MalScore
100/100
MalFamily
Malicious

win.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 23/67 Related 1997
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 486.50 KB (498176 bytes)
Compile time: 2017-05-09 03:11:18
MD5: 653d490a3b9b0924a582df196b518bfb
SHA1: a7bcf252bbfbd15443bbe11a479145c43efeaf5b
SHA256: 87615c4e3f5caead75d8d252cb0919fe24816810c5832442d67623962c9c2040
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-02-16 18:41:21
Last submission: 2018-02-16 18:41:21
Filename detected: - win.exe (1)
URL file hosting
hXXp://prosciuttiamo.it/ice/win.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-02-16 17:23:46 [23/67] VirusTotal
PE Sections 2 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0x45914 285184 05e6d50a27b3c5a2c65948dd837aa761 3547f3ea1985b1e9b05c0cbb43d8985849d8e619
.rsrc 0x48000 0x33a14 211968 6480be14a3318433113bf27366a948b5 8209cfb369e99d0c68c401ce75919bc67b039e5e
.reloc 0x7c000 0xc 512 f410d840191ff459daf92ad6cfd846e3 0211d2cbd3ca536e8141e5953165228941ddc53b
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x48130 209740 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x7b47c 20 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_VERSION 0x7b490 920 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_MANIFEST 0x7b828 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: Copyright \xa9 2018 Northeast Utilities System
Assembly Version: 0.0.0.0
InternalName: win.exe
FileVersion: 14.2.22.1
CompanyName: Northeast Utilities System
Comments: idebuqos
ProductName: LightCycler\xae Master Mixes
ProductVersion: 14.2.22.1
FileDescription: LightCycler\xae Master Mixes
Translation: 0x0000 0x04b0
OriginalFilename: win.exe
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Library
mscoree.dll
IP Found
14.2.22.1
URL(s)
No URL found
String too long
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
4327453a-7498-ca8
4327453a-7498-ca9
4327453a-7498-ca37
idebuqos
4327453a-7498-ca0
4327453a-7498-ca1
4327453a-7498-ca2
4327453a-7498-ca3
4327453a-7498-ca4
4327453a-7498-ca5
4327453a-7498-ca6
4327453a-7498-ca31
14.2.22.1
StringFileInfo
4327453a-7498-ca32
win.exe
4327453a-7498-ca33
FileVersion
4327453a-7498-ca45
InternalName
4327453a-7498-ca44
0.0.0.0
4327453a-7498-ca23
4327453a-7498-ca22
4327453a-7498-ca21
4327453a-7498-ca20
4327453a-7498-ca27
4327453a-7498-ca26
4327453a-7498-ca25
4327453a-7498-ca24
4327453a-7498-ca41
4327453a-7498-ca29
4327453a-7498-ca28
VarFileInfo
4327453a-7498-ca40
Assembly Version
ad97e14a-7336-42
4327453a-7498-ca43
Copyright
VS_VERSION_INFO
4327453a-7498-ca42
000004b0
LightCycler
Comments
FileDescription
4327453a-7498-ca30
4327453a-7498-ca7
Translation
OriginalFilename
ProductName
LegalCopyright
4327453a-7498-ca18
4327453a-7498-ca19
4327453a-7498-ca38
4327453a-7498-ca39
CompanyName
4327453a-7498-ca12
4327453a-7498-ca13
4327453a-7498-ca10
4327453a-7498-ca11
4327453a-7498-ca16
4327453a-7498-ca17
4327453a-7498-ca14
4327453a-7498-ca15
4327453a-7498-ca34
Master Mixes
<[x
4327453a-7498-ca35
Northeast Utilities System
4327453a-7498-ca36
2018 Northeast Utilities System
ProductVersion
74'0fhh +1f
ZQz0
z>dT>
(|F^
.-R6OQ
lbf%k
8N26.
T"~fU
]wgA
^Saw5DY0
tt)1 g
B&n#
WL'f
gSN4
ZZF0
hO$\
T9aR
E;Qy
ODO}hx
PNG
a /U
z]/C
tYNwB4
$a!}
,,J^s
ObjectHandle
. &6[
)g#,X
GEE:
l )ra
ResolveEventHandler
s3h[B
1bE
se"I
get_Height
>P[
S_0l'_
-kLaV
e:"D
xl4;'
C%E=
V v/
nO|m
W_Lf
*UlR
UT0;
_t"e
}8=A)JBm
6CK
RG.B
(BNW
1h<V
{#e
IXMiS
G([}
H|)
[i<=W
Xv]d7
.(!K
U+vY
n_@Fp
Ep6k
uLF3
z&q3
bqW#
Z`e#]
Nf27
AqD&
P Rfd
sSOep&S
PdB*n
8hys
_i1/A
E3$dY
N5V".
~v r~&s Q
mtUD
b{W"
(W8,t
9&{W'
}\55
Drxl
+gOC
j0 K
s=M@
r+J
K'<
NJoW
O^W
kj`%
P4ly$C mT
DFIJI
CCt*
&g9ZL
G3r\
58Q2
qUiOq|
<5Jd&
\uQ7
+ ?=/lv
3.U5
Qv0 M~
/6s&
6cLL
L /
S t,
rZE.'l
{3Ef
\]>F
pm/c
5>1Z
l+gi
Q\Qf
i[1M
w82P
IqP2
5D:P\
3yH:<
(Iu
@pUI|
|u&DC
RuntimeFieldHandle
IOiq
QEcL
?'1b}+
cC9
}IDAThC
58|5)
uJbE
dAbW4
Y_gS\).
o$pd-7)
#*5)/q
rV/C
~"vZ
78"^)~
sH0k
bPO\
/ Ic
I"swQ
j52:
{6?`3
C9!z
<D7_
s^ *Q
Cf+n zq
6Ijcxr
f#a5(
EndInvoke
@~]F
w%nu
ta-\3
s^m9"6
uWVU~
xZ +j_6R
W~`>
Ib xJ
l M6h
I_-2
$`mI
r9*c_
U yzHAC
ID[4
N#s_
9a@x
DP=
79f9
tB<Z
V:!,
ZiO_
963_
h|.[
ZY0
1n0.
u^cX
R0Z0R0
