
&7mKv
,t.Z
QyVqc
wcu -
E ~$
/MD?
lN*`
wEW5
JWh'
A;?z
g W@
YKI7~
1{&`[Y
e2e p
-DTg
&5.8b)
M7vIuUyiih*>1jq |eA;pHHL!
;Oj5
6~J
'7P5OLYWHuy#j?K#J-VO=:,-/
RZiA
\5lH/),/$
z#W@
m@G<&w
^t#?R
[QW\
.text
%1y
PnQD
[@;e
:/w=
GetString
C+g$*L:9
FW@F
"[D`_
J ;guw"ed8SX}'lU'uxSHQ@Q&
k!WT
&GF9
'Gq+h
8>6|*$P
lgfA^
}zp|
tTL8
^oIG6
@Mc.
n0>@B(X
D\lV
7>(sE
object
ZqYd
.)~c
EW&_
mg*{9
|kT[qQU
jXQ:
!]#^Ef3"M1vU}bK,,G%,UVPA"
}[%419,oa
lV}_"
^+H=_
(5@T
Dd^&
7m-ow
)zX1
C0)'
ofI
CZ=#!
>+s;
k~lY
FW[]
?+q^b
hX=`
z Q{ eR
i2t?e
G%N.n
$erG
zTro
Og+g
*S&
dDr;
gJ|G
e328ff89-42bd-36.Resources.resources
X(Q|(w
}LXv
]w chq
i3]@
`iouU\
g^-?theg7?*Y?|C,`O}oG@X[!
'wIz
k|~
)&zQd0
u(N_
,E%m
qq!O
uGx
x:no
6C%p
k]iZ
aC'8
' o&m
T6Q`Tt
@]Y!j:F%Il|^7EenwFcQ{kCC!
3b:;
:[Wh
'e+?z
\ =I_X
mxVM
@,r 9
G|1z6
'@Ug
U\x
c9)1oz
,F,x
<93t
~F'J
~%o\
c%,8k<i)b<9wYQ41ObLfz1uM"
kccX
e.!4
vDDq
LkeG
~h89#
G9@(
ntEv^+
s fb
oLrRc
e+-v
wfK+
/F9of_)XCp*{qsDGS#5"{6=^"
gGvO
`.rsrc
?hN_y }
r6\yz@lxZGb-0]X|^)4$@K?a&
OK!
'y"'
+{,q
is1J
[@\
uVie
|B9:>
PlHe-
Hq,}
BY)
Nuu$:
get_Default
c"4:
'#`j
imk6k
&\*n
j`x&P2i*Z,(jQm%f<x'KTO4;
G;{`JR
kernel32.dll
PrYM
result
|$T~
<Z"%
>6/|
wA";78
rO\Z
Xmi
3nlA
zo'7
~.FZ
5bQ?9
r/L$['>
%!d C
iX8Q
7^DG
=YJo
*ar%
"9PU72G
k%ms
_8Q<=oWl
g@ox%^(ONDU0kxMB`Lb8DZII#
s[L%k
x{]ih
snJ+
w4>vrD
vJl{
u}=R
O? U
0e2
43uV5
(0'r
{Uu5
ujttB8:r"To1vC2zb5=Yh(/`(
Q/t*
eF&b2
~n+OlA
S8t
.ec3W
DF Y4
gYU*IZ |[F#CNs%u/'_J((&K"
y'^\M
"~l7
IK+5
{rf~
Xt+sj
0>iO
U3U
R8p$
get_SelectedIndex
nhG 9
1kC&
rS8V
+^Xs
NXY8fC&
kv:
f"<\
eO|5
~ lCT9
ag4/
I~m\
QV+O
:CCTD
!/Gjvw
NZA>hF
v^h?*
qWe0
=uWo
<@JT
/c@_4iwmt-N0Js)'OL*sG7+z
MouseEventArgs
)iS/
*J~
6~A%
|IDAThC
; G$
)p{.
_3wV
FG3 h
[\@S
f-)(
>N C
-q**1pw[8,d%D3AP8qFtP2 [!
$fzv
X/hk
A1b?Q
Gaob
}5PC
xcj#
dZm.
mu5wM,//UT`a5N/ve7Al &x3&
>aP537,td!3"m6BuF3Gfv}6%%
`?x!
KkEE
5SZSu=
"_cH
A?G[7
fG~eN@~k|5J]bq:&Gz_{KT(`$
!8mJ
}'CC
U],=_;
qCx
)d #
5j*x
M$N8g
m HJ
X;r,
+\c](
U,J2
Q?/mB >zrh'I#2S>pOu3=V93#
%\Bg"
$4Aj
"a_uV4
\h A
C/G"
?s5%&V
:<nRp
0$Yw
3 ""
>Ju+
HJDf>-b3Iq~vP+zgo},e cm(!
XJX*V
;w5
Kak@
{lo,
S;wV
+3sT!
3{J
FrBh
N/T$
z iT
TBw-
Write
;9 ,
uqhl
OnMouseMove
:TNq`
*:
lJ1
yC +xk
G.{:
,q@{
gg7h_
}9NQ
'Mu%V`
get_Assembly
0BqONtw
sGz/
>!A?`
#6gHDW
@$"i8
*YNP,H>8+~#C/Mq6=d)T0*_>!
* C,
`"^r kFs
s6|]n
C\Q
G z_?
Bsm]
NK7Tm
9wq}!
6zYxm`J"P#>>>UM@cRe#!cMy$
Te}w-
)1%-
<+v\
,L?*
/Ri$
:pOX
gh v
IMVR
<n|;
System.IO
I]!qLD%E=/5w{aQH6Vo|H>!g,
7ylqHn^
WrapNonExceptionThrows
rv,imE*
v(okB
ig@irQ
DLt,&
OgM
vs/9
^JQr
G"Uk
vum9F5
C~3;
xB> '
w&fJ
Console
1 Ww*
RZ n
:0'G
g4Nv4-.
lY_.S
3`Kh
ugSw
U'^W
/lrdNr
j.{2
v78Y;
>nR!
r{dw
0B_1iO<
}9| A\(EMWnMbZI42S`X)PG>#
\j}u\Y%
I3R\
cXgD
a=C#:
_V3F
TRiS
FI4ViBW^Q
x$Y
=NL<
D3Ok
=hzkh*
&EraMAk
u[.\b[e
@l9U"
,A&{
>ea#E
Y6y;'
Y*XTm
>:9
)O ~
:8 o
(3m+
\22lT:
2Id"
p tj
CWIr
X7[2fFK
IHDR
:ZlYwjX#=!b4esT9k!]1]AM%
_/<m
? Az
Iacl
f%6Fh!rSD+\{,ILTs'6jg;HP#
NrE>
B]:
2m0&
-NO0E
`8sCl)wv,nv@km7=1ihlf|,W!
7lvR
lsKf
+ 9XZx
a&YWQ
eHCt
p'W.T]
Ri9oOd
((#
R dF
aRWs
l/u/
2pWB&
W8<:{;=oyrI&M#/<K[Shk%k<"
bA=X
d?n/T5fbZL-#@(&AW:,foSDn%
]Q?K
<Hyj
1&v
8XHDbX
%i<>0O
EventArgs
) '&
BNR"
rI7n
w/c$
kNBw3$E-qe4BJ4AdBnwju,VG&
64doZ)Wz\mLo{Qo>$jcBx0|C%
%~iz(F
Anm$
5K(so_
5+&y
xK6i
hLzwi
3rGqH
^dao
=Pc.
= 3*AM
&DNj
$+=P
^py?
kt}
[jh?
n5"(
z8T4
s^;QpLw+H#dJ/8_+>dqeCG1$$
1)vz*FFOe-P{'mQhy=$z+Vs]
:Dad"T
4;XC
[<ERVz"k:_Ef!r0G%o%n0=2X'
y_>7E>bz/Mw7#k'1*u*qA*&)%
d'wf
*1Sju
Jg`[_T
l` W
NwxJ
IfUf
5+dk
WS]Q
JNZf= +tn
CreateInstance
Kzi1B
>-ou
~eTO
$s !
?-)V
;%0PP7
B{@6
|[Ny&L6}nRY'fN3!K}L*TKXN!
kI_
cDc4
$pKXp
MethodBase
#Strings
}.%n
f#]_Y
;f>Bt>dA>nqh05qVirbhTgfP!
DAId
ZXM(!
*)7>
f_*.
fmQkX
0+d
GLi;XZkQ
0`^XS>
,~1!
lg.(
c;|`
P@Wj
)w(I>
!e #l
`b+|
/Fh_
2SQ+4
'}I\
_ y(
O< i
H#Ga
-uq&
`x+]X'
}LXn
fy`V5
Environment
#Rae
get_EnabledCalc
4]L:
VIxJR
=[F OB
*2yJ
VirtualProtect
Z 9Y
i&Y4
I bd
C6!
F4,+?
\[T0
v3*/
;x 6
IhDM)(
RM7p
xQ=!
r\i
b@ndy
3Y^,
x=bZ!63V-S1&ONP9'uMNA^TY$
eBPk Vem
o#:
mt'1:
M{b_
A:6i
get_EntryPoint
Z~OK:
VVkr`
AZ@$
!1vr
m<mb,
?7ls
g22WtV<4Ln1%=R?486?R%:n!!
Sf |
?hot18JEWVaDHlE#>9FV`5UX-
?f:yy
Jk8e>"
x_f"i1
4Z/4
:^~T
K<"i
jq1
+%yFq
V+nZ
U*CT
.oQ[
8F2
GetType
{1L
l7YV
[2HdwO
-G#@">
!H7R
> -<S
add_AssemblyResolve
acSE
2>)N
jC( p
(f3
IDAThC
wm/eG
X#[Y
I]~d{R
NzBsk
)$mh}1
<s}D
{2'D
3 Ru
H`>H
8 MBI%
G; @
set_OverIndex
;.Qc
`5o?p
*,lLl
%2w8
TyaWO
]X~c
Z"jQ
e(3*,
Izx6
DD4F
Penw"0%aPWg1gvTJ#QJkN|ej"
`?yO,
rcFKW
1.ui
t+&1A
:Xb)
V sM
L>JIx
M= e{
@:eQ
TabControl
N7![
lq~f/4-4U-%@:shP{%Em&,6S-
}[N%
^fdG0
:/Z/
~v|I
%z30
AF<
riaqsa8v
7I gWk2sejWL1G'~%DFcX%0l0
D(L7S
k?*
i"*1
GtiB
pcOpJ
GtiA
vt y
A6fLm
VmZJM
9#2)tNFSYshdMihFBL=yuzHt&
!`2}}
n },
Fx{-
V8CR
Color
Vf;}
lM)8
|6 E
T!c_'=
Intern
C%Xc
Dbo?c
O*n}W
YSHs
^$~#>JE~=AyaIlR5RTu~*sa3'
oVXs<
'k*$`>Y+| r+
+=-1
^o@&
)r,a
Z3}WU8?8\g]ZALzlWe&TY($b)
@r6$K
}yCP/
MUtn
*:\Ps
r=R;
SF]>Rbv'AafU)*,Pgfp)Z eA'
z$3
]_ `s
a{5#
get_UTF8
W-44
zb~"u
i7&<G%
tvW$
[ pEe
% <U4
d#c1
$^9i
~,&J
z(De
N3?|
{gK:
2;3v]
ZX {`
bv;)p3\`2@tRG{9KH"` ]mJv'
[.KU
Vi/JC1S!X\bX!-+437E21B\Y
get_Revision
_z 9
TL3n
0B([
jDuS
96SO
bj-pM
n^(-%O
@;Hb
4nX4x
194J
?fBl
lSaz
M6j1x
"M}=
System.Runtime.InteropServices
b'an
l+d(
{ekY
_qH:
\ODVx D@20E"1{cq/k9@!DD{
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD
9*v l
i412
{y"'1
"s+i
7p%b
HK4J
L$Dd
q!3h+0WwTV?JTQZt#gII-*8u&
hZu\(&TLVyyd:JYrKSks&&&W$
G(-{
q~ri
5K98
m?a
og &
}4~ S\"
c9/--
@m}
/&4z
J7rAj9x
set_BackColor
Jx{\
cGu/
W!_v:>
Bg0sp
4p`a
~ n9
&^@C
?:.6
%?BWK
T=: G}
t>s4
eg'hzbI'wk*0Aj7V;o! {4:p"
&&`H
=su<
0RmS
`[Q=
xt3i
33)Iz
N}(_
F~ ~
91 v
&+U9s
mkh!
* Q
(K2^<C!
[OA PbM
,DOB
YhPUQ
67|b
$a!?<C
r3+V
,-@u^l-cfFX\t[^eKkgQXkI["
rsOw:l>)YaNj2c3<5TK!NU/o$
WHJ{
System.Core
a&2q,
^z1K
r T~
h <D
9<.E
(7Cro
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
AD0m
~-f
iq;c
#( "
([v9liv
"Dll
bRy:3/
; et)
uK_`
Sj"G
qQ?*(T
\ ZP
Delegate
"K1*\s
a d[
H %k
1f;Fqq
-pgY
Hmco
fYC!
'qUi
#lflg
Dh!K
f+y;
IDropTarget
,~e
^=l"
"#yCgT2
.G
EJ0
| ac
X +4(+
{:q6
/Pvd
0c,@R
Bfu2
X/<T?
SS1f
#1E}Z
&[.i
ModuleHandle
0X$drX
o </
cldhhTZ
&r_uS+8-InFd*0J TaY[FdZ&'
heX9Y
l'.3
GbA
stIJ
cq k
RT[T
|)L<
y#<C
M@`k
nG2|
{IDAThC
'AW7.1
X$~^
tU&m
x)E=>
"\\j
-;F)
HYgb
-,\|z
2(3SY_S
C;8=
c`uM
?ZoN
5w4dT<
KCR =
)R2U
}4p!
tNU=
d=2V
n b
I2Q
/V "1
,aSg
,Lff
$[UxCE
6?e*+
set_DoubleBuffered
F5D
0eGR
o&m_
get_Length
48v)
3v|3
=YH'
z_x"
*v5G
tSvUP9
3Q\u
L,z10
`_R{
phh0
Sr4,K
LA+P$5gj_G)s9!%:2=*;FQG%"
