MalScore
100/100
MalFamily
Malicious

boy.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 21/68 Related 2060
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 509.00 KB (521216 bytes)
Compile time: 2017-05-09 03:15:50
MD5: 92376f1add91daf34d723a3869405cc6
SHA1: 3fe24fa5c426a114633e53a15b6fcc81cac667be
SHA256: b71fa6d6b906783b77f6eb8918541b99e1fd9e932d5194b1049a51c24d660d48
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 5 ]v|=; .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-02-16 18:37:11
Last submission: 2018-02-16 18:37:11
Filename detected: - boy.exe (1)
URL file hosting
hXXp://prosciuttiamo.it/ice/boy.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-02-16 06:01:31 [21/68] VirusTotal
PE Sections 4 suspicious
Name VAddress VSize Size MD5 SHA1
]v|=; 0x2000 0xd9ec 55808 a65148733560d457c40309973d5a0551 57cbcc744f0aef32513898f7e1fd73b197a2c131
.text 0x10000 0x3d468 251392 3d89cdd70e3cc5fb58585afe323365c7 9734f28045e610a7935daa99c5459924f53336cb
.rsrc 0x4e000 0x33a18 211968 3010c1c0d7a06f900f91c43c121e9d2f 7d54af0f9715a603a8a81b8ce9d38878c91f08f8
.reloc 0x82000 0xc 512 4e4a67c1ffad72c688ad19cfcdc4fd13 d14eeb3fb7574ba336983085b070684b350f4b1d
0x84000 0x10 512 da8c3884b98792b6bef8967fcff539d0 68e0303f596b209249acb6097527889af6738d8b
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x4e130 209740 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x8147c 20 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_VERSION 0x81490 920 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_MANIFEST 0x81828 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: Copyright \xa9 2018 Northeast Utilities System
Assembly Version: 0.0.0.0
InternalName: boy.exe
FileVersion: 14.2.22.1
CompanyName: Northeast Utilities System
Comments: idebuqos
ProductName: LightCycler\xae Master Mixes
ProductVersion: 14.2.22.1
FileDescription: LightCycler\xae Master Mixes
Translation: 0x0000 0x04b0
OriginalFilename: boy.exe
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
No packers found for this file
File found
FIle type: Library
KERNEL32.dll
mscoree.dll
IP Found
14.2.22.1
URL(s)
No URL found
Assembly Version
Northeast Utilities System
idebuqos
16e4a919-e85e-8836
14.2.22.1
VarFileInfo
Comments
16e4a919-e85e-8834
16e4a919-e85e-8818
16e4a919-e85e-8819
16e4a919-e85e-8838
16e4a919-e85e-8839
16e4a919-e85e-8835
16e4a919-e85e-8812
16e4a919-e85e-8813
16e4a919-e85e-8810
16e4a919-e85e-8811
16e4a919-e85e-8816
16e4a919-e85e-8817
16e4a919-e85e-8814
16e4a919-e85e-8815
16e4a919-e85e-8823
16e4a919-e85e-8822
16e4a919-e85e-8821
16e4a919-e85e-8820
16e4a919-e85e-8827
16e4a919-e85e-8826
16e4a919-e85e-8825
16e4a919-e85e-8824
16e4a919-e85e-8830
16e4a919-e85e-8829
16e4a919-e85e-8828
Copyright
16e4a919-e85e-8831
16e4a919-e85e-8844
16e4a919-e85e-8832
StringFileInfo
Translation
16e4a919-e85e-8833
Master Mixes
16e4a919-e85e-8845
16e4a919-e85e-8837
FileVersion
%q^
VS_VERSION_INFO
InternalName
boy.exe
000004b0
CompanyName
ProductVersion
FileDescription
16e4a919-e85e-8841
0.0.0.0
OriginalFilename
16e4a919-e85e-8840
LegalCopyright
'&(&-,0/32425262
16e4a919-e85e-8843
f3d2d92e-b351-c6
16e4a919-e85e-8842
ProductName
16e4a919-e85e-888
16e4a919-e85e-889
LightCycler
2018 Northeast Utilities System
16e4a919-e85e-880
16e4a919-e85e-881
16e4a919-e85e-882
16e4a919-e85e-883
16e4a919-e85e-884
16e4a919-e85e-885
16e4a919-e85e-886
16e4a919-e85e-887
q& x
V4v%O
/G 'Qb
wAU,
9q>U4$ %&
wZ'O
%_LQ
{#^5
Rr/>
s 2CffQr=
Em)D{k
*Kl%
H(aD
AK!V'
m,HI
@C$yU?-Gs
N5B,O
TINm
dfEI3h
PNG
Pl$H
z0n{
eA7U
97^}
xa
#D52D
^z1^G8_'$r546jA@=%-Wz:<N&
D>_o
TMY>
&|Zf
P`J^
CgwF
4n-d
rDj)
g* |
bE,k
2&~
_w1o
2Q)|
~lO@ 3
ResolveEventHandler
i8'B
.".N_V8"
AutoScaleMode
get_Height
$xqq
TbE,o
kmyF<M
/:Oc
N'X6
}ydR{"
<Tg$]L
32Z1
LPA5
kfAK'
GT[e
Kja.
@Z#uC
4Z6_!
%4
cf2J
#O8^3
Jm%kq
Ra p0
L}R4
aMOW_)
~fu &
d Ye
uf&a
_Pt Q
UvK
Q2u32
m=;5T'797=l6r0/3YqE1teu\
~R2#Z<ae8
QP1a
Ag.`:
Version
K$Id
W(#p
>"VG
,):)
,6-,yK2Sv(?V^w4yA7^Mx_<'&
71wz
s#/g
`G-B<+#f
X (+
mXb>
C+@&
set_EnabledCalc
>(~
sAF&
}C86
}Z);
Ymwfr B
!0 T
l|G1
I\8z
iSLni
"{effE>v
t^fK
psUTj^
V-XD3
0i;Rk
"0{c
zux4
WULg1
Y| ek
^eb,B
(5hg
ControlStyles
yk)$
Marshal
.cctor
t,;5x
I_1Q
lw;D
U-,ZS
..*q
`xCM$J
g%5u
7$
uxEi
fv!s
|K3F
h:C~
9&By=]Q
Q6i8&
|\W#L(LX$sW\||Zz<b8li6XW!
LY}`
u HR;g
!)8 )<
E<#<sM
p5H'zb@RZ`O'y;Pr8BB/da6O'
Xo\9
op_Explicit
RuntimeFieldHandle
Nns0
5*tKC-'_
3PM 0?Xe
"o!e
}IDAThC
Le8
}QTL-P
Cx'
Jth3<V3y
~8 1
lJ><
ObjectHandle
x_d
qUWU
'IRT
[ ?#
%=b]
X> (
u?Q
4 Jw!
tFR
[rLY
ZXJX*V
*bd;
U1(
ZXJX*J
Cs*{
2~Q_]
~+")
EndInvoke
7+ 'B
|iNA"
R5N,
[@/.
1#|q%
GLf$,
`10m
's~B
BoYa
_vP/U
')%!