set_Alignment
5okA'#
AssemblyCompanyAttribute
i&!m a
#Xf~c
(M/^
.Q~B
b&bP/
5Y(>
GaL\'y
-}If
&SA>
7+_!\
eVdL
a|xM
Cik uO
( (\
$7[]
;g]O4
{B1P
Pr4nc
2*0?
= /w
;R{VY
}om,2
^o^
eKZ]r
t-"bv
##Yf^
qPi5?
>.[
O~=B
cEaOVo
AppDomain
QeL_4
_VPN/^6
v2.0.50727
+GD\
!9B{
get_CurrentDomain
#Z!
-m
11R=
*22q[&
b%eg
u%eN
; d\ |!
)_x
&$Y/
| {L#q
wzik
&8N
DCUR
c fgc7
:6 t
wu#G
iB(r
Y~y
MFR1]
;H-V
0x3d
3;23
Gn5u +
](7 3 nx'
NK1tT
=4x
AssemblyTrademarkAttribute
N& l
EF=p
Gn)~
sdGy
N ,PN=
tvK
=S-fgs3
Q)sJs<
m-*O
Eva`
03 Y
B?/}P
O%i\
.q|nP
l>8ut
_-0s
F{ -h
A{g2
q .}
t s{X
Control
u|yho
3:C!u
kE?}O
;UN
Hy@]/
ow|!
k]\1
eo#2S}
f)|,7
~@U<"7
K!|_<
}`>(t
`[{2:
Nl+6/
u;9E
k}qO
$VBe#
='3y9
OnMouseMove
EwK&
Taak
t,,
'~v')|
Type
FOgJ
)E4q
aD>Y
VtolE
,qeH
nTt8+Y
We]A
3"B1
^ f
)^+f
w:D$
#)k0
hMBe
h%8E*
h)7q
m`u>
,?g{U
l>=H
4\tY
`[[y
0W_4|
R1MD
;RhN
}Y,H'
=$tN3
eqP?JT(mA
t[Ed
<j6S
?2XU
ZI<i
h?[1;
7.+C
Z`=@
ns?#
+Q0Y
q:yer
f8l
|D3!@F
irm0{,}
c}Qa
Guid
.p-
G\vQ
<PrivateImplementationDetails>
Char
e^"cH:
p!]jp
G~=7d7
[FY9
C/Tv
VC0
5:G
Db6xc
yyZ}!
Q_x!
p"):
F$*H
;pY_
/RT7hT
t qQ
{xz=
`&/m
get_X
get_Y
CgnNE
x}>
7{5hC
cC6q
\!uK
<@1<F
+[CW
;)QF
Gmpv
y2>g
%<CzG
_jW e
FsuF
5\ k
w7DOL
5nNW
t4SL
/2=c2RDW
5Vi'-)
jy'D
:'$n
$Em_
Cgh<
QaryE
%%=r4
Fg \
xE-Y
kU[SX\
#h=X
gD"q
=K-3
wj3Cd
8sY
Ao
S5DT
]w)w
W}{K
Q`a/M
VBBo~
2Og
" &L
WN,)
%?kY
(FH\
WrapNonExceptionThrows
t %
=\?S!91
BaseRect
|%Tk
<*mnvkX
nOSp
$B3M
p1EU
Xn*<|
wX{6X
Component
lO/^
,2w
x*I]
K 0i
f\4H
a!JT
hs},
ZEwF
|<*S DV%
kz'?{
object
@JR,
Ob<'
xO>4
Wz5nu
L!k}
!^,C
[A)W
Ew4I
kx@s
{7q0
p3I:
j}9t
Dw<_>8y
^:wi
q>6
#C\v]/
r"PO
IS`\ZG
E]H?>
r\Dt
E{ Y
*]5-
Gg)F
1GtY
gX%"
pebz`
hL=d
-{V&
>B_d
)Lp2
la k
NGer
.A#jR
59(^
set_EnabledCalc
G{P\
r(zU
o9l5v
lh+*m
}[.
4*|5m
-;m!wu
i3?Z
b]Y;aSm
4?+:g&
~md L
/t
FX}]
yhU
CMRN
p|zJ
F cu
/ny+
o {^
VK&Y
IList
Fn+GN
+> E
R-L[
x3j!5'5
Pv}
=@
`-C`,
>D_{
.J`Uqo
u Wr
U:sT
]P4%
b]d
oS
s](u
YDr ^
5J@Or
ResolveEventArgs
t, 2
.sBM
? ^SS
ArN9
*#:h
`.rsrc
method
f)_5*
SJVOP
mZ_*d
s)c@Z
e7H>
54&M
D9_G.
1 yO[
WmY&
eD~$n
get_Default
'\Sz
}iHwA
!G# Q
'$YC`
VUbpMo2
fQHA_z$
&2qC
result
' Bp
Tg9k
SVrTnif}
{,wdW
ZT_ \
* #9
\9_o
kZa9
tINRi
iMk/
$LQI1w*
\B}
wxF@
Wll^
:wsR[
`>^7
=I~fRC
+l:7F
3 f'
MvrN
GetTypeFromHandle
G?zD
?<&l
/ }"
:Z "%
i0+M
YR?F
t+#v
&lu (
TWht,'
z;Z:
L< /
u./`S
9+ 8e
wbVA
o!G}
4ICIq&FRl
%@FS
YjRo
c{B!
^/9L
e~/&
;l wA
cU v
?2p
c/>goy
JQOr
uc92
q+#8cl
MouseEventArgs
R_3!y
]FiS
NWGRX
fP3g
wX^Jq}
kjbr
~E1@
DSgQ
(j:+v
iL9u
L&MI
xt'K\
&e^y)(P8
Nl66
{ n&o
`MGs
}e?'
2`N9
QFc25y
6_p.
1$JI
\R;>
IwWDer
aT:o
y0/w
cMxt
6pO
<*84}
U u>
3fEy
iERU
,Ixgv
KFTvd
Uv7`
&^n2+
U{S{
S;$X\
7t_g
JK r
.$m*(
D}[i
ewJt
[j'o
n fr
E#
}4akRl[
_flQ_
ttD9
System.Runtime.InteropServices
@4@\
;c |
00)
%-:&
5 @>X
`m4k
PN5-
)=G'
wU_=lr
get_Assembly
)9i$
cgPb
BHxB
TWTJ
e`ke
| h&
hJ$M,G
])Ol
E<HN
"3m
;@t{
m57,
8VgS
/RT4h
3 <"
5N(j3
Twsy
p\4Zv
9J2
[0E'
)&r9
T/Z9
F8?<Ui
nS%,R?
`4;QTT
j1_l
L~;y
Invoke
4x_{
IHDR
{Ot#6
0?Q:
q+eN
adwnm
W0Py
H68*
IhA."
:'),
m|bv(
;?k$r
I6+z<
Console
b/-g
eE@6
+I3#*
<3.>
Zw9o2\gC
~B$/
Zt&*B
]C68|8
}](`k[&
iL1aA
Vz4h
vwX
LcX
@w1Z
b[pt:
32{B
Zi[$
<5}vO
IObjectHandle
RwW
<:5(
xcrRv
VzLYo
PWa@
fd;_"
;&TN[=
J}i)fQ
hCX<
g,,!
a)1L
3U/,
99;'O
I&#|mL
{ .B
'e9O
&*8E
DS-F
*E<RI
uwCb
0[dD/{h
1A
eTz;
OverRect
&*8p
1pR]
R~c\
3^4
.cctor
&*8x
s4Gj
oHF"
$ hb
S 8g^|
@#qN
"dZtP
$AfP
`pXHm
~ Vp(U
Vk ?
rkuT>bW
Y ]|
=b~nC
-t z
$sH8S
5:8E
hP Q
Vz":Tf
T-5z
U 9!
System
}:}D
Qoy?jR
PdC-
&*8z
WriteLine
Ki2,$
c ?
UF%7
&*8{
Incarcator
T=+c
8#Pv
~Poot
~@i7f%
'Q!G
4n$(
qegl
e.{D
g .1A
Mbg]@
37vrg
bRKGq
L.N
fgQ:
V5Ny
l%/_
Zw-T
wip>O>f
x|B8
Fua0
A?"
)XpDBA
&*8c
Hovering
N1iV.
Bee:
*b\A
MethodBase
#Strings
i&K1
=SY9
Font
MC;e
}=SK
K8@Y
R1u$c
J\Or
!4 {"[
t AM9
8*6uJg.
stT`<
\m"*
%S*h
]#V3
g-\*
6}avzu}
iWz
,vLsv
q2oe
Sr23]
%K]9+1
/MC!
>}cl
)e~U%
<YZ39
get_EnabledCalc
:IXW
ryIy4
V+n-
>%+>
"ND)
/'Fr
vI<,
1`\j
}ARuO
V+;,
>+[V
C f px
rNyz
)_I[
J}]m
:W]Q
ebOs]
%+"T
RpuMOO
EMDw)p#
2~KY
M *v\
D h2X
g]S
Y~0D
3{Qqi
EventArgs
%7)1
41(^
fv5*~(
Qc4
C#T!
KhRB
<@&5
w8cn8H
gW-A
]r&7
`nus
^6TxlH
3*!C
Z}ts
g+a3r
GaQQT
8P2~
4}9o
=[Cg
#6+V0
; onf
51vM
'*~U$
chj?
2 gh
u"@b
kUGHk
!J0-
h>qH,
I5q>
qnect
mm+c
6v29GtnS
Z ,w
'Z#n$ "
+@ E
3h0w
9 e
,(8.
XOtx
/C$
" _1@
[MQ#fDLP
466T