M"q\J!zS{@M\}\jV>h:vIp P&
`]Be
qMv5
^IZm
H6gB
ck1#U
10 t
.\1Z
kWM!
Contains
(! I
}f4_
8v;J
vcu6
4#m%
{9ySjz
V`t*d3$$|a61B|}Zr3#Pv{M\&
gqSN
c(Ox
,-TZ\I
V0q=F
BcD7;
:.rL
qO@g
a_]9X|
m2yhj
:8H2t
I w
C_
ValueType
,B8
GuidAttribute
gjl$
,"]_3 i/[76*tc0q$@]0Z9G3
NJN:
*h '
Xdskuzn;*GGeLxjhBbE^Sz38
_x_h
J7Jj
ZXVG
I~K
:?F{
]"6B|(ZqDXy)%YR4wNKr<(5J$
OMOB
"`{+3
^.1u[
33K,y
x{#M
0!m%=Hbuuxr5'/MT&9&+mM1p!
Vby+i
]?v!
eB:b
t\~ J
G=+j
get_Count
8.1
,\XC
r~&"r
Ekl&1D(,_<
<Wj6
>v%
G]Y!
<i_{
[U^**X99
P@cU
=/f%
@8Fb
System.Runtime.Remoting
pXG6
y2M&
Xt+*
YIku
m\vF
TZFc
}%e=
J7nz
kZL
GetField
&'r<
U'=j
bvVNnoVi'
-%T_
IyZ~
u3DK
@n:t
NXHeKv
{j%L
&$ 7Tf
F3OM_P
6{cb
m!Waj
6;Q(
b^'
'BT0
|/rKv %)pR,Q+NVt?n^-}U9P&
1>$b
LS#G
tc{RB
APJ0
hQ%fp3
ee({
EQT`yZz
^hiK
a+hJ>
f 5d
lntE
UInt32
,hO[
B2sv
-[Y'
%ED
get_Version
9qbb
RKp&UNY$u$%hsc-LcaXy{toi#
8Dl3)
8e^~
/DYP
ToString
-xl
xPr\
EN"p
- i0
?eJg
hne(B
.sMS
[""GM
m>o~4
khvJ5WP~gr,vc0I]S`Ntm84@
re[o
PV+?
z.tbl
dXU+
.i@J
X
~X6vo
`1ZK
2>~HXyB'S-`iHVs<B)h:O]u@
{C8f
;r--:
{`xX
HyF/E
2Kj3
b'u$
$7zU:
eJD<w
7/Y>IL
Fd-4$/kid~bNATi fp`eLd}I#
Le@]b
Jf9\C
A)m\
ServiceBase
'?Kd<$*[vf:wYb|k#^Vr(n8U$
cI07
* F
XJ"F
R|d`PCE't33&IPK@s ZfZc;<#
h1$
bV)DNGq
8 ]O
I`{;<,a+bTe{?}UN(k4Ea%k@*
iv>
vAE`
%\IU
x|{2
GetTabRect
SuG
!zRu
r1o`
Uc4I
L\5T
02r
#d]OJL
Vg=&`,BStu2|i7b]^:'vDYU~,
shLn
us5-
NB7x
ziMtu
GC"UFH
\dm8
MmZO
k]Dkr&
MZ?_Z
*r@d
F,S-
w8C(
aKJC
8wD]
Fo<7
*_&MV
C'(-
|*t4
t>"wj
fa 5E +yF
!%[k5
ob2)
. xf8
r-l0
FU:m
3'cg
OoWa\D
0~XW
F2O.
T|QZ
<=Gv1-
PF$k
&A w
$ jo
Y!a!
J'-v
=1 d
)E1Zd,
8Ni~j7S5D
|)4RK:5F,H0B~7VOXh e>/OR*
"F.@~
n "B
>A|)
7i7v
t4lr"
^F'@
'/7I3
kt{9
w Clh
LGag-jyy
e^^M
ygpa
eFlJr
sgaN
8"M`%
e$}0
uP/#
JAc *N2m2Hh(^Zx,CJU\"[A0(
J0k|
9{t
Jo
Uz (
beS
xEF5K
92b0{eNr4^RnN2bC5_QP_HSn
* .c
<F]! k
% >:
Data
(W4N`
1R'h
FQ$@
)5-kUDX
wo^A+LS
lQRO
IE K
Enabled
GqbnY
r_)n{l
y{<4
f{1,
Ql<X
KF-c
t<=BI;
LII6 J
?l[yj
%[os }
b/U;X6b B/
z/z3'
x+ S|w6"s/9IXzh`<M?zZCHo!
|mG
E nw-
pHYs
.ctor
IXaH
KZ):
D$nq
a{b5t
es>@
k)#(
hL8V
(_\]{,#
get_Message
Container
)MIQ#
^Vr@
y]PzF
[3 %
]8*
L7GG
q<v_#3
FaOV
m k0
dKJa
,!|'
Main
;\!j
x@b7#;OMK&"7OK2ll-65O#&u*
j_fP
Invoke
d".!
711
#/&p
ZXJX*
/b*j
n6-s
1Gxgq
Ps8xy{Zr[hMFXI%R&!Y{'Z@0(
@ ;]
:T7u
;^gOm
UzF#
2/KZ
m:?}j
@k:O lw
Go$,
#Q%d
'%uC
n1 >
&'&&7
hYTk`
OJKm
q@47
G@}13?8Ahf]lk':'+3gg\z@{#
Hs+<Z
M14<
P)iV)O-SRm/0"Rh-4qI-({W`8
b`e)
o 3'
Lx'Le
IHHw
Esot
F}E8WfWNcW-V8+ F&(3vJLLH$
TW^?
6+A,
6l~~gO
Module
Rilx
e,(1`
/om`'^
&T[A
UDYF2E{9>$7d9(LA-{fwrL5w#
Array
~ayC
8}O(
nFwi*|{
*)F2
>X-e
qO$z#:
\^r@{zj8&UI3S<Q>R}[)!Wy&!
vTrr
j!:
=2uab
NiM~X
{>0Q
@.reloc
f{x&
jrMU9
BB3
Q FL|
;<!bi$V[nxY2/Zz6RGQ!aVK+'
"`OH
nhuoZ
vvKV,
C$HxX
{VK
SaZ~A
T;2b
Am_K
TabSizeMode
Z'j=ZYcFR6r(8_~v'STqu(Rm)
d?1+
Byte
get_Chars
U%DV`
E$ c
=4}
:V9r
:UUn
_7r'
hKC @
~1tp
v4c+
wXZQfd
|nm1'\a/\_~(_ywA4Eiotl;-!
(r?v
hHZ6
tF5V5}&
;e -?
tc
5 1g
<>pw}
j PZ
;`0l
DtcT+%V8]d"nlU'mu`!N_oEn&
x_ ,U
fD5{G[
Ra~Y
1Z,L
$"1q/lg)Dvr0gvq13A"lt]_}"
] +K\
gVc)
[6>,
wGND
gR7>W
< N=H
~H]Y
|$S^VELR,?W-T`1-t#3gFk6K"
BKl&>9
~i|ey
slK{
(X x;
YB^M
|@YMD
juBd
J,~
l =48UELI<Z5pE+xTbD[1)b4*
OJCw7
]H-y
_Nu0
ErhK
fdI{e
%Uon/
ufrV
( QF
Iow^
k% Shh
Hqe8
[=Rd
)S_~"H8M<X>N0A+r[A=zb7!&'
,{q.cT
Jo:Y
3 ea
get_Location
=QrC
<7`++zW>KsoCQVl* *H L_OD%
k\bk-
mopj
QzoX^H
#8*(s
v-h^2# U^Ic:l 6x4sXP0TN-!
snk*
Ve?Yk5oLZPw1);;2GD(``c]D"
]9BR
]Slk
%>1[f
Op!A`L
jK?G
js/H
]P#ce
AyD,
AD,)heS2e WW9=v<5 dG-N`,&
:!fi
0>S&"t
uEo9
](+!79
LtqW
0=8G0g
3qTRc
1"'d
L:^
/WkG
get_FullName
e\z
J5\9>
'`f=
S.B
5KVO
[d28Q
FreeHGlobal
RjYTt$O[YfaBM*d"4Ec('E?['
d+ S%oF
]hR4
?T&m
iedd`
o<OP
$N"Yx
KZB5 n
@TE#
00&,nq-
s-?CE91`+`^8:Ny6(hNf^P2@!
RuntimeCompatibilityAttribute
@Og4h
UM|8 u
bqG[
> k
{ tJ \
+R(+
j=K(.0
`YI,Lu
Assembly
$c9^
3jls
!(Y;s4
aodi
|Xg*w
IYl!IeD
?=QC
fTh;o
NK1U)8>I%low%{F7T/{J O[M"
>A"w
6)x%0
r/ i
$"W>/Q
^| jX
pcVd
igl|
RJJ,
xv9>
9b{3
@{:}
1L:j
t@$sp
D4c8
95c|1}z
I{2m
Invalidate
m1:.
6mjr
V&l g%3
._X`
q]Nh{K
tP[hHI
[a_E+E||w
mpU$
^fcJY
5|\@NIc
6G1\`8l#6t/3k*]^}]>CjSQ}"
qyv$
uwr 2x
V/ ?H/
P9y\
Size
s&$
bTB8F$m
^ Wd
1vY2%2w"sPb4![Z}e[b@7,0e&
53}A
H nS,
NewGuid
#BKQ
Sbo2
Yc>2+
:~?4+9;W
D8UN
stbMK/g0IAxb=gqAU5d'PKKM$
.i<(
set_AutoScaleMode
,>Kp
U.*Y
?&;-
j]BCU
2vQx
F:t|
9oG8
*uyk'[ Ch))O=BZolVsAvH@0
`BCJ
w}'nu
IJ m_S
c&u{!KG_R>}>d]HD\`%|?e)g
&n''N
,:-(
M3@<H`]
6 Wa
O!I-
Q8@+n
zJRMt
1NF<W_!
2?s;[
:'fK
Ns.2(
4Dxo
e ova0CDC&/D/3'(6,Q}q&AB"
J[R|
m+,>
7?]y
b w5
IContainer
d/2~
u#872j
<$eu
gx_|
`A[(jFj5&21<O^lw+Le}t}Is"
P|aX
is #
.Q{__
6w[K(
WWZI\2{2'EPUA}D[[MUwLdS>%
18_D
FUAzp
rjv|aJ
'JfO=
T$A{
~tI
mZf?
JwHw
C2%P *$6
mi 2
i5A5(
?B0Q
:f `i
Do[ @> jPq
-(}u\
} Tyu
qCy&
}L\x
ISerializable
!5pVe*i'4_@#}6_BB>[Cv $V*
Od`!O=
U/Lm=/
$VqlX
uu ^)
8{)C~% |J[mk Dg\z5xgJe/<"
4! !
V+qO
:dz~
;A6R
oVk2
Z(1
$J:G
m.Q%
E;D,
| tq-%
n&n:NO;N
U|R Tn
~owN/
`x&$
C2Hr
MRY u[
7BX3
hDs`
G9(3
X9RA7
MAF{]q$@
hY-7
} q?
<kY2
]TM:u^Q&hkgAHy4=-xWAmU 3#
0Q?jyS
Z VsN
vK0P
;^KW
s|<6
get_OverIndex
Q}@=
3E"5}S%G/^IZ!BTl`6PP&'9i+
-$2byPD3H!-uV<:Q]9|K398c(
U'>F'
/~ZSH@
e[ .
=UD5
#,1'
+av}"
D=3?
FNJy?jS>&I_
XXeA
a[E m|
P\>H
#&{j
Ce0w
*e4M
CxG=`
+qGWE!r}2pB6]BH:5sXY8e?C&
-_Y =S
^L!C
Es5HK
St4X
_kF@
Jgr|
}-do"=1#Fa:(|]R"^o]4Yv{D%
?rzw
8}N`
$bc8a3cdf-4b06-4944-b7a5-34f546e0c267
5Gxv:g
Y73k
(hCf
~eWC\(*I`@Va4HK&\$KpEEZn'
9'2y
M@ o
5'`r8
MP)%
2])P |
t-] P;].u
ContainerControl
c%d';
;w R
2w!
!P/>
f M5
u}l@
9t80
}iib
L?Zx
P/+x
}&J*
>ZU8
@L}k
FFsI'1'Dwl/<yN*(>\*eX'@M'
[^N. j@G
f,uTT*
w(rS
GymtM:
r0Cx.
K44|b
q[ /`
ReadByte
Q$vv/8}X/}i#(uy3g0wI_]%R
} 5\-
' pc
mt1e)
s42'
~&:D
9uR/ M2
cJ~@
~m?i
bT'R
3F1764884A245F1B3FA91DEC2E25339F23787561
6u{w
ns/P
/Ri
,ua8F$0$<1S#3K}B4w#"F3<v!
w- k^
O7.p
=p01
V @P
'$U)6
deH[
5e<c
AllocHGlobal
nyQu
^zFa
lpom
'O5
H=A|
AssemblyCopyrightAttribute
0d'X,*s1:s0[d3I{JfDje;e?%
3{N!
S, c
=29Qc
HODz#GI
B]"_D/=
+gyaz
K ezQ
]mK
c"zW
Og$}m>
s1!;/
SEKq
][[fG*/RI]2k HI})IZl&6>}+
-6*e
B[iq
3(2o1w
5!dJ
~qyY
][ U
sxwlm
Z/+qg
UO}_
mMzw
yS:wbwj8# 8?)=}IuZfM,p m
~u ~j
}\r;
Qat)
}Cr k
^S|^
/f+_V
(L\v
}RPJ
q{Vx-'B#Rcw7SlZJufTd2:Vw
#Dh>
E i
K-I`rP*'3/yE%v8$$ZESW;$I
.D6-
UIo]
nOW
zxA-
7Onv
RM`?
f_80
TNq;
`9UR
iJ[Q
LHUy
kzSp
Ce#%fA[?HU2g #WM)qC/"\=>!
FGz<H
Ti9LUH~
EkyRbw4jm@yfFy]'uQ;\@a);!
E3WZ
crPY
K=+f
Zt 50 ]
Q3d@[$
hqB)
QdD/
7(H8
k"Fn
TJy8
5HrNj
8y$i
YHQ?
na4-T4
v Sf
yC>yxH
6-K
|zWH
.f*M
ControlEventArgs
' =*ED
U/_Z
+@b^#
?TI
!o|[
%~ w
set_Enabled
>zz6
(/ K
3^{zV5
~-:j
N]X
Read
't0v