.C*_*j
JMML
AsF/ ]g
U Qm
6bT0,
>$]1y
Htq
wXMD(
^rMO
Gq OO
1fj
r%5'{
2{abAC
vNsz
WTt
+h~ W
o; ,
5r8)
~& p
|;9
3 j[
(uU5J
9JM'
ah X
`ta-5kKth)uNI~U)!m4o9QH/(
v:A >E
HL2~
1(tz
`"x^`Q
z|6]
c?NB3
qrtw
B&R;
l 2t
zJ`V(
dJyY
}xC4
set_Alignment
epaY08`=@8#!f*Rk iDu@76y+
Rq(.
AssemblyCompanyAttribute
.e4bH
K,[C&
HBQX
QE4
oRq?y
Gyc;_F1h
WNmDH
SMV
s^i>
.#
}^d6
GeCa
}raS
*]2
IXQ84
4K%O
O'bU
c>)<GRv.
VU u
0lPC
Rn+Qj5}*$~qyL:(+:"'u6L,L
5Fvi,J|PnH@Z0xG@DK(MSSsv!
]X|j?
Of=b
BA?@
I*z
?|7`
j~5o
{V_i16C
NhoD
Enumerable
)(BH
eu4U
xlujG
/G
A7S+J*$*?f~jfFhC?M b'~34"
t(-R
y6xA
&bZv
"o(9
-}'&~
kKOl:
:%/!
W,D~
-qD4iI}0UX!AQlbO*UQJ8UEf"
_'M\yL
ju 5M?,H]?zK'w<zG6uQy9Pw,
SK:-$
=m5i
get_CurrentDomain
xg[D
+!@_
jh~!
T D)
` h(xX
kS4v@<vb1`8Q)z4ETarn)F'"!
y$aP
J)SN
/p(cM
?%YC
b`I`
`0;t\
5](
Urnf
9!R.a
yk ]
_D=-i
OL"V
dK``5t
39+h?
Wu IPxXZ)v
ani'
*9TE]
0fJw
J |b
Qp>o
^E34?p5
5{>b
ovS3
t8`k?s
lMh~"M
hJP%E
4,;S
pv&aCt-(9(PY67-KY/jR:lWL#
.')bg
USuVQ
KbSOK
AssemblyTrademarkAttribute
* #
}TXs
%@#ZMT
lLw)O
Zu4H0db&23{iT9ub';9E"m=9%
q+
\JIse*L}hm !dW|Z?WNRak$i&
Wuh+fQ'
j(OT
}"3{)
$k2M
x`se~O
$xqC
W:]b
d`/D
\U?}"$
^8/U
wigbs
XB:e
XNJA
/vvK
%0i
nvhkNT!!R!L?f4]j=#U8TM=u
0M\OK#IlAd7@e^o*)c8a@K4J6
tVW;fB
S.rv
]r4q
)[oqO>z7)^LhVSQW|+eP-3b*
`Jc
#Blob
W*\TZ$)W2I[4$Bn9hY4t*$Em(
49V^,Q~
SF:j
CJ:F
9D"o
GetFunctionPointerForDelegate
q>6U>
0$s!Cs Y8ke5a3)*,W+g>]W%!
q&.z
7;Z7
3qM*
x .c
ryN^
x&#m.PzO
> e
<1]&
0'H9
+7XT;8)
l-p mbC}Ion:RjSeYdX%8-Ot"
"4rH
G)A2K
e<-S
QMIJx
I ob+
W5 ~Sk
uIDAThC
'%Fou
AssemblyFileVersionAttribute
z%j*
5":r
tR#L
BindingFlags
&'yC
ZkuS
u+I6G
Type
^]^;
cX[<
9%'!5
*t"L
+Tcw
"QQ o
Gft)
F~ (3
EGzUl
%=I
?Pn
v0ID
E?}=
'U19^
?_ULjOVTu##Cg-o+P5^N$tLu5
|Cn&
4@{<-8
o$M!
4g#lfaq
ag:
0Mzu2`&}\0ga_SJg/j3s0c<j!
yF .
@<]xB
:.}|
Cursor
v(Nf
X=mF
n6mfT
Xk!r,
*xD_
UXU9
*v>*w
7sh%
!3Aw
2[-x
Guid
m\ Y
Ej<i:0
S8]4
RZj/M
&B c
.H|X
^|:{
Char
MH9WU
S_IG
gK99
R.">
_?Z
+u &
J3T(DW3DLbbC%!ySR*P6XUw~$
AppDomain
i &iEW
6'&}
FU|D<
%(|^o
J^xj
V{7eytb^pdZ9Wbfo!,Kp83{t
}wb>CG>
(rU J
iGZ5:
GetValue
2_FC
^o\`
<~|t
<3fJ
T$u(
yDQ
&c-p>
SIC0^9/<)C,{=Nkxd@)]XCZy)
get_X
get_Y
T/4E
J|[T
SWsG
)H;F_d6 4kV_{id(p`bIfp|*"
{JyDK1
<?a6
/TW>
S47D6
Ge@\Mm
K4%#
cxM
GUVs
3,Mnz
pD4\
U}U:
h-cl
VirtualProtectEx
'Wld
hc}?
get_FullyQualifiedName
<VY4J6
#cv/}
6cA
P E7{
#KwVH0*)h01E<T}3TLDdEjc}!
T= V
.,Wd
j~sIa
s *0q
o[<nEco`FI
:lq8
~b1u
-, ?
wgWi(
\.kn
{Mj^6,
U rBWm
Xv25
sIDAThC
%e-q
5TMm
hm6Z4
8yG
SlK{%@
<?q(7
^az^
*Zus
1;J8
l)|4
|~-~
['C15
U@:VK
6sx-
M!R(
$Om
>vu|
xrjd
zISt
A@B+
xQ/qb
>P-a~
:a='
m`^Q
T6?r
MQWM
W \-p
o9"0+I\GM%2THVdIDo0_\R|a#
M@5
]Ud9
4s5,C1
.text
\C9o
'\K(
Y^[M
GetString
&V*'
$N',
IL;R
\X*S0z
nsbr/K7[
sc)
^\97
%Hu2
m4V^
67I!
'^.s
4Ak-N
o 0nd
sU>nc
$B*(
object
n070{
9S.y
f@N;pDf,5i;>w2j9#+_\?cze
o6k~6
Vh
WIRK p2
M&g2
goy:
pXz.B
{^2'
n|k]-Z
o=8.-.
|['\
v%Urt
ead41bed-2044-79.Resources.resources
cxL"$
^T/g
'=~Dp*2u<e8hW p6NX\MgYQF+
3W_k
&Xkui
Fudt|\A
6 cTY
tSx
6x)mT
ubn<Z
/ 6$
.3N.
!>Xh
sv"e
2F'R
">D&&8[
O8[q
0X(vA/~
A#ky
#U~X
77DdL
M,^[
PM/(
JJeg
r2
a*&Y
cEZ2
p;3<
CY4x
4k*[
a6pvW
[Or
&J[%
\ B=cK
X.hZCsW
>ygX
N2&3
%r$]
DN0,=
=ZB-`
#@Y'
8k>
m;c
a$D~
J+$b
V&,g
S8:{A
u"|6
&}u?-C>q-S{*+!P1oVMq5e\h#
vp>##
T e
1uK5
6EAD
xJ5]
?:j)
V4u#
_X}w
z`"TXa:$)pM759ea1tS`=h8;
`.rsrc
O,d_
wh1)
cAEF&
wK!w
3 _<
*<@`
**u(
;6-^
C&-^
zXM=1-Q
@7Pe
lEx`
9R{hA
get_Default
KA#K
TJ7cP?P2~Tu)k7tJ]#>FbOHn$
E@C^{
r>Qq
. Vs
kernel32.dll
1J,%
result
-Jlk1fp?QsTu^jt35@m45tRA!