System.Collections
@?%`
_A:c
0n`Z$
l1l/
;RUD
Te}P
ea9E
;3bfgY
TabControl
GW!J
s{bt
KR~O
u13-
PpaI0
\wiw9CG
A?1:\
vk^ b
fM)q
~LeDmV
Y6xe
f{3^
l<C"<
}Kg,
5"+?GZL
{[j-
X'uz
L Q
va3o*'
Array
7B{1
WUZY
>0G*
Color
o:W~
?h6r
dnsx^
?o=
B|n4
[(KwCj
System.Collections.Generic
1B<^
d[ F
Nc :
{4J7
;(d7
set_BackColor
0ou_
p;>/
?j*(
H|d%x
> o$1#
ygElf+
pb1<
.tSg
!>m
zYy
aTd?
96GYA
d&NW5
A."K
?{uA
+d/_
j 40
SJ->e
Y<aTk
D$[E
&4Fj8sy
/0OF
" drm!
Q<;4
p[nG
YAK+
_z4O
TWWt
"^ $
%) -C
T^sD
"9aLGPS
3"z`
B$i";M
TFb*
E2]RM
wj.u
yjts
#CMfl
)>nD
6724`[
%r l=
(_~G&5
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD
j&xx^
Tkk*
"T.W]
C7b]\
,KBc
?Up$Z
\0 u
mJe-
T>:}R
AtmY3$
4{F.
%WCA|
-4d
dKL&^
jvxNr
}XiV
1#Yc
%h_s%86
-K7 \
PI=FC*
wo64
RMn l
Y,xm
xMG1
e4^g
I oA
-s`c
IAsyncResult
Erx>
'z#xj
?L]@T
;f.V!K
7}z=`
,RX/
R2q;|d
xS.i
435]
*%6D
1'&\
u1xk
|qY|
NOwN
tb
R/no
^o\K
,x^[
1jle\
5s]Z
Yu`jf(5
uVP:%
K%qf
MM8O
,-Yx
61nZ
Ct5x
z)Klx
ZqFmA
eii
w'ND8
RvXq
riQz
U;c}
a@ue
'xHp
a n7;w=
s,oj
p;v|N
8Z-0
1QdA
`i`{O
{v+&
'0?P
L$lU
..[8lW
<R%%
gJ%)
~u/j
G-s|
n1'
{IDAThC
g_XG
jX G
=N'T
G\F#l
Sj3w'$
N)Z
TabSizeMode
QA-^3
QsP71L-
t $>
qPov
rd1?b3
f0@m=
jL@'
s0e[J2u
0 Z{ECvx
]iH.&
4I[+
toYI
3g[
remove_Click
in 2
?=$}
gJ%V
SP0b`&
&/f
}kg}
L&RQb
xIET
2QrJ
[L>b(
j$Jo
s>sXq
+E1!Ro
% ,$R
*B[@#|&
V.m
`:\D
oBC3Y
TzeY
TaZt
+eP
2Egb
8,}j
|l^F
+~$N
P29Wm0^
`&nf
\/Z"k
hVR
Contains
#cNG,
sq P
DN*v1`
`cTG
NCLLk
V@GYK
g qK(E+
)=FPar
UI:xFX
6:g|L
5 <!
"A{L
5; &
,<#A
26gw
JPOr
j%':
ValueType
Hl 5m
o M7
rFzu
GuidAttribute
N$.1z
` &M.,
{v%.
GDV^k
<2c)
Itr}
oy_B"
B7<>
System.Runtime.CompilerServices
l ~"%
/U_r}]
e W>
fC8l- !#
ck,[S
~[^k
get_Count
=]#
9.?K
DNfQv
^ 6K
V;a|
fZ G=
aa`"1)
System.Runtime.Remoting
#5n ^
2}BH.
`R:3
EkvQq4m
tge7
?Jez
[ iL
fVE*sE
IEquatable`1
f@x
Vb!
B2sG
4cS $#
~D$]
<A o
718f
L }SG
|GH
s&nf
E&9al
SuppressIldasmAttribute
PFLK
ClKK
R|.>
<[Z 5
-@^m
sV]g
.s(y
E<JK
M1F?
q&com
T}Rg~j9
Wb-
!aQ@
O<{X
(tE"
RTGa
aVm"^gE
Am^p
#N9Os
ICustomAttributeProvider
K T
ToString
==>~
S5qf
*i/a}
p V#
4Msr;z
#P#
GnN~tX
B`R_,
VH9n{
WsS9'?
;8u:
!xpQ
S{-r
CPJ>
yBEC#in
ksO
k_Uwu
;:{
F5JYm
m']v
6Lt8
C U+:
KGW`
(G5R
6Pf
M78
Wp/gt
q;n1zf}
NxX)t
Mpy@@
&,mqb
+rFq-a
.B4a
Q! Xw]
vJKx
]&-'9
Spcq
as&(
eLV
U3nm
-u=kC
Q%H#
NblA(
e4}=
&o S
C?H{
76+z
AssemblyTitleAttribute
;}.<1
s9|o'
dl3c
d 3pJ
YC`5
t.-i
ZcQ[
ipf1
3W-3
h_CE
$fef85586-54fc-4293-851c-7ed17f06b400
S %i
M()
`B ,
jCEIt
J^_)
D2!&
+Nj)
cywE
/Y7 A
o*`@
Qg3W
'ZvJ
[ Y2
hfE_
G cg
9G~F
-\0|T
vjC;
!orI
Tx%.
6 1j
BR$W
Mt3
|u?..Dn
#1Q/
`84c%V
!XI)$
cuP/
}L8v
;wO;k
QQ=f
%<vD
|+Kv
?wu3
<LWp
=9vh
/Bv,
'y_N
Data
w:'p
XgM`
P,iu
pnE> E
Enabled
f4)8
4Du}
>[Up#
jHns
jML5
D<`B
8}
zwBG
N@ A
lxB:
mg{0
@^ j]
get_EntryPoint
PY!&
">
^;O*
mh_(Lk
pHYs
.ctor
u w`yA
}Q;L
1Q{G
CreateInstance
obNt
get_SelectedIndex
/q14
1B,[
mscoree.dll
lvhO}
S;=p
"X"D
&WRu/
j8u>r
I20#L
Y~Q>
~y1O
n& F
gY\Fv
Am{M
Main
$yZ6
[jE7d
E47vK
5HAk
+NrzV
callback
i7''
u6]9[%!
z{~k
+ABm
ms -x{
qR +
swUcH
b\GK
WR)<
cgP
6?t[
XUvd
vJoG
1DSq
;^%q
Z$xE
Eq!r}
~lU)V
QT:s
!P~-
3cg%b
hyPb
!ab8
=3,_
(H0dm
oRp%
A\nB(
wY}
zHC;
<U1
Cbf
Ho~n
OP/0
get_Location
rq1N=
89x06
iSc>
eOFr
5G]-
:}8k
?Q:5
@.reloc
t}Sy
cO)b
XDNh
RG?
/Eh{
`cs-A~
zR /
CNOpXI
/H@B
[/ZV
lU/ eQk
wkZ`d
OO`e
{eXaV
BiM=
Byte
Sy](
)dPp5
k_;B
Load
|FN_
V@1n
Yd8S
%(/#
+W7fd
_ yo`_
MW%U
K}Bw/#^L:
Au0&
f#B:W?6K
x=^X
^ME 8
~F+B
Ff={
5~i`
( e3W
v+p+p+p+p+p+p+p+p+p+p+p+p+p+p+p+
Db:p
hC*
H|TD
2St^
U69N
g+emg
![q2
#0`t
N'H{
Xx_pe
hw@4,
Nsvm 4
p
4!\R
set_Font
-Lj>[
E_b6
K?"i
6G5
1II3>
x`6A.
M )L
#O9h9 w
Z"}C2
A0 *
st"9
V39#
8:a^
]7'G
.text
w;61
1lF.p
~Oiy
!e}PUl
`+ (
Y 8l
e3"&E-
[ Y&
ID5h<
#Yk;c
^+nM
]#1 IA
EcM)4c
"IVQ
|1.hR
[$s
hCK!
ID7"XC-]|N
Jug'
](le
6Sd,eh
>Em,
w ,%
J$
6}:2
~zp5
!YR;9
3B=|
o S^
d \e
b2]
~]+ Q
IDAThC
QOgU
jcmDzJ
A!3"d
4E2BE99140D24066CADC84F74FA899FEE5976B68
A5C3
F j)p:
EJdx
A#oi
2* @K
pbfP
R;~G
.<= ;
2M_?u
RuntimeCompatibilityAttribute
B2H*
7-R^AP
g/A?
d2pm
/cUfh
jXHo
hJPOr
ZFsa
K- $
Qdf58o
CXRW
'?]fha
pruF
]Ple
IDisposable
#wez
Q= i
]Pl'W
lV}b
M`js
c ut
B';gF
6_%}
w.mp
Rd*r%
H ln
ov7Ca
'-6D
WijJe
Invalidate
jT+EH
3,vkQ
mdTAB
wsr3
CbTwyM
ZG_!
C~r[2
rubK
^$C^
'0a6K
3PV
2Xf^
8?Mx`y
OB hE/`
M/7"
bVn:
E| N3Q
yjL!
NewGuid
v& _=_x
H@n4
cj\[
set_AutoScaleMode