pk9E\UX(
_zn'
QEAPV
%15<
]Khl
hq&J
fr5N
kCy,jZf&N'9-hjn<,<v)Qy#y#
@~d{^M
]o:
`KA"
s qS
I .>E
jvx%`,'A
>"dcO 7r`
get_Value
A Q
6<j\,
tvnd
(5 V
mo Ll8 S|
)$%T9}
Ht%y
tpL
CLR#;c>q^\FZ$#()/#ig;63D0
2f=`
Yidf
Sq}Oz{^Tpk3KRLvxCGhN/5TK$
?O\=
7\OL1;]LvH/Y*2D>v)F<1>=M#
?=v;$D</(:7kdTCFB2aqSO4@$
R:Gk>
Vytz
f]vg|
bb";
gAMA
SlSVJ
tL.
q- {^w
mOD.
FST
U[o
V| }P
4yh+f
U16W
6gJ$M
AutoScaleMode
HeZ]Pcyq=KM=~m8S/ff,A+C*
Lfo|
18?1%^
_s%!T
Gq r,{
MarshalByRefObject
&%\>
?_LTDL9:
sj$Y&
*7J
/m,;
4gwDV
.cctor
AsyncCallback
Xs s}
qnF
.q't
M,cml_}CTM!F"-,r@!ZGI'YU&
n'Vr;x
mscorlib
KMow
>Y8CR3
\y2F
cCyd
Jvi}
xaNnI
o^VI
, ci
e5v*
= I S g u |
53%W
::z4
@t&'
X`(d
2'
MU:&5+
Ae OF
X;gi
*uBu
>tQ)
cz'G7
N:*j
Rz&DhRqQtn/G"q00?N*9M~\i
wy!9
get_TabPages
UGoa*5`LqK#<d?1";L KC+H--
vp2e`}
v#X8
g8Os
R]r2
b4ukR
|$bc'D?k
Ell?
Guid
7U$;n/eWHPBfe9nm,09Nq#$&%
Rp[vh
Ete:)
+xMH/Q
G[p
X+GF
Ypc^
5&:|
awb5?EYtgUZ6:~g)D4Y]9^Vo'
=[*y}'
u0xa91KJkupk>bixi{ZaX|t"!
P\;hw<Y{DK#~q1p\\wwLZ!gt#
get_Width
vwA}
U;6>
]hBl
~pJn
U'pw
TB|>k{=
dMeR
.@D
+Tk&
K<k
4h#kll
-UI{}i
!% 1
System.Reflection
uz2"
TANG
<'~z
iat,.
CIH2
p#B"
7Q%_
9} W
iL`}
RuntimeTypeHandle
\a7oT
6O{I
V_S2
@Z"_
Xk#f
`#e
S{tZV{,*znli5yaDVaN]*^3u
mbmG Z
Hwjt
E6 6
bUFvXD
d~kX
Z f
"FNOD
mo^y
nxrt]
~g:Wg
6f^t
;'>yxS
#aS2
<> >6J
0m;gV
\PXC=X
}g67
sender
u}Nm
^M~
`=xf
oro<(
FE _
I] fS{
.VZ
Append
fy$}2k
qMh
`1l/(^coFu@#w!oD!M6pn"^{*
System.ServiceProcess
op_Equality
D5hVH
wD+C5E]K;>D?~e0$4a`k[d(!!
UjN$6Y<{pOXh&V?+y"P[#=[*
Wz)O_
z[`n
"\qA
VQ(}+
8RNy
f^-/f
56jSD
G"~1
"^MB
h&d9
C(eu(w
}gg@Q
o]TZ
MJ4~P*;
`hA:
"r%9
"a&!Na+
KSWA:
3m]y
!*q+ET
2S`7
.kGW
|_=0
8VI_w
AssemblyDescriptionAttribute
#Q+bG
9k
! Kk
y+x$
[L?p
sENF
&|gs
N7OT~x _H>h:*9UCg;f3Ww">!
U{}4&
7nFh
I]0x
rh%A
#3sX6[N'b(P/jsu'&%\D)Xj)
T,(7
V<p W
Y#rH
C@^~h
:5L"
iD`?
y L4
,C#_
xccx
I\ 1
N>j9
TGd~
KE5
o{Fu
IR`
AbB(%6c
5*{$
[<~t8 Q}
c@j9
6">rpRiAAE=G&tk?RYH32T!o"
&]5}
d{@7[ :ydJ7%* UD"C&x"H6w"
@Exx
X@'"
U2Gx
Cq o}
pNv3
} %W
?Z|p
~ 4x-
#4C
W)i_
)8tb
2#[8
Phn>
Gx `I
R+X]
I?j?~Y&8D
t'/*LeE4a[=}j:Y?DNm[iT0H0
J Q
MtT<(&cmJ{oFTrdWt!;R9:KU!
8,BQJ
ABx@
_/7'
{~6
>PX=+
:He't4
o[>u
;&XU
N{-;
i?:Z#K
p" [
#2:==
?vKX
")Rt
|R~r
*=R`y+
bsT66
/EbwY
yk-(
0&+SD
sNt
@%43
_ Nl
+ N;H]
x~tG
xsro ?
J};PR
_ My
=b%b&
^E0k
~}H nQ
mscoree.dll
!This program cannot be run in DOS mode. $
EGT0Z*?
callback
6$>?'
5)R2PQ
GRIf
/Z;I
Qf7a
J 9W
vx 1
BeF]X
._[0S
e%NHW>apYT~0YXo#JF&Ub&@j-
G&9
3_{w
Dispose
Nwq"
<&9 tB
,f=5~
CzKj
`CwZ
i0'dL/:N~'+r`jfMi $6*uR+%
hrFv#
v(sRTd
?$9v
QV[ _
dq+W
4E2BE99140D24066CADC84F74FA899FEE5976B68
y| w
Jx
[;T
LDP%
ICloneable
i)B+
G/wz
kbR|
\YX0[
Vuar
S'X]
v&Ai
r f'_\
O_{
OD2]
F\ cM!
"s\}|O
WkGh
AnQ?IY~%id37TG,H$]^GI Fk-
#=>)
Re`@
E.M@C
T4zV
x[,b
ujV%
qSZ1y
B,)
y;=C
VxV=cT;O/|VGL3<|v=DG/_Wm$
{#-y
zIDAThC
V'0h
>BG=
uO[{
XINU
5H.
B&@\
s}oi\
Q_)x
CA:^
+&t8
|qL
,QHEaAC
#0eK
)^Ru
fn/r
)b#s-
Q&zq5
W'tHhqE
8[M]*
;PJ# E51
~m@!N6y
Yu.D~
.h#_
a/K'
2gLb9R
BSJB
9:7
6DCx
vcDsk
Ku6D
o_HNx
$+x^\$ iza5x:)~)Y*5y{,0|/
&{0.
ZJ>|
b4:_)
K\_t
hhS-c
\ uz
)?Jo9[
Tmkzz@B
>dke\
Zj Y
cgRR
lcA-
get_ModuleHandle
}Qy_9
SQ!H
F||B,
_CCq
##&|
%#g\
Fh<`
j-W'
{#b.
tEk~
n}ks1'k;W
UE^d9
IntPtr
_e0fl
8\5.
'*mBm#B%XI1UT><(,R=`'P4r/
/T;/
'u4
b}p
dH2
3tj7
|OJb36Q
6D\ B
)b6I
<2A8:
5Mzyl
Y'ZJ1
qM^A
_AppDomain
=CCU
w/p/p/p/p/p/p/p/p/p/p/p/p/p/p/p/
x%SW
0g;L
h4!_
-:se
nh@d
7@s"Cr
huzN
BG_p
1ZL%
&1G%kgX"{}XHzC^6~B(aWL7Z#
Sv{
}:-s
System.Linq
:*B@
Vk2B
/Yj7
C708234F139063BBE3CBE2208BB6ACFACBC50333
DV >
#.\i
#nK
?pdu
Gknf2
InvalidOperationException
7m:/66;43]7KA8|dkGN,#RA<"
G*$p
W'
l+kO
V5cP
rnSyt,cm<3/``x:z!Un7puO+&
/{4g{\P
Ptgg
;+*^]
\|/Q
'Rc0
Et"/
uGg|
x v"j
?Zd6D
ej5=
2kH5
~h'KU_r<&@RbAF$n:QXJ!+?,
KLy#
AssemblyConfigurationAttribute
i"N
hu/y
i@>N
i:vp
H'5?
:QpM
%2@.
W>TD*C(nP!#6X2L$<v ]U{H("
j<pu
Zvtu\N
7&y"
f)S+z
hkA#^
SO?rV
BlockCopy
54jEK
kp6:y
fk*b
C{WA
el$/z
>3%u
u\C"JA:
tVtx
uXc [a
ImxX
+Q:F^3n
4:T -
S`E7
^!/M
DFxi
vI z
hIUw
R4v*
i ?#
91 RR
"`^
oYe(
5p.D
DV ER
EpyiYV7
dCFEC$
U w>
K#G6
Wx9
l(B"
K D.
CO= < < < < < < < < < < < < < < <
$q3~R
ihC=4H[;%R?hQ/0?d6{'8GbE#
<`b*
h@ok
WG.@
YW=KXc
LF!.
[2q
_NXsT
qQiMz{rD(sG#B5Q-"0u=}QI|#
dW7\
b <`
.*iIn@
r6iGwhRK9tjS(nPR{BPE}S$ !
K|#cNeb
(=k7v!
2$[Q3
,rH,
l&G!:
E(|G
WE<j
4Jw4EQ
Db,_[Nk{
gqKN
=Cv
LF!s
0wc
N zqY
>IM' v[
PB1 SI
y~l@
iKX[@pfAYON5EU&st[n4ZM8i!
3<j9
SOgKr
UZVYk(e
rY $
t.:N
C3
w.`O
KV9BK;Cz;b@,HUK:At H;Xxe!
K_Mf@
TQ ~
Y^ J
MethodInfo
5dBq.+
-4NGU\}2eEAy`"C/"+ueE^[@"
KU$s
q&Ig
iXy/
' )
aD`"
Br1i
qI_Y
CompilationRelaxationsAttribute
gwU4p,
*F~GqC^'a`
[ \9
,S!5
TabPageCollection
;7ga
Hm/^
rTHP
A]Y8
_j(b
lyqT
sF<#
MemoryStream
-LO
vX6{
pc.C
t(TR
fJ#j
)Q,c
ResolveEventArgs
D^&z
9d c
r\Tz1
PA_8
:~sKJ
w)mu/
O I9a
;I0/
Ag6/
q2:i
FrlG
`/UD
5!@sR=zyfFB]_HOw/%#]i4b/$
T.Bu
OnControlAdded
,e_o!G!h6p#z+8pW4WUKG\` %
TFR*u&7
2VsY
myfA
`xET
2a 1
0f(y
FZxy{`
`y|z
SqjC:
93Peulr*41R!E4(GpZA#:bK("
gPa~:
)%N<
"0zI/-;`J+4K~a)PV>3Lh[JA#
A6ilTp$1 s
@- M
1n}{i
?=q?}v_vDsRQ;**o3eZ|;Z2W$
e_eg{
_r O
NY o
?taZ4;:[%+-94^,R|FbpJeNo#
C^ma
U+&EO"uw\%uN;x[CQ@T?%xl "
{70\
)#nW
%gVXp
%BM~
3pm#
!wGS
1`RB
O 5'
&JxX
)TDkP(aenhiy,3:p\yB-Bx+g#
]S+M "
]]rF2
z!j%
l ('
raX*M
AT?V
.HEs
c<+<9
]s2M
%b`R
OA*q0
.>'2
:|bs +
= < < < < < < < < < < < < < < <
yQdb
7u)9
K]!L
;vyT
p|TI;
~-tLW
Gj~P
TY$NemT?oB:J-?Fq^ng9@}'U!
J66L
0 ]`
X Cc
Q=u4
9t:62G
? 8
Wl,i2
"S&(3
JpZ@?
!H n4
D)"WyBzD
r(#N
C7 9=
eSa?
ZEME
~BiP0n^
LW
|yGm
VmB#
NnM
!@w
-#0_
b$:kH
sX6SH n: s
1a C
Mutation
dw6g
ti"S3
u/W
p)_[
L[T[8
Rectangle
CV&Gn=
0W~*g
@U&e
get_White
}GT!
5 >E
!mNu
hw S
npL =@
3@/"[
d?oq
^t\_8r
':X28
9]c:6;5'
Concat
7iz^
>7jG$
>Ti&
lV{/{y^3IIk];(2}A/*OgVWi
StringBuilder
pw{"
ig~cDq
z]:=
lRXJ^%
CuF
~ ~i
E 8hj
C&@|N
>y0X',wVj{GhL'v'dv*nz5`Y
VZ s
h<6B
6\[N
P]r<
?SxU^
KdbRR
gXDK}I[>"V[gG1_m,(!"N5/E/
WMB>`
^EkQ
yZ,8L
dC ~
8=7c
9*0
[$Ge|
-_V
!KZ#
get_Hand
`-8ubUtGNYX'HKR57GcC0(y4&
"P|wvnbNrq('P6DWIE< n^UE"
OLJs
]0kS
~H%R
\L4-
~LfnEmqn
)_c;
.`f("T
VXWan
1~#?
Z&B2
"rLM
a p]
1@851>Ky$>J&]DaMD`ox2skH!
rjSU
SE}f@'d
VBc8xP$c/|5D8H6!KHd F YO3
,n(a
mku2O
P[[
9h(X0Ned~=< SeUPBE\},fT)%
%h =^
_~\vc
?(;y"A
Wlmz
\ly/
%E3U
(- l
kF)D
N^)1s
p+\=
)JfV6DyDC6~[eQ=>h~odO{R5
0>@!y
AssemblyFileVersionAttribute
ct)}
Q/J|1
ZyxRk
System.Text
kOB<&)u
8nw &
C(pm(
ML31
511m
2M9f
9*\#
+ &.
(;#u
N[`go[
v&Pje%
Ib=L~
D2e-|
(TpK]
"= !+
FGv1I
$biFo3
>@^E+_qq<zWaq7(I5jZB#!(}!
6 Gq
w%&"
\k'6
WzZd
yCiH4=;q0rjsRE=ue{y9XM(~$
lA1cRI