P=ppF
d09AJ
d/K/x
l BS0k
7Kz|
R*M;I
y:3n
[ Yw
;3n*l3yR
OH7s
|i8|
mFU0
kQ\I
%]-
OzXBi
&wSk
m6H_S
2cFr
^Qk/
z7$`{&Ir?#PR/wQp"{sN15$D
g:zWt
=:K
CanJ
~^~E
ROnN}mF
U gw
X^l{e'(9[+!r`Dh6+)dm(y+\#
J-h%C*
s:+-C3g=\O'QP!~RY>MuiU=''
'vr~D/
6Yq0Uvo<7\} 8pcX2R/OW%~Q(
d:|j
Y)Z8S6
L LO
1")w
u@ &
92M
+}C_
_1FqE
/Pzj
`#In
;Mnf
|9%m
.:3d+R
+n&
|IF!
3h@b[/
#BG.
QIDAThC
O7/WvF
CBNv
W+EX5:
fZtBS"4o \87jUH0Mn*MLq/z(
StVq%
}KTc
#8;T
/[J3
6nrmX
JE'4
u#::
tKGc~eh>3j:vba@DO(#_Kwqi!
MouseEventArgs
]!v/
m,P u
2npU
q3Dt
W95
~3ub{
hln=?
A7BVE
q$'e
8kU:
MS+&
:#reD>BB&!LZz83("H6sa<J{0
0Ly_Q
C)4
GH/]
9A9#
+qqZ;E
Y99>
K(
-|)8
;|=0
%_+
'BA@r"?T?;E&`IZfSWFc7(>W-
=OR T
%TcM
lMS S
fIDAThC
|@']7
J0vcV9
9 ?g
~uI!
O @
h*jp(z+
a+PL
z? nA
aMa'-4]wF3o}l@lQ>CnE7BO7
3Yg%
^PGW
jBDM
D5X"/
, ~w
MdbX
I29=
b|;
JMo<o
u(d%
U@8C
(EVB
|V'G/
jJ o
!/)
'3rO
f=3Q3Kq`qx>>H[Yq#(+j"d<3!
y Se9
JE'V
4 Z_6,
Z+[-
!IOo
NZ v
X6AO
d"
h I3
diTT
L=PSA
XJX*V
O =
k4txh
Gd\m
K$s[
ffYWz
8U <
c9J$
AUti
Write
OnMouseMove
l% g4
oDwZ
_U%g};N
8#:K
S6tJ
TE ;
[jDy
B4e~
R%kW
tZ{Y
get_Assembly
@whK
-#+{
M [?C
}TN,
3s H2
>4hnL
[C_I
!5WP
ShfsY
&4^{@cb
-t)aD>L
9HHv&xnG]& m_<dw_Ub_j]4?!
iQ,8
O(}Kv"RAlWDd8V|2 K:3B@a;$
U:7-X
UAt n
(4.K9
&sOd
Gxco
8P31
D@BGyWODS|$+ORj@Fdy8{RGe/
[rJN
O'%u(i
h]Ue
Nv _
fa%
B !H
e+1l
?/?}
u.B
VQ3)F
mvU0
U g 1l
System.IO
;l+-
WrapNonExceptionThrows
x>#9Y
3Bzu
st7g
q>Z
|k~9
=bH)!
WJM
(hcA
;u"s
Sp\3
fpQzmw
i=/0
Console
9r)|@+
@;b
@UPd
Wknp
zj@o
>3No
T5!S'hV
7T;&
*fj~
< /
lp0~Q,0c
Ym~&
)IT*
Ur&
oi>5
!"G%
t mkWi
@kpf
gk5Vf
,_qW
vb}:
c[)L
XiLq
sYjdPyZmJ%:<0*xy2[`8dxA:%
yiTVtg8}Ch|6mX]w 1e;o:K"
r~n'.
[H %r
a-Iin-v=L~&s^){_#J$wb'ra(
6gPN@N`
A[jk
zZi
QOFJhU
At&@
IHDR
5+JxP]g<kM4N%4^XY'F-A1Ik+
wbPh
+j1 cda
bop<
F`}]
M0gy
-aT)
p@@<!
0#uxfY]xSsvd=r<<>gqH,%/O$
T!<>
Zc%w [
Ftpk
U f}|V
1YI:FJc}FK9\4CYi qmUc^yF%
*eR`
~zmMg(bqhip
0,~5
`[u<z
ALM&t
Oe}8
Q[d\
8xFS
N c
,F}5
*=3>
zYQd
z%N"6
Li# f1n-;K"mb`[&wuxqYY0Y$
W!]dA.
1'q/f
jI0r
H %
nB 4
System
EventArgs
'U\`
`.":{
> ys
T`L[
B*3*r
S@^t
Hg Q[
f6A=
]'*I+}
9HxB4
(>:PMl!]6*
vs>
f|8X
-\`<
rK<u^
E$tE
H5r!
y.X
{ F#
b&NN;5
X{f?E
CreateInstance
NG rm&Nd:
SA/_
MK
Z&It
' Em
*]=WR
Do[+
"Da
Z"GT
oIDAThC
MethodBase
#Strings
HYs8f=
TJk{
x na
Q|` [ND
@U6w
V)@T
ZXM(!
/E&$xUt/=&~#|L&[_R|?dyNS"
\oWX
*`%<q>L*_Q'1 RToc%SqQ/@k-
CK\8
7FQ?
"Sp>
iZ0)
M&J%
,tfX
c2P-O
m6NH
tK %
m^y]w
G ^Vi
%w(l
4#1L
jH3=
x"Og2
g_['
@P3C
Environment
}I }
get_EnabledCalc
#p#?
?Fh7x8ZW;)TS6cB|/c#p`:Ky
VirtualProtect
C hW@
7Za/jJ9
8G1,
- 18O
y>nUb
&.[
k:l
aWs#
\/tpC6>[]%q&xbh-WF0t}ZU8'
&8<'t
,'!%G
!J"y
* BF
{>56
get_EntryPoint
d24s
$;ti
`Be8
efLX-Ti
]\C5}
[[8oa&
PS73s%P6
Kk\U
y8C
5LTGk&{
O`Ec
?kO/
=5\(x
lx W
Q*.WV
3ex(7
QV<j
Jt=U
hy9cx
--,i
*:vv
9ya
dF_w]4
Cm;d
ri^
qdVrm
GetType
?C7q
XJ g
8bt:j
ClP
Hp[T8&Y!~~,7h&FtXoBq;\Qm!
Y&~>w0"K9N-VH9pu)`OH4W6z!