6<ZF9
D>YJ
g@|2
tX[
na.Tl
OSEO6
G!uW
E\R#H
I.x&a~
s@P&
a Q\
XHr.
@qU(
lqR\
Oj Y
X
|djN
a~C=
IContainer
kykKI
O?{h
/3 qg?9
24w$
5=eZj
AWs>
NSP,
y yB
;mE~>
+D)H6
^!;;
P#DU
?3Dg
09<:
N23`
NNIU
riiG
SgnWd
T6&G
,9;&r/ mz
u=[k $N>&
QL;il[
X z
Oea`
F+E_
10Kp
VH0nz
wvYN
X `
VH0n~
K f)
z=F
<.>N
j >=
' +f
4fM5q
#=cx
U%N.-
'n*n
u<B!
X ^
kUm]
S,.?
^Qot
wx;Lp>}gPyEk
I;</Fg5
N]dN
WtY#
X5oV
*0ljQ
StringBuilder
c^%)%3X^
<'mx
S z|
reag
!9r|
[.5M
vfGv
K [cC^
oIvM
MM
yUpM
X *
x+-^s!7rF
lh
Uhp`
X<Jb
>_%?
l 5)s;
Nkh-
[m?
jv#^
?Pib
W~0w
mH+d
mGe_
k(b7
ControlStyles
us1:P
X
oB%75
)Wbv
|?d
f![
:[v{
zX21
Y.bd
ContainerControl
ugX
TEqN
>G5 g
! :
Kj^+
tlp7
+d{m
kr*K
193{
51"U
af+4
%~Pp
A)K>G
a ,n/
ZU^J
s}@ENG
?8uv
6{aW
t@GYK
C6APh"}
4Ws%
,eM8
d9k8!v
1uJ:
}00!
EXMf>
Yjlb
X}D#
s:'8u
3F1764884A245F1B3FA91DEC2E25339F23787561
n (9
C9UD
M'dx
rwO!_PJG
v":8
AssemblyProductAttribute
Gq>d
}HC)
Assembly
5 |_
>"2FFb
]Jv0\6
x;jj\
" ln
> ;S*;
0 Pk
pB?#
Y@<H.
9d}s
i|d0
) Lw
I(pw
,8bw
#rej
AssemblyCopyrightAttribute
L hTS}
*/X}
dq<@m[@-
A+
@ ;w
w1<9j
n='
3 /tw
<G)|H
o1,C
ZL s
VB~+
v4c $
m~R4
)$_C8
/ox[
y kc
G*&$2
@U$y
&,m
a^p
_@/f]
"X~}
qFR
aSVn
NO&jm
&Uc;
IK N
OqFM
Y 8z
azPmp
pRC\~
uhTui\
Y 8r
xOFV
]lY9d
%j=G
Veeb
w<{
y,4SJ
Y 8X
~L
89B2
4mQ)
}-8
$Lyc
St(ofU
:Rh&
Y 8B
ArFMDJ
z`#$
Y 8D
BMitOwF
8 d"
Fd>2;$3
]| M
Yb_j
*0Jj
4Y!c
py6r
UL={
MethodInfo
BSJB
J1{~
set_Enabled
@'h
qP(b
|kwJ
uUvL;
M*~ N
N=$L
get_OverIndex
kIA!
Sw0S`
*
Vi/;
{B79
gLsu
J~`L\
G]x
QwprM]
YaI-
UserControl
3uo
b|SfiSk=|
?1~Y{
`Wf]
k9*]
m4_jl#8
@Uk'jU
?aOp
x69D
V7^18
e&pAu a
Q%`+L
%?t'
z5X 0
o;>!
" z@
)m-Xp7
gAMA
up ,
X%vF/
!f4}
3I :
~y t
n03_
AutoScaleMode
Y'uX
U lB
MarshalByRefObject
gI\
1(Y&
'$GWa]
yZ*m8d
H'So
SB1D
^f4a
J480
9[ ;
'N,x!
: -i"
$4FE
qPRz
mscorlib
b"zT
_R{<"^6
ClickEventHandler
d >V
-$t*
YKv&
oGU$
mKfA
`KBY0
}Fm9
bn'!bo
]Yx>
HK6>.
w60|
.;u#
Kp D
#xmB~N[
%v% W
m}%@
tp$_
get_TabPages
<De$w1
uwn:
7B[%
#[9e
jM<E
09vL"UWQ
i5[%
Ch>'
f`xFD
S=I}
]:Y
_1Hf:
mMVf
S`zh
%r l
0I{i
wuH].U
Epg
[c.*
lUY
Tu]%,
ine
EA\,
fW%Q
!f"N
3OL>
get_Width
U][b(
aH%;
tw#7
D`<0
35#cq}
System.Reflection
H\O|
@K>nt
6Etn
ScLh
RGGp
eQda@'
RT2k
Q HA0
&Y]0 bc
RuntimeTypeHandle
I7*(Y
hKhq-=J
!Ps.*2
cbP"
h0@V_
M's^
wBjs
#!/U@=
_S*I
7Rqh
$<^\
B||O;
=5rN
:sd .
FGc*
4ykh
Cursor
sender
&YEo
#[0I
JkG%
o Mk
y[{
5AVb&
vbBOj Z
#^w
System.Core
a.62
Size
0]6k
Append
L9 T
YPAs
z$1qrm0
y.n%
System.ServiceProcess
N/LU
m8 e
Ni}aQM.
bZL:
+x"WYh
w?.>
{;CH
G)I/
A uws
V@G[K
30}9
!G'!w
aB<*
,paG
C1]%
F }+&
t4J2
AssemblyDescriptionAttribute
mYK<
jN_myL
6Pad
pPl
@~#D
P([p
oiK?
mEBY
!iGI
RhtF7
V#>w
G<hf
i3-=?
]ARW
YzX?x
N5^&
2H^St
L7[0
x3>Z}
AM1#
_wlH
S,^N=
mP/1
:(9G
OnMouseUp
G BI
Pk/!Z7S
mTB"
;l6?
K~Q:
-QV%
g j+
)HAf:k X
0(I
aO8T
ZE*(1
M)n59
bps&
C&}x
Hc_5
dKeYC
)8`
dy9)
FO;sa
#:v(
%$e'b
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
MC!$ E
5s6Z
ug\U
z*^b
ZV/c
Wxs\
?k~e
9RL h
>xZ!%
:zX5
KP$D
;AZ\c
QM|=*
& /
e z{
'u&.9
get_Message
!This program cannot be run in DOS mode. $
gCVV
%r }
|6(Nz
M'Ii
e-O(
,-KqS
d;e;9z
*7A9f
\!( D<
Dispose
?hx\
|A}J[I
j/8A~
nc[1
6)D4
YCmk}
]>M1T7.W
z$gI
#DA~
olIS
X!-l
Y6,9
|^G]
;}JLk9`?
*xOe
z%sK
pIQ0
%r l
~!y=
01
U-'1
-# c
_^k.
yVQT
=2">a
System.Drawing
FnIa
.,kl
"9FA
(1RJ
omC
T6c)
"Nm6\H
!#a:
\) .o!
8X
Yw,,
S=t
z: 6
s$ VWh
>c_)
3nn0_
DbEB
$/`qu
:E]
]epD
Ler:m
6.^V{
a`l
xvXt
Y)1v
dj>8
p#"_s
jF6c
VV@M-g
S^yWY
N\ip3
D_5f
j4&$
yWf;
(^{U
[+ )
p|l.
V-w3
K!cw
U!|m
_'q<
J78%
y'GD
MZ*T
s"tU
T%83
F~\=
Bbzt
invl
(R,F
^ w=
kk=8B]t
8j}N
-Iwe/
BBK
]G}b
-682^
AOATw
l! a
b \*
f>z'$
mOYOy
ExE_a
2.jW9
4HK3Z
|#=
V7"R
CzRI^
83)+(
set_SizeMode
:6ZZ
9:1n
c.6j(H
A4 L
+f'b
CI,6
~({V
sA&o
R,uI
System.Linq
}@z&
vI'7
j<0J?
Sfz
G& "
gkG]\
BrKK
Y7`"Q
mfg%
6| ''p
D"KV
KEy
OyGc%
,J1O
f. pG
~ mxB
K)gR
Tv!J
27J
S&=I
I=z U
n}6
!EUC
C708234F139063BBE3CBE2208BB6ACFACBC50333
V`">
6p}l
6p'&]
InvalidOperationException
PD8/
aK_-2T
=<\
$s(yH
8Kv]
T 7G
N IA`
/aM;-
b9fbu
<8ds
]0^
DU!)
gB=B
k,t
,+<E
-JYm
Er,A
{x|'
;~Si
={}yN
EBV)t
P6Ko
,CPj
>HsI
-<B+(
oS)9
e1KQ
g*-E
c^SM
>H@2
add_Click
J !9o
[@r3
hU [
zB6~J
3^
$L<i
Xrhl
<.O<
Click
ZXZr
og<|[
8W`8
a r(
0;al
V1$`I
?u8o
LG{~
$QI1
PU$s
,P ;J
S {E
w:}?
H-?n3
"vgRs~
G:F/L
CG`2
JL']
FY 8_
12TI1
GetTabRect
]e6W
/{g?
"M>
#u'j
=lV)