o~%5
aNot
GetElementType
ZaKx6D,CgA?*p_wz@_28M u\*
BarZ'
I{6V
~"q>
1kcML
~vIbi
C"Kd$
x&]<W
tU} 5
(+
RDiZG
DRp|'
i;>O}
`g v
XGWC
s~ZN
y?[=!zl
Pzxmu
:b>%
5,up
96,+
l.,
lU)mY
M9Fh
fN H#
= )o
G6pr
Xk,k} @
u=dny10o8_*CIs6T\!PN$eg+'
5xI2
qF e
r j5
%ZbR
Q=B5X2
Oy?F
kwcF
x<H8> X
dHo:]-H6Mp@4jM&PR"|#!jE3
~"S1
c9EJ6I4W9Y}m9;;68<7!=}f>"
Z"\X
x:V3
AS9G
g#}K
kB\a
.X-lhUH
mUw'
~/?zKdG
(UIH
6% 1z
xW$'
p|%#l
+IymD
7/'C
y[{|gb^M
Rf, }
; Do
BBp]i?sr
ZUU|
g;:?*;
mu 6
K|+G+
FieldInfo
Font
.>zI
cd}K
=Vwn
Bgs^c
0
](l(#
'U^OK4
@DY:{!5O|ufk=7&d#v^Ch:^
_+pM"k
tw5A
~gk-(S0
h8q
)>D~
mWC>('c Tk[I2/>P#'CjI~M"#
+y*!
String
/!`@
Fu3<
_CorExeMain
1@,!,| `
:~89^`EGq O@L^p h*9*9! |!
nRlG
){)((#L^gH 8p}zj>(}j8C/-
[& }
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
02/<"
wvJ x
:gxQ
2!"/
^d~R_
dr?mo{(?N6H!_@q&;IMrm8DK$
=Pr>D
6PMS
F4Vo
v)u4
QN
d8fE
jm}"7
h%94l
jf,<
a<@^H
v6}k%[gy-f~5t"/rMyhqSgjQ!
q< u
{abL
InitializeArray
ubK+
^- `
bmi*)
7)o{
\%$de
u1 9
-.uG
+ xK,
n[J"M+=v
U|kO
YdlZ
T%e~
5TL{@
kL<f
KeyI0
>PIZ
cW<Sz
\yE=
ch}>
ToArray
T4$BjG
gC03
<0Z4/
OnCreateControl
+]HZ%
KhYI
^@m5~
9*IyQXV
^t1;
get_Control
UO E
KQ'3
a;aJE
"#v;
1$R7
j_<_
V,hB3
L+n%.
ao>V
dcjN'
cn]ppICK'>haDK98%&:,76s9%
#C5~ e
959}
"<kqu2?d_o_Rl5|h3;52vi*}$
jg)G
l*f,
,$]^
Md5w
L -dX
AgR(^L$gGud&rgqo@8N!I3t5+
d4l^
Yq+\D
get_Hovering
%W'e
ZD 8
ZCRZ
Jw ph
gFH2
ORIN7*
flLg"C
,/k4
r6luVRR>f/oR$0\~,n&9xgG|$
N&3!rP&,@-7X]B])@{={N$%B(
K(?sTmIY-phR4p2}c[=}r-5'$
:Fup
6OS4;F+4'~i:E'Lw`N=^MIAO#
J.lEC
o~lB
/#/1
.pl}
M_2 R
Load
%)'?F
2p@6
;>]1
x F8p
\'h
qN4
p'lucP
k P'V
t,},
System.Drawing
<fUNy? 5QJ
'Z
jo.f
!~FT%N
$K%N
vk"S
c HLg
(o_1m
|O>)
wIDAThC
uh*m
^+ -@F(Rrzj=#WIL8AZiBE6l#
=(L0
l+sy
$@5/b-7),=!)FW 7#=Nl"3yW9
%^0
bI:o
4o)&B
%?BB
&BoC)O($MN[o;e@y?D!>&myg!
[U]$IXp
BeginInvoke
V*t^Uyah|Y!]J(;)RGKSPK E!
p5nt
~ .k
-Py}
2s$?
;f=
*( y
~tO/mKYZ^-I@mZ/X[CK`_z`d!
NqVHB[
'eY>&Y
7z^K
_30V
qB}h+
/LZR:
zr:|
[C%?
;T}PF
Q>&l:
i{ e~
5H(sc 3s\f\-FImVYzmT1xtO$
}mWr
N+@:
r87h2a5>:5FZl-GrH>H~H+|q)
vwT{
F ooa|u
-5lj
EEwn\.
1"hv
\VB"I("-atjk[PqslN^I1QQJ$
}{1~
`j'g
?[ta
1[ a
3_%f
'7H{8
u`q8
BV/,r
?i0z
|McwU
>Lyu
RuntimeHelpers
5 ?`
To."
\qip
JI 3N
Xrg3V
XJ@{
A-~g
ebf1
UserControl
:PL^
g9SD
'?^8
get_Enabled
|GM}
=G&'
}n[4
>K8&s
Yz }Uf
V*a
`IkU`
fcG[Xj
f)+8K
m<q
S,"\
FO[_d
nP&JvlB
A'#2oRGHsZ-@\/w&r+L6PS3W-
G:{=
|_w![o
HK{~cz
$:@4L
R&70
Li _.
)h^T
b`(L
Z bi
sLwt
8]sT
Object
75ug
_}e e+_O`eB2F!6L;:+UEi!!!
LMtZ
Xcb6h
ZC E3
+"x7GS
aRrY^
<%q4
)ZLp
p lO
JIZ* (>
BaotW
aX%F
ZIHl
U^34
tIsa
ComVisibleAttribute
KJy+
].: p
=]G&
tJ Hw
VMe7K8b5srmG"EpjUwjQ\1\(!
+o7
MJ~Q<
AEzw0
-g<I
Evwh`g
?67asV
_` V
G X@
6Dd.zW
A fC22$
zwP3G
V\H#]
qF+1
JF,B
V4M1
h;J
HJ&[
.5>oG
eD,r
$yg]
9wj^\
^s*Pe)+Z#X`G7\BABkT/x4r}"
PQ$ x{5'
O[qRz
(@oUz
X("<
'f]W
e9FAeOMr>1x4!_sXiuv8J7pG
(]S4
<SY0
|9ds
j9&M
G#1r
!D+11?F:e[-k|*64)0PvF;Lg
e7I8f
KT!-
R'w\
sm 4
L>ig
1u:7y6q8uzb
}FZ?
Sfj@
u }Qh
),fI
Dvul
W?e^>3Vg1{^6r=Hx;MfskEa}'
1IQ1
OnMouseLeave
W?$5rA'~~1@:B|&hpqHOKO:n!
[t3{
N_Ze
1.0.0.0
5YA
k\di
8*/
Awr@q|
_`QP[
!:wI
/|soS
:h??
6&y&
'\6c
FlCb
Le+w
3 DV
= @0?
{/{Gq^et
MK'r
m*2;z&
Z.W-
0ad4&Yd
rCV01
,Y,VF2`;&&J?N\F7$#L52KOj!
@!}'
)uj
=TC`
[}'p
fKMh
$sNX
Stream
"=iD
m,o+1
n9@=
zUc1h
sRGB
Ac)p3
ZF unI
.1]5V#]|
Fn;j
|'
M<}!
\DN@
9b-?k.
zHEm
u@3!2= [?@l_AKBn5DzuT-N4&
CreateInstanceAndUnwrap
y]WJ
E[J4
#SV]0X
b>jv
SK0[k
iYrsBI(2
#[F#
LRIA]
* ?}
5*<l(v)$fj44N-Mi(/O[,,xB+
HiUn+}G
O+uQe
}7)9&
.ORq,hNVu
~J[FA
w$PW
HwtD
AS\z5Jk"9(:y>t" I1iIM(51
Zc5<
Sr%U
zBY`
k?/
TY*}
Confuser.Runtime
I zIE%
i0'WDN5R%
QKM}0
2ZcX$
p< kaj`
50}$
k# d
YY+F
T3C\y;
Rd8`lp;
]u _
Xvq2
}B $
gwbm
@+0
x@VS
~f1n{N
3yb`
cnS{dEh
C/z3o'&
6PXI
3GRt
5'4AP
tww7
,mvq
JP)#
:yiq
+CCr#`3+F2uNzC*G5d7x,C3Z%
,{F.
eP~wH
La*T=OUL
2:T8"W
j jl6
Y}3t
nNy,+V
r}"mH
i}A>To
/{F!
2\`K=ZNIB^-zU9FE_am!?(=a"
9 M
EO3n
~-ixa
E|H/
set_ServiceName
41-tO
ku"t6
0U!8|
CrGG
l0yBA'}<v0OD"uP-r#),ZZXV#
Ha
P"p-r]tR5X+7l|<qVY=[Ihct"
7oNW
)&La8
\v_$[
b<-X
v`~}0xARGZq]RmU^ry44{<Gj!
5zNh^9vfYmsNsbw*)<JN^2M}&
l+'C
xC;Q
"|OpR7~ FlSV*w6VaN 1 !>O+
j& c;(
Dq8Vt
_qMTG
GqV.
> pa
m<~/
oD$qj
G%Teq
h?k{65j
FaW{
*[oHK
q(V+M[
OM2n
]$/C;%xEEOtUu,FrV=@fCYhA!
%9i <N
>Whi
oYDN
iJPV3o
set_ItemSize
G*zv
k.@QI
cXW
,Nc
VnzJ
(. (
Ewt
f]A>r
|G,^}
p1 iN
m|HEbv>R;5_424I9{#-i<r#n
p&|O{
ckv6
y|T7M
eFO_
O_Tot
lBoP
KlWX
!Wd=,B
8B]C#
)~VY
YbL80Jmc
GetHINSTANCE
j;S
k5 Z
#.:-
SHE#
YI^+
Buffer
Q+}'G
(Vy0
a`&&
bv-f
IO89?ONh)4qh4}|O=JZeo[b9#
5V^[f
6gn h^
'@Gl
_qP=
=&a5
$mB#"qt_pvr\9P$P$7xalNrm!
8\_r9
LZ[L9<
(yD68
(O:pL
QZ^}
$e@q
MQ/x
o|z
Rp`7
)]yF
hT]sj
w))4QwL-X!"xoIvp\2Dbv}*d#
Lh|jW)
<$.
%D7V
%BU
M@_EXT
UAYk;
CJoO
R> ;U*
;3"+
sW4suDUWack[UGz@^Z;m|MP]"
b\~M
?vgS
S?r/Q>
36*Ug
q }C(
cQ7/
c5M
zxRc.
i1WL
HvTtB
XT%6c>dI;5SRmrVO)rk)Hl*d"
+ov'
-T=f?
U#~(~
o];gK
(0Gal
v[lO
l\yH
?Yd=
[\Pg'
) ]c
x*4 ;
-]Wn&
HH'1
h<y)
4c>S
Ij- `
+I'A
|IY4
tf6S
_**(
"oO~
w?pKd'$2|J{*Gb*zKoHF)2C*&
n;\6\
9CDNN-@->v=YAfV-p+3A'=zt'
"RiQ
=`SM
ArgumentNullException
y?h$C
~AF.
Vr\'iIPX
get_Major
'Ieb!
-%)Df
56/!
%p*{
eb.C
pJ-Cvk@modkC\gC<c;vY:"10
|:4A
a0]6*
0ZRe
R;Jg
zoaD
w !&
Point
,J(+
f"CD=
Lp/U
y]P]b|
EO@l @
~gB&85'7y\9!wG$eiO5p2(1C"
.O#Lc\8
v2.0.50727
"l38
ZIKc
Qow$
tHc/A25trkwX7\]c*\]<umWs%
c\5?
hNx`
B1~O:3oM
L@K#K
:A W
d!I_j(
%eM$
.F/=
` /P
xdn@
7Ag~
D&@dC
ze#_
X ^uO
<*"N
9V R
V:9<%,K
WNA6.
bg@'
t<
{:A$P3B")33j)LnO\0W<-:J,,
' &{
xcmyXD
L`
Kc6oJ
=^:zW
E&o'
xTFn
OLM;
1l4R_
Exception
SLx4
+hB}A
evE0[\V=
U?N
[W7{
#E7.
;Ji
oX&X
k^o5t
CZjd
\\-2wM
Zx~?X
sb.H,
G# X,
[!C_V F
wt5u
;|h
\^:& `N
)'N[
qlYA
l0)
'~-N
co; )
V z~#/
+OWIcyn-|(w]d#zf\S~~S&g:
yHs<
GetTypeFromHandle
IAsyncResult
jjt71
T-{
6|od
Y2RU?
w;Y&
A2Y1HI"+!h=tJG1lFn9$s{e+
.. Qv
_*m[
?N0v
xknU2
-3GW
Wb >
p-Ou
j\}Nw
GetDelegateForFunctionPointer
:W7M
`jf
<_$5j
Hc,q
uldV@
`G8zu
z]-q
UuBtN
<s;*c %;9IgAd"nDaS%y$-Gh%
suky
^m>-
&")AV63hVTt<|MqdT*%]xE:#
nGLy
4hP| A
N7}:
jt%t
zeG5
|U4w
7"9
V_@H
A4rK
,Q T
6)BhI
-e^1-
M|fv
System.Runtime.Serialization
_x u
{=XT
K<dF
:o~m
8V9l
s\R7
ycVC<
)tg=
ke3q
0m+Z
pT]e
RP
r V3
FVJx*#`$
n'Ym
KP
jubDU
yh:'
F1zezY
`?Or
YTR)
Xz4W{
`0O=
SDlg!
XK(.
sZSL
lUs
HfX3
gW<#ks0
s%Xss
ul?S0
fo0i
P|J N
j37n
=.pi
{Zw{
Math
|M)|/9bj[N[w#4i`='7`#ad
>Klr
/Q3*
631f
.4'"
[9}"
){F<
G!R w
c_vg
;=4'>RveIAY-T$\=u$bt3+M3"
6N7cl8
Qx!=
1$xn
C`['
~;&o
?(Ys
7KZ3
7Rn,
System.Runtime.CompilerServices
d.p(
/HM o
4WF+3{r;'1rs8U<3Lk*CH(Vn
&%E!o]
Bymg
kLIv*
_eN2]
|e/ r
SuppressIldasmAttribute
sI1$?