B _K#
Z`"CH
add_AssemblyResolve
@aSYSd
IDAThC
T[ >
@[VRB'!E8Mf'j?MFEtDBv=QH
?3(:r
6_ .
mhVS
&sJe7
{q=8
i\=8g(>
BLQ~3
set_OverIndex
_NSKN
xCz~X~<
{S=Q
)em;
\]BfY
d+\E
sLO"
JHN)B
g~ f\
X/k=
^0.Q
w=S<
sw-[
"`I~
X+2d6
/Me0RzB8l3;CWbnDZVfmxj\/"
GR 6
],XO
(t/W
m' ;~O
8.Rp
+=p=
RhLMs$0K!?zS+n_T"!YbL?vm#
* = L d
TabControl
_ g.
K!PK
bf
W<'+X+BdpA%+$rYLI!ke$ah5$
>>]tS
I_@,K
vI cg(t*
G@_^5
%59I
U;:k
N%)F
;j\s
~@V>
}n8oD
L\7H $8
.\0I
\U\"d
b[NU
Z| p
%+T$a
2h&q
K4z)T
fF{U
$8O{
l;A
Color
MX{<
w>J_-oOBF
sLb>
Q!^cF
o-tH
O9WI
Intern
g3fl
Z(:)
u%oL9L
lMFd
!sxt9
+!.z
ql2JJ
Olve
5}W<23wKb
nGL^7y
set_BackColor
kh';
9p[}
`i;b
mql&
2%E8(@;?XfjMi{Y:U$lI9qJ8#
7 2g
j\C[
ZtC:"
?TKE
get_UTF8
2#Q=
?ld#b
;V,Z
get_Width
Ore6
r5Wd
HVRs
wHM&L
2A\-
#oXA
j4=PkDg\yh=_40kFuDi\>T7l!
N#p"
+],6aK:c1?W6THbd7oy!e f<$
B ,>q
^DkP"o'
ZX {`
qvo(
(]y
K8GO
Cq<a#
Q!.':
nB;
sFsP
u~*
get_Revision
d~$K
3 s[
WCw0/ycyDll7{`|?t[UD)sRu"
7 2S
];KAWFN9Sf['[3Uxi&!U`PW*%
(Nx8!
Js$Q:u
Z ~
D@b 1*
DAZ9
"V4%
'pdM.
&t~#
4+|[
B^od
a_%!
E:>0
8ed.j
Dlnj#4
CrYh4/
X:wk<
yJat1
.a;I
)V;X
B<`E
<}0@{
f#){:
9X-+
7q650
Oj euf
*LtX
Bh <
y?3
5r5,
acpV
&StD
TUXj
es#+
Rr1w*"$P0+lC4h72s#E2dE2X
@ey&4
,prEk9
2UWh
1tww
o3Ey:r
ARo
J$Fa
@q&;
\ 3[Q
'q"m
"hDj
L[J:~UX!g!'Az@y3$^ttn@nV
YdpxE
K8l9P)B*Ao"U+s>#%?7P]dNp4
#Z[C
E>Y+
C xH
{ei?GM
System.Core
\yG$
r$ n
1IVq
*(n~
.S,
NCzH
q&vwq40 556&t^$i6: 8Ew^3"
tlQJ
0LH^
YXf!~
i -c
N Sx
Hmw;_
Delegate
C]}(\
PCqX
Vv~a
Vlh#
H?+z
#d$d%
P]a0+
Xplt
ARIg
vqO,B
?(/z
lWe"
<Oxl
Erx]
-5K?`=k5,x:~`yL-F^gtQ)!&%
$f32
^ 6
[z\[g4
jrPf
a@iD
NEL %c
x'"B
q~G&
ovX~
M;7e
IA@B
L~p/
[xkf
utzWzM
2^V:
Y 5
ModuleHandle
c/nR
]r7T
;F*0
TO'd
s{@/+kn
l%.<
3hxe
6S'9
,5}-
WfZFXO1oy_e584=:y}b[G%7X!
_.g>b
-@-0?>#)u|#P0:PFKKGY_^?o/
<@zF
(wr@"\
Oc #x`
:PcAl
kFtS
s}1Jh
HI ?
LU#L^%X8eB>Vt<KO+ss^&U\u"
5=<
;-yD
Z5j
e#JE
E $j
lj@
Z%\B
RU |b
=. Q
d=Kr]
- B<%2w]ZJw{3jUz[od3igD0
asM.7hI
set_DoubleBuffered
Byte
get_Length
[}RV HNLKT-B|?sxSh,%\&dH-
Y? z
qNgv
EP|6<MG9ls4?S:R!A)f\{D{y5
r%6j
,{d y E
KJ@:
l{2A
[^Vv#
ct6J
Lzhj
"buqv
e=xT
?k^+
FczB
XZX)R
3 EN
BQTa3
3hL=^G
*e~
AN_~
9#yZ
u3Jf
'ewOU$b3j~NY?ACL4&Ik|6]X*
#y,~1
Contains
Tp* p
V_VI
c N~
yo@:
j5fJ
2:tH
eYYU6
`v02
4im"
<G\)
~s%lc
6 sx
*v]#
_ay6_
ValueType
}Tqg
%u99=
9xRh
M@Y.
B"wH
GuidAttribute
kL{!
L4ZH
<p]~
aK?0
w:e[
#`4r
" Y!
]nJ
8ww`
0%1h'%1
b<n 1o
qIs=:
@sn(
fB"=]l2fsktMG{@aC-|#@F<[#
y-a4MU
[Cr6%
w3=t
:x*-
B<+
K/q')/aD*(#l|c ~`,5+gq}/,
get_Count
& @z
5Pt]n8
<' E
3xT _
+'<O
k 8WfMW
EI +
^W h
nuyt
\} N&
System.Runtime.Remoting
dtH*
U8G"H
>d(a
a] R
< ;pL
#j EfF
bkz,L
4UdC
Am|
?(i|?v
K1htp
ZP:g
\BP%=
GetField
nrv?z3
Y ZzR
#zL#=
~K+a
8;No
|@FEN=E+KC%x,%+D/v5!YB(/"
Mt<X
l 6X
]vSUR
_'jj3
` :/
vjn}
'A@} }
Db|D
Gat'
Yerj'
&NAn>
,1`P
,{~&
< S
|2zR
]+IG
Db|S
v& v
Kamy
b~~]
Se6[N
UInt32
12<+'
get_Version
pIDAThC
lVD7+
sE*Tj{Y
5V[>#YE9{fdh-v>abzwJ1Lz,!
GY/F
ToString
z&*nKyazgj_
()y
~xo%
u`U3
=G<e:
yE`'
B~q+
+yT/
5Jo@QB'
Xa\U
LUw
od<w
|R+>
`m 5>
YE9
Dl*2
f*iI
0M e
=2'
03](TNui}}-I?\Se hnF%_%8!
qrxa
X
*|[G
?1lf
zhY)"R
}F+D?
V-q%
S)(Tb
.rSM3
,dotwJ
LDuqPo
gB]$
co<`C8
ky%/
OZqw
|^eC
ServiceBase
v1Q%
}@{z?
3a8oF
3#}{w8g{k\JaTENWgF;qq<uR
5,l8
&UjM,a1}HS)ohaQ2o'/z}&d`!
GetTabRect
d iUu
!&<l
q@|#
LR7Q
O5<&?`*1c+M*}]pb;o@AC)27/
@f{\`
]n+v
7D,?G
YL89
?F9C
N \GOY*
RIIZj
(S|1
'])4
nD__
3}`f
l0~
?&a]
=W I
-d?H
AssemblyTitleAttribute
J`ud
o+*U9j*
&%\^
uV91
[|P]C
"NQVT
|iY7
n")+
a Im
41m$
oy8VN
K-'-
!&]8>&+
=Ubl
|kKc
TO~?a\=Sd~5m[?(^r(Pkbu2s!