[<b@<
`|DCf
=On!8NKNL
hIf[
|lj
g5m)p`
P[^pN
Qc>O\Q
d_JF
VdN .
00`oo[b
gj &
(9s Y
6[7u
cNMfN
&EVbz
hz$E
set_ItemSize
qjhrzM
,UEnEJK5
QfS1
2_&R
cfP
S]iG)
, 6{
[z^ {ri
PmZw
Ark.ControlFolder
iyD@
{4S($|
'lrC["
^$1k
nL@-i
^{Dz1
xc]/
Zv |
1.0.0.0
KZe9SJ?
"c@M
mw<e
xAu_
d3WE?
*RT0h
CompilationRelaxationsAttribute
'>R\|o
kPB&
)XbV
NS1>
k{o
TabPageCollection
Cmb1
for+\AL(
mj;p
87Kf
8[]
YoK?^p
fUnS
Oxw%u
C~pr
Ej`"
%}aeh
*1V :
2"g
o)F(
bCIlr0
CH0jR
w(c1
~)1D
SjB I
44vx)
Syw\5
6BGK
]L=e8
x+(F
{ )2
$?@s*|-
gY}J
cXM8
caQ
Ht~OL
f_Fl
OnControlAdded
'y -
4r8K A
^[/t
RaC#
wo:
&\SS
GeKn
]}Gn
+<4
7Le Z^
EVDo
/7N*q6%0+a
o\M.
={O4S
<-Pzy9
4I_(
;VKt"
-, :l
\ 4X
bu]`"
;j9N3
a#|MV*)]i
=un*
{Oa
5>fw7
&jwd
;-URUfZ
aj^sw*
*OLYn
<3;
3v{
B,B^
:x9Z
String
= [LI
nLg-
/#~Q
T\9u
IEND
AQlg
.c !]
_|'=ar]
<4e}
/_9L<:
.|s>
HH}o
W+5t
D5 4
[m~!j
.>'&
JC#<
GQ4 s
0^6_
) ZF4>
D52Q
N"G}
#GUID
m8 z
tBja|
f)DP
"<d[
wn'b'
=2X2
]dh e
LdJ$
Z2|q?
S0T
kJxK
w. XI
N>42
ziz[
+``$!
>5Y
tL?K o$I jr
U/l_>
(Hi1
9'/:
lzb,
Y/8c
),2G
get_White
L+cD
[4@e
3+f 8
[spMa
0-+#
pHPy
Z2ZG
Concat
F,P:
i`Kna
=9nN
ug=Z
$*xm4
/@7=
(>_)
eD;'
_V{H)76
TE>m
`#@Z=]j
*@J0
Hji:
"SH7H
avVc
ZE6a
V(q&E
S^5~Y
2ZQ 9|*
PajQ :
)oGrHGe
@1l( +
?iR=
g~\`u
=\]o
5nvT
v"ZJ
zA7"`
{H156
get_Hand
:{sv
6]#X
a,b.
C!bB
xaB(%
[lA-
4A2e
XQeoOn. kb
2(P)
K8Yg
1.7FO
aRk5
Q 2Q
Z"G
)?!
g T/
!ds\l
|,~B
b\.a
MGfp
t:n
' ;+_
9W,b
5Ly+
#kWG
5 PN
\0;s
t,)\
m%,o
KF,y
y!B'
#]oc
$QHF
\ T5p
AssemblyFileVersionAttribute
"YKe
CM{$
System.Text
Xh.c
5 &:
6QI%
AZvf?4
ok<v
{:: 7|
KJ#>
+'XC
j+XQ
mr/FZk
Bo3z
vtw3
c2_Uj
FF:f
KiT q
]*1n
] -U]
}@@[g
G9Ha
]aFmCE
'XDi
?hQ*+@
A^uk
"a.>
sz &
*l`(
vtl`
w1?o
WdU@
c]\l
~w\
Ak!s@
C'@V3
822C
}.H;
\ )a
=%c@
CvG
k #1b
nA7>r
0NT*
:iQXq
W=!
A]X
s6sy@
?=c`
Q]=r
[\Q>
kFbE
Ev'}
~JpA
=I-R
uIa
B8`,
#`vj
Gcol_V
g&'6
Ke!w
ZMaI
:"T#
k?f
(?Bj1
nNOw
kGbo
x,O1
}O8r
> e-J
i]%Q
\af7
PbHl
4k,K
e"qU1C
>mzd
+a\dj
gS4u
{&s
b4 Xf
_CorExeMain
|<8
}$xi
"-T4
vDN-6&Ck
;qlt
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
x0"M
<iG
<Module>
V:^8
DEZ\'
%|R(
Y#v"
*j@>
E4)_0V
x =QfB
% ,
.Ma
W"GG
6l3i5
InitializeArray
c M]
X
{u}
>|Or
ZPD}
Iv! S
I**C
s9, aH1
d}h!
>8*4Yh
]I{nU
set_DoubleBuffered
e l%
ToArray
xLGF
'gTwr
Jh`D
lMhFxa
OnCreateControl
4Ij
%U-w1ZU)
M=J,k
m1P
2y~
q@L
ZVduN
E47?xM}S^6
2Y*~
4a "
MOs8
-zdb
c()9Wa
/&TQh
Vy/v
2<4YU/
{4-Bj;W
V kK
,}BO
e7<,
fjK[I
V)<zU')
%Owi\0
Enumerable
%x&/
*~qT
-Q/{G
z@)L
|1f7
\JIw
|
}IJB
hm?^
3L_ST%0P
_Z)u
qA8
2.l"
8:=Ur
Ha
QF2Q
!9&nh
U<{c
f(WmE
^N)
0Od}=
QtnI
get_FullName
>[y
=Ge[J
1pjug
M;9R
gza(
6Ob]sd
QM2S
~-fBG
BeginInvoke
]n 5
get_Control
ZhPw/
/4!?
Uz: Y
N@(w=
P<:7
-otg
G1n.
o Bo
$8 Qi
^U r)"Y{7C
@u!K
S[9/
E|P'
0dG/
c@|cQ|1V%V
zc9yR
'Si
okfq
)gb"
>cD/
<I4
4Ww,D
Ea$^OS
gQK-E_CY
QeBd;
*?I
Ty s
?[16ee
4'ef
RuntimeHelpers
ce+
$~wb
=N[u
Y=~"ud
OsUFIy
.oFS
10AW
1_:.
B #X7
:fvz
?4Zr
C{".
XcO{h|)
ekJ/
Yzpjp
get_Enabled
U#F3
[. e
< ;Y
b/(wF
W% I
kG }P
njI,
uK-Mf
{qa5X
qfMB
RxIN
Object
D:=g-]
3p,s46
!A6UY
vRI{
7d2AE
h:|]
#(^)
7tR/8d
g;r'R
IKY#Kr
l*H=
u%.E
ComVisibleAttribute
EnabledCalc
E.g
U`D9
llMb9
98 "q
54\.h
BsB9<t
N 5
G))O
=s.`w
RX~9
0Fo9~(
o{z(
Guo\~
1YgE
L> e
tm[rV
h^4b
Q*(Z
P!|S
d{#J
HZ^
wl =e
V9V2
_w{O
n/[W!
k={/
|25x
/o$di
N u
#yXOL1
q~23,
AssemblyConfigurationAttribute
p9%b|
m3?8
?$
*=r,
^-l
3~4xm
ol=#t
-=,\$
d{ 3
-_ufi
:Vv~
}TRQ
*'?p
OnMouseLeave
\<*N
WfX;
~mlQ
*Hc7
F#AA
)@u}
6B`
7 qJ
~j;z
VIGSX
Z]$3
6Z0z
608G
Z.W+
l:$3u
*/PkO
4f8U
2" kk
SjP(
Bd]-
RWk5E8i(
SjQWG
g}9z
i4Ge
wVj}
?mgF-
iLU
W. ~
.{{Y
g\SZ
[}?$
Zfyn
XE R\w
gs'f
5S]A
i b
98 m
sRGB
W% }]
1 >Y
6(j
Y: M!d
o#?!"
IN#,
F'[H= ~H@O
A/k
)`L g
IComparable
g PE(v
xxrO z
7PmO~o\;
LCzlLa9 9uo\
CreateInstanceAndUnwrap
7.5*
k/
64(-
_N:OM
CW1#)W
[l#f
=Cb_
0[D)p
Qx,J
G,^v
add_AssemblyResolve
EMH @N
Ct?Cc
Ou1
1-,,5
f%t+
cS+t
a*d2
AI1
get_Hovering
/f%I
$rvH
->Z#zq
$~UZ
4I_)
}2j&
]qrV
.P2d
BDdw
\|Y6
(Gw~
Q<oe0
-AUN
r|s|?
bqmBI
g8(\2
t;l8:
U.4HO)
d (8C
PMuXr
ZY$ks
? <=H
@,VC
cC__
<l^y
OfV J
D+~f
rWNk
\Jy{:
ri/x
WQZ=
cBa<H_+
PDr_
bX>Z
!c($E
t f=
iS?
R;j9D
l(a7
c"]j
p|YL
]t>!
?+I/g:1
D:-
GUn&
XrD=
j3o0
{96#
w^$U
%H9>e
rq [^
+BNi
~9#;0
bI@<
Ark.exe
!t&&
D"'=o
m<~/
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
jm3S
? 94
2.9
OPn7
th( b
v1X1
<f`!:
ee]Z
ZxROR7
"vuT