+[5k
FaNn[
2'b7
$A~
zmK9
Ot$l
)uIK
fVS
xCY$
IEND
=G`A
eXIsH
a].ZC
Q"`
U<Q6
IVRP4q
Cgg>
QBX =
P ah
p "3'
.i~yr
}|T
3Kb3y;
3p(t
9i~?
o5 /x)1
gN.8y
*y M
5"W'-
YTO/"j
OFHt
4Nnm
4y-f
/;G
u*K~j
oi59NHnv8i0'cdr*t=&DL_*V#
978,
w>ceCe
{h7PF
g9Bm
y^4t
1#]H'
Yr_+
0"v<g
YaUK,
wq#Et
Fd$,
u FE
=3{+
}wZ w
System.Windows.Forms
set_Font
P&:u/3HD
)=<L
_b38VcP`ZhH[V5O\t6"4}Dv"%
1;!A
9s1o1
YK_:"
<PJ
`IyZ
x(`=
l6i"
fY{Rm
.Jw<
'i6
IDisposable
dSc^LsLxyw|JuvZ_T*P:]"J-%
Iv K
Upza"~Fj_2m|TWPb+V:EW5=l!
= D
LIMH
Z1Ah
k6;xcAjg,^cE'z6S=!bh)/3+-
s_FI
#F=g
_IHR[
`24|
6K6
%Y#~
X|RT
O0Ia
zG^n6
50v5
q <}gH
tZBl(Y
-6hb
{8vO
uTK4P
.~kq
w<X>9E
# 84
Dbh6
).P
AKY^
*hp
\-?e
/l*A
sOj{c>BF~[A&pYO?4>K'`]'_"
JP9_
AssemblyProductAttribute
x^)
PMw.
+!fQ
%*5_d
Kv6@
68fI
Jji)
D{jZ
[^o<dSSJ
<Module>
t<whL8
H=*
~jo@;7
Rb/
I%Y/
vQ e?
} Vi
5]E_aY
@ :V
sw"<
J J$
iNd:
!*O'D
+>Zmu
MulticastDelegate
u=:s
eK#Vb/qcSDu!Sym4$Z/TWglC%
K*&G
@=e+
G\$%
's12
ZMSU~+
K;*Y$!1{erx<fW*6e%$,3Li|$
81da
2^cg"
!m_pData
1 7-X
T0<f
fJ'B
-7H
value
.,):
y2e9sL; m
2)oZ
~c xS
HM9(-L;5V{
2018
9\0 f
H]=-
Du?
)FWZJg[(dcJa,0}&=+14U%'f*
t;|Z
n?&d
GuH~7F/{NS3#\4=[3@3S6 Ws$
bhP'
]1$H
Oz /%|
(2uZ8{,wC02Jo8]t&u7%iaTH$
#Ir1?3
OnMouseUp
uP|
0H,11TZBux:rj~0g;E]5 :/V
W R%W
:y}]!74-Gl0/8a0`aJgm^$Bd$
%ZC_>7,NKh*E@nJrSS>-)o2v"
f>z]>Y
rN +NU5
/>8w]
\xZv
"$WD|
tg 4P1
i|y:H
BG |v
MvD/hMlG#SdAE"x5[v8^+dx%#
!?e6k+KZust3q>Y<7{&L;t_<!
WQJ^
n,N4|
)$,l
IwdX
#GUID
.4LX
V C Zm
Y,_:
73du
zBcP
=%5x<diI[w|EJRtIOD3KKw0e
~ L.
#5vgqB\RKX+>8c k`i?rLu:x$
set_SizeMode
.\?8
#9V~\cr
G8p oC
_L-kE^
`p
>LM3
W.R]
*0Z p
5 _J
8Mh
.Gp-
?yR}T
?$_L
9nOP
:M)F a
V{<o@
hqt~le
YN%
[+~K
IDAThCc``
3bnV
]^Ekt,q
/}3%
Euci
J_TPm
<W 8
&c7su
^lX!E
T?b
FI)'k
HI :
X +U
O 4&-
4J_W
sJ!W
Nullable`1
~9v<
yH=X
1`=
D3yj
>VU+.
t&}{
5|HL
*g-he
sxV:Z
ee)P
1-Ww
#S2hEF7M#@
4, -
@4ib
HP9%
5&\! h
:Lv~
&9,\
get_HasValue
/?[j#
^,L
A*O&
a,!f
k@q3
\>w)
]0.2'
8VLj
Tz 4*k
OEiy
8|5-w
6L;F
_2gg5.
6$+<
'aI^]%cA;8a<QeXU>xJg`(x#+
b'#=G
^N{$@
/Tce
rbDP
42A|
-uNi