X*ML3
aT`!
ql< =_~zX
W]9wD
4+iN
Yy}j
qp8d
Ag]FP#cs_d[?b[A@!FU1eXJU#
-wR4
:>?D
)2hM "
TQ{yH6
_{zW
U?Ihb
1[EQ
?|)9
Gzw6
f!F~
FN=s
W'%@
N@l"
(3?-HV{?&ZU WH-r53"jnAZs
&Z4y\[{5bvW]T*I4BM2$M+8W"
Jr&w
H@,5LK3n^Q%R1"d MPHa@#uZ)
L.g`bX
]S9C
@4t@9Ra^27`?!+zx"hQ#>@U}"
Syyu
5!
2!K.w
Ok]C
ar!I#
N K_
mmDO
Rdu+
(yoe:
dpvH
ynT5.
Jur0L
<'Vz
bJ*W
!+K
.?yL
{MH
Data
+su^J+R&@)N2(qW$Nz<mDP:>!
%`k64{%prDLX?!6uL)z/3(",!
Nc7u
j4nwp
~d{
6_Qt
M!CCR2w8yU9bRV mLN?#j'6N$
W{UL
QIJ.
o.x-K2
2PG3
: l@-N
'K\"-W
Enabled
Sl,w
bf8=
XeF<
Uq=>g
V-nw
X f@
?]h;.E
H$#{
"X/A[w
Ix]T<
|X%E
ot3-
3D~,KH
E!:r
5;WH2Y@T>=LgG~~~l?lKs=lS
K62
aIDAThC
pHYs
.ctor
L&W
QuUb^
T~ K
ABR`ga9otQNXja t6M-|d#CX)
R7 HV(
get_SelectedIndex
FqDe]
,}0U
mscoree.dll
Container
56#i'
_bzY
8VuVt@
O8U/<
/Z*u
C/j!FTjCxl((y(40w(s20@XY+
oa3/
gH} s
p77R
?-^?1eI6Kz|"tou1OUZg;NCs&
\$0v
NE+%
,QD"
Main
pGwa|
T]A(a=
Iv?H;
YZ}k
zilN
jkyf
<$.,Q|
Invoke
O W
9L/c
jYzC
zM(j
ZXJX*
7u2f/p_[pUk$}&$rE5T3xvbJ
(P #
,52FGB/g<&HRRfE3|NEj\,,~$
FH#J
@'!@
F*.+.p
qIAiV
jiC(
@d T
=n]Pczl!>P/4Hro9!9?WhAF;!
`ZZy
^LTcAO]OFvyqz}AKTp;~Tcew!
{Em:
u e
8*:57
s@:5h
F6:Z @7
_7Va
9{s(
Pb{Vl])$@&q``Rr>8gZ[Ir]`
_1&C
:b4
oyaB~
>~?u
<EIa
Module
DHxNt;#kY}Zr `,`&x@+s2{f
\L F(M
_0rfZ
F^<m_
FDRz
\4MVZV>pno4q_(3N$m>vU6>X%
Array
'?I<
H?6s
!E=h
z$#1
n?<.
9,gT
j!:
0A
,O)M7
@.reloc
|EYNX
WI\|
AKLD5
935!
~ X:}
F*/KOs=!jBDQZLygY7A-V-A+#
`%3Ka
? 4+
t \?
6HJ}}
.SYfP
EG"
H*!
Odch/
3@x&S
>uid
B{xX
|Uh|ql/&i5e1)]ngh0Y4l9lz!
TabSizeMode
LtR|
\Gj
9<q!
B"PJ
get_Chars
<<v
gti=
z\h?
($%a
4p^F
- o&
Df3,
5 }G
D.{,i
2y\
9"NZ5
"Y~]
C8iJ
YT^(PG\|^CfYZ^M!!rQa;!:Q$
k^=B
PW99u
tnO'
yv^6
7m^ 9
UQFG
>N/
4#7g
J(SA
T 4(k
,ZzW
tnl9)6
z Qb2
v~`5}Be-*#*JW%WEORvdL>uL"
?^y
]>Ki
yoFSk
*bs1
N>ag S kF
H)N;k4)
\21$
)6 I
gE3%
hjW)
6oO] %
-E%?
zX[^Y
lc/\
.~Shb<
*.EB
YN^m
&PF~
1jK{
pi6
BE t/"
N-f
>L
@>nI
+gF0
mKE
get_Location
Yog%b
`r^kR
a`z@
.`+K
e; as
fbl|m
!y=i
KyB//
t0[p?
yg+\
zE-L_
dy&SF
RhnuznV?lHEP,8)u-Wqg]}P)&
r7*W
vuKTv
s>M&
&-_O
tH)A84_
zTvC
I_~j
FreeHGlobal
,lCc
gw^W
(M-)aP
,-I
c0~+9
e\ ,x
k,N~
l?:U%
X\Jc,'
t@Z^
a{MuZ
ks8<
OIkb
t@bQH.Yn
<O8/!
NM;@c-=
S_i-}&J
V|XG K
d( h
px|=$\
f?T]
^-ZmX [
+0z?l
K+A\
=LpA
J <W
#\%#
L0[t
RuntimeCompatibilityAttribute
j>Q4
)P)j
wK+(m
0j<]h9*w-B<B!3vU|C@0@]!G%
+R(+
A#ow
+r;=
"(0+
P9f"X
Assembly
6A x
2yZF
:/_|
rz1s.
dx<t
;$ U,
D#S-
Pj>c
;A=E;
? J*
[T&D
fe/gg>
LH!<A
|<_o
u5#3
%D/Q:#'t
;0zk
oyW"
z|g~
:dorl
C$<3H'
;BO
#~p},
^*LD
*X3?N=
ze9U
vds=
R"JI
<xMaV
BYxx
Invalidate
)w?0
7rw9
h rJ
#o\#
)2Lq
@7TVx
vj1@}J1%]f$#*(q8NnBWWvr&!
3y,pL
bnuW
Size
,IDAThC
7DhDk
bHt\M
Um8k
AY;]
b"6~KAImOgm7t[ ,-b^Jo[16%
1$"~M
NewGuid
uE9j
w@9
81~
Iit E!a
set_AutoScaleMode
x{Ua
$sr
};i1^
NE )d
%+kj
]`DsRI
2H4/(M
~w<.|KYT
JNku
=W$j
Tdw
8#:Z]%P
|NoW
[RE
fr3
lCsls
=~o(
4Y f
>]'@
XyT-^
`7n
EoO}
fc6q
)JNh
E%a"\w`a"Z"BWf&<,2|,W&V,%
8Ck(y
\6YOJO&|7i/3z]Zl:?p?9#Nj
dOB\*5
t(d$W
WMrl;
2y"
M ,e2
E;sD
P c*
.nc
lzY9
U\EXD
<Iz1LW;{
o |d
2 4lp
+^TA
jbc~
rVS/seUVFgO^@6!=5I\/b~v!$
s z*
IContainer
| /S^
xUJ=
?Zix
D{8:
pR<@
x2 b
6FcG
YxjAw
!M`
Bzm;
(7 D
Zmz
TVg&
o<"o
`7*
ISerializable
5`NDC3
";#'
0J4*
J3O 9
28fG
iR{h
<xKC
F/cu
xBy^
cuj.