pS3:
u[ >
@ C^
l%MJ6
F[yK
s':}
vT#:
H] (
;[aP!
y D
{ve]
)P |)
QJ'05
_VY!
*$[5
"8S zR
c{ *>
;0%H%ra
q@c+
] q+
>ujA
HMNN}
Rhi:IQ
&f n
wU-
*\3v N
]gr1Q$3
A?V ?
*rrPL
jWCS3!T9
j+iM
X0r
MQ/e
D4fO
1&A<$ch
cwI7
1_5;
v4@q9_
A>1 H V
Y 87
s^/{
#yNm
+9;"A
>G0
]nM(R
yb'^+"
V0+9
y &
M* i
aa5d39d3-289d-a0.Resources.resources
cf3OK
sbgt
Z+#S
K('f+e
H'u*
U f?
:9~M
$!Vy
c8Pv
+0Zb
)Y$}
,^?
84C2h
d%&:
!<+4L
C0U3
vNb8
$^~6?
o+GJ
8K2@
1~L>N
MG#6,O$
pdx)
#L)H
a#4dE"7
].^I;-w
S"s.9
Z s>
w`G _
7~ {p
} {4
A$(;0
2sL2g
-t#P
;}b7](
wK?"
P2gm*|
8v+l
AF"SL
"M^Y
+/7q
@{hf
ZupNf
W/k}
Copyright
h1gz
FwZl
ArgumentNullException
fk/g
QD2Q
gFr;
.yLS<}qv
X|>z
!,q
{a|Z
/&nl
Point
: u3
*rCP{!-]>
;:ha
[aYK
VFs:!&cN@
XcY2+
oci(
pGa.
"',H
$s[]
c*c6
[_H/
Nk2P*
`!&z
CPxO
96?5t
piB%
?@zL
Eb2p
0kqg
fXFH
]9$\,r
Voskghe
2 DUx/
oHvL1x
KVAsa%@
. @YA
dj"n
UzK-]
"sG<q,NN
OD` *
I$'?
?:f]
R!P~&
Exception
;?xu
ZIW
ZY0
WY\S
]>(n
N#6Uf
1Wm
A1HB
set_OverIndex
mH7*
||KJCi
6:XW
E{ b
Ks-Hh
&Tj+
EE/~
LeftTabControl
rnS
k8D>
M we
9X-fR
1|@}
; Gk
>Jmr
d ~-#
4hkyR
; mT
$T>8m
)C^H3
<7JG
PW6 te'
XXaH8g~
E+{
FOgP
ButtonBase
U53W
g"]U
)]Z"
s#^v
=9tP<E
K+_v
la8Xy
!kUN
FOgQ
aSfW
w.]FYv{,g}S
yZrR
eY7M
3{"s
<FpK
+J E
sZ)y.
\-Q
om+eyH">
La&;
! zM
G_]
=Zdg
#"|_
}^u`
7)Y<
_(s /W
Container
}1Wr
*2k6
%<
TF&Ds
w=zq
FVAEG
4X6
)"V_G`
h5<%
M??S
OverIndex
3cUA
y7*
2F5}
TNT5
~IDAThC
KM<un
Ev2
G|%`
[$\G
*6Myu3
Q-T$.
W{ g<
mici
B t
[('dM
$Y&q'
X s
;'_]
nmCJr
2r%O
?%nf]4
Y||e U
wD+H
$i~c
Y(.>
6+7P%
pFc9
2; =k
q~jdK?m
:4k
>(7Z&
/G^`
_hs.
q8X~G
}:;"
w|k$|
nz#k
r:?g"Q
hTY=B
~;i)@
bY!#&,)
WA]H
V@GAJ
[c8!&
+B,gS
O@Rb 2r
AQ")
8X3K["
=68{
{gP$
a {Ns
$GBw
iUh~l
n"8?
T[3ZW28Oq~Kp4
yIT;
o[_9
3&km
]ft^
TopTabControl
;)4X
6Yxj
#rkP
,g@
}aW3
b 89
#8[w
FVzep$
x e.
HRl
zDHogS
_aXW
>GjJ
ef:R9
VW:V
QjZ:`
~THd
J2fI
-;#m
/R^#@
~&d{
I;e{
rB}k
_lOb
_]3
yLFk$
2~|r
o'TF
11dsivF
+v8l
wS24
8hi|
rsi
ItemWidth
|Ax}
lb FB
gr c
)WZ
O:x`
wdl]
0c"-G
yAj3q
$tO
i42c
[F 7
R5o{Jh
xc\ R
"t, Wp
Rfo;
~43"=Y{ ~l
FYip
sX3Jf
_$3"
@zGZ
.P4y
QX`f>
ControlEventArgs
7BcG7Y
f^~S
)OV
c`HML
Umabs
|i2[H2
^dMdO
Nq Z
Bq?hK$f
w<R6
;t X
_vaq
wn#[.;
3W+[
+u ym "
94Yj'
O#nl
u[Q=
+(t>CY
zm]
bgG}
QUzMs
pr:B8
#Blob
j#*pb_
v+L|
4>Fax
Z-e
TV,?\
-eIud
r0sM
r[X\m
j##wtU
A? ? ^
MulticastDelegate
o?*e
G\Oi@} o
?U}o[x
1+|Z
z1-1
Ce|k&_V
value
6#B2
2018
^8}*
MX1J
<.lb
Ue l5
z$eCx
6M8^
L[lq
&"P%
@2T
a]w,
MP f
hD^i
,fL%
7-[[
|?$\
rS#Ix
FwK7
Q(=|~
fCudA
r`wJ
l8.!
+iMb^
iz7v
5\P>j
}/:_m
H4$:
e](
DjN!A
w?W&)tt_
3_ 1
-\I8qb{
AsyncCallback
ycb r
g 4-
ZZI_@
h7K ^
bWC:
=g
2Ton
#m[s5
/)LSJ
n<"z|
n5'wK3;Wb
80o%U
7;gZ y
0/x/
yIDAThC
TS_c
UGM-k
WEN'df
e7'"
>[u+
yzrT
13JN
o*O#G
L r@
UM91K
?vYR
Ky.
&C5O2
f<+F
Nc:c
gqd9
\u@+
2?8D
WUG0v
/S&\s
. #"
F)Pw
:W$x
U vj
/AKo0
~Y~gM
|L:k
SetStyle
@O*p
E^|7
W~K
i'9<
%1gV
bX<p
%9!D
C!g|M
v `Z
.^w'z
l?lc
0iAP}
E~9J.~
/ST4h
Y</\{
o-~b
:U&>
]T
<prT
@&Ir
QL2>
q\^
Db2p
)O$1
)Si
rsF
H on
@N/)
E>mZ
]3u
bVc|i
@GYK
H 9%`
;5 Fy
<cP
athr
>/ndy
disposing
\n)6F
2R 8.
IEnumerable`1
+o [
vJ2\
1fM
]$c51
^I<lO[q
P|?0 /
TabAlignment
"wf5N
d#l_F
}D{8
H+c.Z
r%P5.
YHda
`7|
2:sanE
C8BQ
yX-pf
>' z
, }@s
} #I
<yzH*
W2iS
Rectangle
s:}P
iH5x
6n<7
) c(
r4!n
830
Cursors
>G5
h8B3 7TqJ
Y:!u!
DRj[
{Ex;
xIDAThC
P7<j
<7t%
HfDPHb>
gdYE.
Ozv<G'WH
woZdb
E
K&%0
-(oK
Xwb5
fm?M
CEq
aA=$
System.ComponentModel
.c0v
YX==
=8ED
436534A617CD86B8557AEAA31D433ECFF38B112F
S~BA
fjrz:
rlMi
Ma/!Mf
V4K?G
A:&d/<@
HQ<c
;|z(m
|hdM
5=~]fI
iRK#
7 i.$X5x
VH0n
*QS6c
{9"!K
Et;<
x fl
}l#x
: on
C648C0E55DD0A71600A3C979FEC05C180303B2F7
Z,$m
6& j9t
PB \
_Q^Taoiv
j Y&kB
L3U
zh]42
'l ,
)2JH
:/g)
9=Jj
4y$S
c _5[
8uM
.X?S
Mi"
$j^1
W]/&n
4O_E.
0&WM
;~cf6
G+{+%
aBN .-i
bl/K
T_ab
ServiceBase
G# :Y
>2UJ
fi1H
/w2uH
|IDAThC
Eb3p
System.Windows.Forms
set_Cursor
{ !
$f^:
")VJ
T2Q _
. 9P
lE)<
N)JL
o5'a
nu X
eX p
^V J1
pmfa
2O>_[w#@G
'JB
V+r9ZmUH
System.Drawing.Bitmap
9~48
N9MF
mfZt
,|V3z
AZl
hsp
>TF
IDAThCc``
D;M r
f*H+
]`$t
%'{Z
(E>'
`_ f
ge1i3`
WQUDBTPM
>)0Z
s[.{
G#!L
d"1Y
)p0$
e76j
K1wG
*PanQ
wa_'
%1XV*
yS('
"rd{;}*
$C%9n&
6];~
1!q[
DisplayNameAttribute
Q e!
set_ServiceName
8Z@Jr
s]/eP
{-s0 wu
m dH O
68!~
>voK8/
q-RT[N
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven02_64 Seven02_64 VirtualBox 2018-02-16 18:40:52 2018-02-16 18:43:43 171