,H{{
}!
Encoding
y#l0
tDvT
;!6:
P%
IEX
U |)
s#_c
N,"!
0,9[
9^n.
h"{!
I}t"*
4NQ1
T|wUW
IEnumerable`1
;g~5
hFH5bLPvs6Iw,q$ -sSvYY+o!
[t^Ija(
SyIU
sZAW
Zk X[
21hv(
get_Module
SiPv
TabAlignment
^h&u?
k"(P
5MNt
sf#$d
azeRQ
23.X
_ >1'
_Yu
"{yyu
QqF.
58)W
F +9
*A>gCm
^? S
jKw"
mKWk
\gq!y
_ RQ
\xk "
cgE7j
_<0y
Cursors
4qvP
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
(Key
tx}"Jy~I&aS(+!v09G*@STG@
a^}V
s`#rM=8iHKS[j}N2wg`I]zK3!
,NSu`@Vv
IM`m
get_Size
{uFK
1BN
zc5@"S
^8{E
RKYY
!\.&
e*%2F-7Gh:oH)r=6i"Z=1AfS$
#'Es
l0 Y
]i;'
0@in
ML=K
Zydb
qEmo
aK9 h2
x2nN
N<*
{QO;J
3\".o5a
0 4T
System.ComponentModel
Ark.exe
Y N&
GOTw
!da
LU5b
e X`
-0V k-
ba%C
436534A617CD86B8557AEAA31D433ECFF38B112F
#7w ;
a]"w
ON({
7t<eogUi'wAR10Q!qIRAc`Qw"
V $[;3
O>=A
;0+@'
LB+cs
Gi%%
@H""tc
(yO6
DisplayNameAttribute
C$3Yw5
``/t3[h=^YLt`meqI#M'a{[C
Yyp+
e( @
)v[o
lYWd
-$)e
]9LM
Jf ]y
k-$2T
= ~@|
,C0,
C648C0E55DD0A71600A3C979FEC05C180303B2F7
^\ z
h[TG
<UxK
-C`v
C-%+
|y:i
UKrpod
bi \
-.UN
H?ED;
k*qP
jvr}*4f*ua$[MZ@g1#w|3loC(
P ,
+4zohw
/Ah 5
!:%*_5#9T{9EkJcsxF)$rv-;"
'$5R0jE{<@l0^!f ~f_OkRmo!
^R u
AHlOx%
System.Collections.Generic
RN Px
2JPei
7 gK
E[)`
y,d
Bgg;/#-
!~
&vQT
YD/'
JmjJm
q4Zc
j!t3
s RO
O}Q
=Dv8
"TKp
DS06
set_Cursor
!2gL-
p,v2
H2e5"RhJLv]0d/N5PyI;1}!M#
%n3~
he_c
D;.@&
~xQA(DW;]4#GbTs/E?Y\siVB(
.':h
kq0'
p2t"P
4sxZ
.bpxo
07Mc
O]'}5vi@&c\0b3V|??y(]4U{#
<a&k
WriteLine
9I7&m
System.Drawing.Bitmap
fg[4
Te]'
o du
g85)
kN&A
hmnlS-u@
CXYyW
l&+N
SetStyle
LRGY
`$v_
G'+X~
e30_
Sh<Q
bmOw
YJJe
9 v({
2{uD}IzilA+uPl)A3^$({{<M!
SC]r')
disposing
BGU1T<V
1S~:
!AzW
{;xJ%
D6G^#
U> -
7eLf
7I\B
j++zbI7fAr+/h}p+c>UV+?<!/
"S$*i;eo&OIXTs4"H/#'o?Fr-
DZ%zl\:'6C5I#^?oaf5M=MaG"
Mn&=
"S:
xVpx-
<"W4
r@(p2
qrDa
MZe%
=b :
8r?2
L&u;
(
]^3T
c f|
LB B
8@!
!CBS
&PXn
Q\.Y
=0q]
t-;Vvz<dkSs+2\u,K=/CjXOm
+j^d
R*3\8r5z
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven04b_64 Seven04b_64 VirtualBox 2018-02-16 18:37:56 2018-02-16 18:40:44 168