0Y=u
6XL)7\
':q&
1po@
7Px)
Z(1
_%4R%4YkpJ qV3T+SN)R;C~V!
ydcexs/
W_L6
nn/-
4U7!
kL>T
^zlD
&{P.q{U!*
ob=/Q
AIsh
E)O+N3/rI
4(A|
)1T66XWn@\,h2aa\yR}Z3?;P#
6d-
x>.4
1/%i
.`tLb
+B:%
"Ak'
} eb6
3@M5mtl
_7ei
0#i*
qtlO
Control
get_OverIndex
2x@{
5Gt,
N)NNc
pzJW
-q~@
bY8EJ
Rc'Y
9bA^i4;w3~1I1j*U#[Su%sh8"
1tKD
2ZY-
2q:I
rIDAThC
-"g{
JB$<
])zm
{.Z{
'C W
ros<
;~5}
k>|
"Fbv
q7~
TJ,/<
'Y~,WC
-v\}
HX[4sU&[OJmma
#tkM
&m(%
H;EBI@:(pq8_<#}d*CJ0lDY,+
^M5?
.3tu9
C$Y 4
ContainerControl
>mT}
w\R!
V$ q
^PRc
fv IgR%kaWV0;n!hS}V8+WC]!
XZ}|
2pR>
F Md
V[E>hq|
m"6UH2PI%^$[9h?iG-Ge^WOD(
oEMa@
U :0b
_>|#3
@TaH;
^mw6<B]%6[[$FDX3uT[9#\u<!
l~~ X
ksLa
VUB}
cxv9
zSQF
&1c)l5
ReadByte
*i=_
Fjy
*5;r
t6@w'\h
*2xp#&
:j"vp
Q@kjr
'`Wy
2fd^
WLX
3F1764884A245F1B3FA91DEC2E25339F23787561
Y'-5
OQM$
$hyW
cSj~/ne
l6ov\
:G]_Jd$k_`4,Djm5G0IB&A:)%
9lX[d`f
.(Pt
6 FYd1
"JO:
IComparable
{+P
6{98k
4fs\
o@Cu
S '3
wJO|I
GK>
:dQExwG
z& M K#
AllocHGlobal
bx|\
L@ DE
ch]3
ZI5Gi c$3
nj[/)<kW7mv%78tAOG_}YU?I%
AssemblyCopyrightAttribute
wEkeWa
N{G`
w pq
73q+l
qIRl
"^Z/
Ms<^3e"
?,cu
$+]^
cSVG
12o$
LdcA
sP:)
(@6s
h$QU>}V"Lj;(XUU[-=Y@J[R}$
'<Qi2
8Yb-w"
Rp0w
B9-T?
17X@
I@8d
f|eI
Q=?K
z=9&
C_C\
Vaut
Gr[[yr=slP/8:%-Vm#hCFD\,!
[#(F-+
VkYf-
|?b;9
#qlu
aS}_-c2kD^mG&D^NHdJK^U0*"
sBuY
t9\o
c:8_vU
g]|>
k+n
%Nn%w
g0Ex^8
rP\U
XBys}F'QOu7)8#?$CJgl6%cKC
@V8-
.u)j=
H 0q1/)
2r.;6
Mt-9
?% E
hi~^>BkTRbqP:gRuMFtz@,{T,
Bq1U
kap>
ZnWAK
op_Equality
1-Cr&,N>;9l0(,r<G-/NSW*T&
p"PD
+e
M2Y,
'pLV
e?Dao
e[m6t
Gb,Q~
J*e
}H&w
sJao
(f4'
HGKc
pWyf
,W *6
":O>
s%`)
=k1V
?bHS
[J6l
S;a
C?N:
ControlEventArgs
bHF_
2YV5
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPADLq[
{T&VB
yfk
pkoT
lssM
% *F
]oA$h
!I{
WTZ{*(
"V~\AAX[G~?=P%/u,o(1}0y^#
-lsnP<
>>T2\D
6$;4}
set_Enabled
N tb
{4JT'
pT9E
HK_i
/zO
A{{Y0U
`VJ$7
Read
#nR
h :F
tH7 FH
?`#5
y!1f
J/cd
xjC {
g0PG
& ;t
t3<o
z,*y
{TjT
Al@[M
da:.
g7 @
BvctI
Ke,1<
get_Value
Ep(Y
h" &u
hv >
N=*Y
.^R_
Ix*^
o) V3
SqA!?S
nM){^
t9Js
xHpJ
~Z@?
GZgI^
?i7!'
)D {
C&Og
@,Hk2
9[ gB
j1w
;0X
>1j7
7:t8RRiw#uzLKGl[Ez_QD6bX'
*C<pG
G7M w
x$k;o
gAMA
0epc8
3&K}
%VUScw
s(b)
1tuW \-p
bF:I
Nl+k
b/rc
M26K}
Olc&
)_86
Uu[f
AjwssCFD&{#*L
Q:*%
MarshalByRefObject
au.([
vyFJ_?
[Rh
C|if;F
AsyncCallback
sF">
"X g
;QT6
G}-T
mscorlib
zt+Y
!BCW
, ux
b+Vo
OFm}
wFm7
<U!p95&6GhIx X,iYMJLn&$U#
]#BK7
Ge0b
*]sA
+^!|
"rk#
L?;wol^,
Sa 1a
b@YW
R<Sw*b,7\a86!ODD_#V&B\1:)
8QC)"
{_"i
_A!5
9RK]
!UWD8*&YLIYz'qFr5W7?>T+r"
[\
$'3n
S:Q/-
h_ jO
Cyn_
#(uJR\nxtfg[Fp4:-dDxL[wb"
YY|7:f
get_TabPages
TaHb
D%BT
'B,[,Fkd7wtnU%%MqVJ(q8LA$
)F)3
1fu l
.3Y`
j) 3R#C
W5,PC<
0aJ7
.1WZk^K
\]$UB>M
yjX[`
WV82 ntG
' dv|
/&%i
Ej=;!
JvIR
3_mjF
:-?>
y>p`
ONCi
yUDEQN
c:u 5 e
Tx W
a_<&'
s]u,
Aqd
B 4~
`yv[SY
G5xKP
yue h a
hpOD
$br,
Ci+G
xHT;
System.Reflection
znlf
! v]
.1Y`
Fa>6
5"6&aT@G~-?$+ii)2(mjsk^,'
WDo4g
kZH!
)G%MO
9k +
RuntimeTypeHandle
s 5g
bD}l
bSmB
S6,N
;@&
M%kB
Jx7I
F+yM7
raw0\@JQ
wv ^
WC%(
@%!%
TYT#wI
$_>['B
'vab${RN
V8[)
<@Q6
6apV
]xHqf
W8h i
1sTG
Y!Li(r@
E~r#$
sender
n/iL7$5t<w"5N,@ Y^@H=e!I"
[ay pL
\:pg4
Y{%
4SOM
j@
}onB
0O_w
YEn0FD
u%*ujy
Append
Object
\?\E
G6 p
j%Z"
&2v3P%
t.Yxq
System.ServiceProcess
G1*Y
>I{%z<x
UJ$d
%^<-.8
}@a,\Se{CebEEdC~d'l]#$:u/
Qd)#l:;5=A'>v5o)V$4Lr3Sx!