8 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven02_64 Seven02_64 VirtualBox 2018-02-16 18:40:52 2018-02-16 18:43:43 171

10 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\win.exe.config
C:\Users\Seven01\AppData\Local\Temp\win.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\win.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Users\Seven01\AppData\Local\Temp\win.config
C:\Users\Seven01\AppData\Local\Temp\win.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol21.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Users\Seven01\AppData\Local\Temp\0f05c5c8-5934-4b28-bc94-b4a259cf142e.dll
C:\Users\Seven01\AppData\Local\Temp\0f05c5c8-5934-4b28-bc94-b4a259cf142e\0f05c5c8-5934-4b28-bc94-b4a259cf142e.dll
C:\Users\Seven01\AppData\Local\Temp\0f05c5c8-5934-4b28-bc94-b4a259cf142e.exe
C:\Users\Seven01\AppData\Local\Temp\0f05c5c8-5934-4b28-bc94-b4a259cf142e\0f05c5c8-5934-4b28-bc94-b4a259cf142e.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it-it.nlp
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.INI
C:\Users\Seven01\AppData\Local\Temp\win.exe:Zone.Identifier
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources\Ark.resources.exe
C:\Windows\Globalization\it.nlp
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources\Ark.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Local\Temp\shell32.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe
\??\MountPointManager
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2272.12043328
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2272.12043328
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2272.12043359
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe.Local\
C:\Users\Seven01\AppData\Roaming
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows
C:\Users\Seven01\AppData\Roaming\Microsoft
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.INI
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\3199ffa1-af6b-462e-8a0f-01586a6e6865.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\3199ffa1-af6b-462e-8a0f-01586a6e6865\3199ffa1-af6b-462e-8a0f-01586a6e6865.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\3199ffa1-af6b-462e-8a0f-01586a6e6865.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\3199ffa1-af6b-462e-8a0f-01586a6e6865\3199ffa1-af6b-462e-8a0f-01586a6e6865.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\shell32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2520.12048437
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2520.12048437
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2520.12048453