9 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven04b_64 Seven04b_64 VirtualBox 2018-02-16 18:37:56 2018-02-16 18:40:44 168

10 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\idi.exe.config
C:\Users\Seven01\AppData\Local\Temp\idi.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\idi.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Users\Seven01\AppData\Local\Temp\idi.config
C:\Users\Seven01\AppData\Local\Temp\idi.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\Globalization\it-it.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Users\Seven01\AppData\Local\Temp\b52d34ce-a9f6-428a-9424-ccb7edf0e95b.dll
C:\Users\Seven01\AppData\Local\Temp\b52d34ce-a9f6-428a-9424-ccb7edf0e95b\b52d34ce-a9f6-428a-9424-ccb7edf0e95b.dll
C:\Users\Seven01\AppData\Local\Temp\b52d34ce-a9f6-428a-9424-ccb7edf0e95b.exe
C:\Users\Seven01\AppData\Local\Temp\b52d34ce-a9f6-428a-9424-ccb7edf0e95b\b52d34ce-a9f6-428a-9424-ccb7edf0e95b.exe
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.INI
C:\Users\Seven01\AppData\Local\Temp\idi.exe:Zone.Identifier
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources\Ark.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Local\Temp\shell32.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe
\??\MountPointManager
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2312.1273500
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2312.1273500
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2312.1273546
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe.Local\
C:\Users\Seven01\AppData\Roaming
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows
C:\Users\Seven01\AppData\Roaming\Microsoft
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.INI
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\c7cbfc41-9754-4c91-baea-8aabe7c39ca6.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\c7cbfc41-9754-4c91-baea-8aabe7c39ca6\c7cbfc41-9754-4c91-baea-8aabe7c39ca6.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\c7cbfc41-9754-4c91-baea-8aabe7c39ca6.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\c7cbfc41-9754-4c91-baea-8aabe7c39ca6\c7cbfc41-9754-4c91-baea-8aabe7c39ca6.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\shell32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2528.1278078
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2528.1278078
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2528.1278078