EiqJ~;
w~-k
N~6@R_`?Ip)$4OPlnXN^4US5#
0OygQFLJ#wu;S}V%Hu>$M8Ni&
WuWw
z|Y)
,B]K
fKlJ
4fsQLz
0L (
3'fy
N6[s5
mP5c[
~F#]c+
9V;"z
gH Q
]IDAThC
N~$sB
XBl+
W%pV
0og5
0R e
AssemblyDescriptionAttribute
V>0K
XBlV
G #0S
E9\7
@4O7
}8.@
`n$
j3<|8HGP
[`2 p6
V'fL
h}{
);c b.
z(/i
46V'
Ck|V
I,I^
/PA O
B5;c=`G
l~h5
@5%N
\<1z
$P37
1y1A
AmOw
<6bB
`vJ3R[EE?'Xp_Yam{EgpR#}T
BY n]<
^X;A
/yWLy
|:/b
/Xe7
$ T)g[V
2F-R
eZQ4b*
4K iK
.D{t
G.+|0FP@
t>o c
GQN,u
-p>Z
tz)!
)5W|v[v8:yZP&hM:WpAUO7:~"
K<!2
u2Uv
Yc>M
+xa
+Xr0
#u0J
w.V@n{L
8jyau
~=R4
S_{9
{ 7iM
# 8o>
*|6>
0z [q
N)z-
v)mS
U?_W/
ddiMi
dlTL
g0"y
ZV/r
)<J\
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
#F:@
U}5l
! {i
l>TAF
LV^'\#XQ*G!Ik-E1FsYX~)#m6
Eiq\
@XDs
WMfoJ
`L#g
HBo
Bx4u
"tPj
}%!{
+UwOj
M'.J|R
0zdq
h_^!
#]ci=c
Zp\T-_dzr]!2x2yg*%,fA)&%"
LVrT
v];<
get_Message
!This program cannot be run in DOS mode. $
LWO{
~[ui
{xC|
callback
Z~5.t
*Ya6
c#k-
^Wb"
~|ML
569B
g-GWh
wIsH7R
=*,c
byM2
#5V
B;g~
Dispose
f :.
0.zL1
{zWqn
~8tlx
g7J4
:Z{$
(e},
R#S8xv
#tuf
W"Tr(
,xp46
)|ow
]8pOL`$
X-=u c!
lIo2
\m%
vJ+;
H8wLx
Ve?}
4E2BE99140D24066CADC84F74FA899FEE5976B68
JaGrFZ
}v3F+
8ecf
?]CWO
:2=N
r-x,
S70|
QNSs5I
{]9
<!ae
~KId<}
>,}L
EYg)
H]y$
.d [
y9<S
7u]I
\8On
.]c2
St2+
Grj)II^
oB0#z
M-z~
|y WE
#ddT
n)5J
wG>ww
Uj^]
$tTR-
yL*9
ukY
= 2
>kXa
hV3I
DOVNf1
:Mf
rM<Q
zIDAThC
{mrY
,*0ia
x$ A$
L<?hYNF(,Pmb0b<m9MG'lKG_&
_U~juG
v V+
(X%v
s!L=
noV^P|t
E>{<n
}ULUfs=0I7r3YL`[mm?$ZLKJ!
wE4
wYuL
S?tW&A!I/[}>VY5jOK<O-od_$
D_5o
Qcb7W
N*Fj5-}
%]57 >5
>4xd
$.3
-u|"
BSJB
E@8<<
^V&wM
*8yX
o-G.
TCD`F
@Llx6*a4Jl>% Z]Q\<wk56l2#
jO <F
x) u1@B?Z;IHZ*e~O0!kh( 3+
n,Rht
:yHk
/C9S
*[h!
`@M2
:'6^O8
%u m2+
[x}o
W5u8]5djUy+k6Bd!0U=;e&X[+
m-3a
iwxT
get_ModuleHandle
,IfL
Ax*Y
6e"/
\ehz
z+kx
; jHa
H~=g
')\y1
_\Pq ,
@p=
~\?\
:+Pk
Uu]..
&G)jB
IntPtr
dd4L
jP;-c)
d4S3
{' :
6[7n#
/Tz|
"J'PB
~+<7Y
HJ# a
&4>4
jkTQy#
a/R6HF
A>]=%
!L kB
wV!,
+^N
-_#Y&
FIpc
;L Ch
]HyLfL8:lY48W(YB\}cVC(%\'
U>I*
;}Gc
` }B
p[Cp
uW<+
&H,y
[W^N
-/4
:! .
9[al
8rj5
53p>S
5bNL
System.Linq
>}Jr
VE$bz
@yp8
i)|4
TYYn
,PDsf
C708234F139063BBE3CBE2208BB6ACFACBC50333
InvalidOperationException
QX/Q
Yd4V@&s
i+`
4m6K
$ L7
Elj+4;
k!&\B
i)wS)
,*,A
9umV/jKr()>@`PmD$T=R1{DG&
3 5W
^C _
_Q@Q5
OFPg
:kqp
-(fR
%#fXCU
X{.:
`Ux-
"Y>P
P$:@V
-a$f
1Mw
1u$)y
9H2e
AMzs8Grv}' @2g_8xnreDh-,(
IMDfujZWEE#s=nQtL?4mF,c:!
n{~P`)byQpkq<&*%14M*LY)="
v$U/
&~:H3
BlockCopy
{+)'p
n'7p
sR.a
7H=c
/;C-
Zxe]
*V5.
.:o)
75s_
]2L>
4@c@j]
Rv~u
qO ?4
~\lD
_yg
:t$-rF5DKX4F1|@Ot}^Cq8I-(
^|UQ
6P~^
tr=w#@^
0{Ocd4 (
Qt]OyT
i8IhU
2(.E
~_d
_$\
dbu )i^r
F6K1wUy#AOZ
fPrH
Uo},
S =5
I*B
{U$*
>IDAThC
zpj(
)>iK
u$p9U
Mh*n
y{/C
1TC
M3 P
~ 98
Q Ft
SR<sI@
(< Y'w7
"_,]
u-;WtP"H
E(j
pe)_"
(L9
q~Yd\
8]ZD`S
G "E%x
{C1U
ZdG:,
yH([
#!q"
fOQh
n9'dKl|T^$b5jn&*=su@oATA
0pC=
/yWG
g ZaJ
)1NQ]< yc/J2LK]Zg^x5&x"b
kX2w
2hzi
7A^d
x mY
$utA
]u@
r=LPy<E
@XTNant;XPX3B:gS^ 5Rkk@v$
[Iw>`,C
~Z(>T6
RBA{N$C"}M0b1O6^?%yv5'iZ$
n4S@L
DQ'8
;WVx
nES-
Um>\^d
TrG-
GGRqI`?~fF4G)l'kt|2IoWc/!