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\win.exe.config
C:\Users\Seven01\AppData\Local\Temp\win.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol21.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll

Write Files

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe

Delete Files

C:\Users\Seven01\AppData\Local\Temp\win.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2272.12043328
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2272.12043328
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2272.12043359
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe:Zone.Identifier
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2520.12048437
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2520.12048437
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2520.12048453

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3035fc5a\375c7a1a
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index21
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.ServiceProcess__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration.Install__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.5.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\337da671\3850e7bd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|win.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|win.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|win.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\337da671\1b71387b
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Namespaces
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msbuild
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msbuild.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|msbuild.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|msbuild.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|msbuild.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index21
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msbuild
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Write Keys

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msbuild

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
kernel32.dll.QueryActCtxW
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
kernel32.dll.GetFullPathNameW
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
ole32.dll.CoCreateGuid
kernel32.dll.GetUserDefaultUILanguage
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.GetStdHandle
kernel32.dll.CloseHandle
kernel32.dll.DeleteFileW
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
kernel32.dll.GetCurrentProcess
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
kernel32.dll.WerRegisterMemoryBlock
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipGetImageEncodersSize
kernel32.dll.LocalAlloc
gdiplus.dll.GdipGetImageEncoders
kernel32.dll.RtlMoveMemory
kernel32.dll.LocalFree
gdiplus.dll.GdipSaveImageToStream
oleaut32.dll.#8
oleaut32.dll.#9
oleaut32.dll.#10
gdiplus.dll.GdipCreateBitmapFromStream
gdiplus.dll.GdipBitmapLockBits
gdiplus.dll.GdipBitmapUnlockBits
shfolder.dll.SHGetFolderPathW
kernel32.dll.CopyFileW
kernel32.dll.SwitchToThread
shell32.dll.ShellExecuteEx
shell32.dll.ShellExecuteExW
setupapi.dll.CM_Get_Device_Interface_List_Size_ExW
setupapi.dll.CM_Get_Device_Interface_List_ExW
comctl32.dll.#386
ole32.dll.CoUninitialize
ole32.dll.CoRevokeInitializeSpy
comctl32.dll.#388
oleaut32.dll.#500
advapi32.dll.RegSetValueExW
kernel32.dll.DeleteAtom
comctl32.dll.#321
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
advapi32.dll.EventUnregister
kernel32.dll.GetProcAddress
kernel32.dll.CreateProcessW
ntdll.dll.NtAlertResumeThread
ntdll.dll.NtGetContextThread
ntdll.dll.NtReadVirtualMemory
ntdll.dll.NtSetContextThread
ntdll.dll.NtWriteVirtualMemory
kernel32.dll.VirtualAllocEx
gdiplus.dll.GdipDisposeImage
kernel32.dll.VirtualFreeEx
kernel32.dll.VirtualProtectEx
kernel32.dll.Wow64GetThreadContext
kernel32.dll.Wow64SetThreadContext
ntdll.dll.ZwUnmapViewOfSection

Execute Commands

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe 
"C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe"

Started Services

Nothing to display

Created Services

Nothing to display

Detected family: #Malicious

TheSystem Itself @ 2018-02-16 18:58:02