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\idi.exe.config
C:\Users\Seven01\AppData\Local\Temp\idi.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe

Write Files

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe

Delete Files

C:\Users\Seven01\AppData\Local\Temp\idi.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2312.1273500
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2312.1273500
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2312.1273546
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe:Zone.Identifier
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2528.1278078
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2528.1278078
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2528.1278078

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\idi.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3035fc5a\375c7a1a
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.ServiceProcess__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration.Install__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|idi.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|idi.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|idi.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.5.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\337da671\3850e7bd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\337da671\1b71387b
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Namespaces
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msbuild
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msbuild.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|msbuild.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|msbuild.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|msbuild.exe

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msbuild
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Write Keys

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msbuild

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
kernel32.dll.QueryActCtxW
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
kernel32.dll.GetFullPathNameW
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.GetUserDefaultUILanguage
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.VirtualProtect
kernel32.dll.GlobalMemoryStatusEx
ole32.dll.CoCreateGuid
kernel32.dll.GetStdHandle
kernel32.dll.CloseHandle
kernel32.dll.DeleteFileW
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
kernel32.dll.GetCurrentProcess
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
kernel32.dll.WerRegisterMemoryBlock
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipGetImageEncodersSize
kernel32.dll.LocalAlloc
gdiplus.dll.GdipGetImageEncoders
kernel32.dll.RtlMoveMemory
kernel32.dll.LocalFree
gdiplus.dll.GdipSaveImageToStream
oleaut32.dll.#8
oleaut32.dll.#9
oleaut32.dll.#10
gdiplus.dll.GdipCreateBitmapFromStream
gdiplus.dll.GdipBitmapLockBits
gdiplus.dll.GdipBitmapUnlockBits
shfolder.dll.SHGetFolderPathW
kernel32.dll.CopyFileW
kernel32.dll.SwitchToThread
shell32.dll.ShellExecuteEx
shell32.dll.ShellExecuteExW
setupapi.dll.CM_Get_Device_Interface_List_Size_ExW
setupapi.dll.CM_Get_Device_Interface_List_ExW
comctl32.dll.#386
ole32.dll.CoUninitialize
ole32.dll.CoRevokeInitializeSpy
comctl32.dll.#388
oleaut32.dll.#500
advapi32.dll.RegSetValueExW
kernel32.dll.DeleteAtom
comctl32.dll.#321
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
advapi32.dll.EventUnregister
kernel32.dll.GetProcAddress
kernel32.dll.CreateProcessW
ntdll.dll.NtAlertResumeThread
ntdll.dll.NtGetContextThread
ntdll.dll.NtReadVirtualMemory
ntdll.dll.NtSetContextThread
ntdll.dll.NtWriteVirtualMemory
gdiplus.dll.GdipDisposeImage
kernel32.dll.VirtualAllocEx
kernel32.dll.VirtualFreeEx
kernel32.dll.VirtualProtectEx
kernel32.dll.Wow64GetThreadContext
kernel32.dll.Wow64SetThreadContext
ntdll.dll.ZwUnmapViewOfSection

Execute Commands

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe 
"C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe"

Started Services

Nothing to display

Created Services

Nothing to display