MethodInfo
wtU(
1.0.0.0
!mfA
v@t03
,cuf
D$b,
u9%f
E3kT
2xvl
D#u]]
CompilationRelaxationsAttribute
/}Y/
T$R>
2~5)
uUtsG3'/2!52Q:5rCG1=v!HN$
%4j
TabPageCollection
IBindableComponent
c#I
MemoryStream
RjOS
EPd=&y?
'Y;6,
}V.o
aa n
#GF^'
WPsr
ResolveEventArgs
KF !
X4]ie
M4RUa
<{!z
em&?
1htB>
oWo]Y
w5AH
,#?{
p0o&$[&$^)-rY>OZ;R6`2~1~
YvPA:
2um|r
|y\d6{
Ok>'
fO}2
>9fu
LJKS
cYZ/z
Em:B
OnControlAdded
*c')
J vr
vIDAThC
r`f[
2f?|
%PJV
[tA"wr
z=Hfa
o/b'8
+T?9
UXz6
I*9;
nS_b4
jEl
q3`?
1Hg(\
*3f
oF!5Q
bZuJ
iTv{
bz`U
4)imp2y
2+ '
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
PC1rO
F %[
;0}2
XKl G
{z-
cFS
YzrG7
I-K_
a3TMGRJ{mP(6qtY-Acu77ufO"
V[9N
xu3/
C@0
A1/WJoy\!~_z:R;?8BcWf{e~!
A=!!
%AYc
PZg9
~xE5
_'N]
78B@
IEND
w4B
hYZga
]bkY
ug(;q,[F ]NJmnM-p+UX7!]-"
n4U?
B%I(
>R3(
cNfp
`{9>
M8fd
pr{%`1i*
{pL\@
y2- y
XM).
Q`_Q
QVkT
8@~Ck
D6D
~dSy
jm@G
H/dh
"Rme
FtH
Y=/tO
J xe
<wY
}ZVB
(=9P:Sp*t4Sr'>$R)*lYZqBq%
*2'\@
PoT
^=Uq
=7{DTjq
oAx O
{p'5NCEqBtg-osG#Tp9Z< 6q%
/X<&
't\|\
@b:J
0'W N
"y M
o\%H^J

svvZ4
|M&pR
H`W-
Mutation
9g B6
wDM|uKIQh+1"AG}J(czXy93X0
Zj'_$
4H:
Qt6uS+rV)$>&UGLXna|XT]@`"
w?E`
*etl|
).N
/OzTA
6.F$
b| S1@Z
get_White
I fG
y~xF}+?
y0&L
^.ld
b %4
bEs8U
L`Ty%
{#d:=LT`UXwA_m 3&#LgB}FE"
V@nvV`*xgKPeOWD:T\ a,EOm"
`.\(b
`jK@
l!sm
Concat
zx'L
+=~_
SzAM<
zEg1
(Ani?
StringBuilder
K3DQ29
Ihwx
7Xr^5Y<rb U=waK5$4Wdx_Ni!
"To<
G#\[G;Y
l.vHf
8_+z
P]Wb
4#aJL4O092w:Xi+PmDo:J16D"
) ul
y=nkvUw
T&)
B F| M
kV9/
SAT81
Yf}REQmYT-u3
1C|I%
/AY[
>Y%{q
E>cS>
ag=<
@.WP-E
~L'#
<MWl
mKDw
s.m3[=
p=eI~
l&iP
U0,X
jL;
[1Ykw
}GtT/
get_Hand
zXJ9
2+:1
t[[o
'ctn
* HJ
<
3PVl
3:;I
w_ox@
9|6,Vf/1U dX>D7SOAW4fsh1"
UBEK
WVQ
%q-cIN
,,yxn
OiSv
nVBlJ
n;iK
>/y5
pgg*
wJ:K
Env~m
z%_S
"i/9E
8*B{
!ARm
&>~v8?;=k7\&59*";ut}5qa=&
&M7b
]y&8.
n3I`
=8zGbSy
{DXW
E"m2
System.Text
:iJzef
@ZX
6pBT
w!?%
_MsB
O 230
Ro5 _
;*pu
aP;-
tW$R
j&M'
.Wo-~=s
lkMbB
0$vA
cYxX
|yZ
Y0=*=Q]QF%tlNxqFV9UP6yng
lK5b
,hT[
UyUdjLv8
4PQ)
pd;B
X +4(+
kqsU
AK:]
Xu@9-
~":o
*$vl
VbdJ
Q##~
y(pj
, 6"
GetElementType
;BBmck2wV?e7O`#(?@eH]l\s!
$3c\'
D1!ru|
4m(0
Tt O)
UjA
(+
c:5Bm
[$3;O
|c`J
.s2 k
]n'kiMFh<L&r~b(J6EG,u,S=-
Qc06~6Jl$06AfKB:YO'W&:f$B
!SpH
"d-Kgu/
yxY{z
sD!I
W+l[-n&b0UscabI+uNr18Ndk"
^>Fr
wOU
Q!-#
_B0Z+r5uBfM;qj[8S1bV7#[*"
<Qu H>
x}?
84uc
7vq@>8qG#_]hdYX8N(CNKb)_#
e AZ
&X'$@
7}JH
:|Lf
C eT
+$DJ:7(u?`'BBs~CX} K[lI("
L|_9
_J) :
3%c5A
to?>cRO
}~*kt
R:9"bE,dUTdrOt<cIc,<3>Vz"
I'"
8 0f2
5SuP
Q!&T;
?# D
Vz9("&^/[D-1r(jE!e|@\2cT!
_7FEoq-
?X_QU
jIDAThC
nLC*UrH
FieldInfo
.INk
Font
>#*6
c 1
p_L(MG
y4U\
#XR{sydkjJ^NpmFCj#UGI%#D!
b?gGj1$,S->@_J;98N98*;xoC
ZIMuL{_
#Gb ==or'
0
9`EQ:|Y)M-y_midu^)HmkpI+"
O#A
9/gU
/S#4
&:.u
X{DJ
_-ZT
kAfm
? ?!
#vaQt
uzzp
r u_
String
UT:N^
VIFY
S(?I
_CorExeMain
e~1$Q
XtX.
P:uj
^h-?
]d.
@_KD}LcQ5/`>OTzL!_i14n@(#
Ugp_
{tEn
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
Nl|<wN
;&2m}
w-98
=Qgh<
+a)U
hSlcX-<8(e^Cn+o?9=1Iuh=x$
<$4H
U7_1
5e-7AJ$_z4&8p*Y+(HNN,I ?J
U pde
;s#diMMG#/~Gf_Rz9~msSg3P$
K9G"
kzxR
Y DM*
InitializeArray
]G[Y
1b}Q
_pN=
X 1'vw
L}'\i
?Jq_
:xpH7
kO DI;= ur<F+VjOV/KwX0kG
#`gw
`WFoo]
F#BZ
Qloz>PR
*-J* XB4+)/U33I_W)trNHEf/
mc|'
aL$
KeyI0
.n7Vh
-V#
WQ_
+OX.
@P(BH
9KF
5d,S
ToArray
}5vKU[}b
*%&xy
VN9CE,
OnCreateControl
kj1XSCvDA6)~bA=?X4$@?Uh?(
:,0u}B:
(n|=
GU!XyiF@sZZTV-LfV#;6W00X!
2*h
(g&sZ
?>h}
t4LC
A/5*3
}j7RH6-eePgb<Mt2O_XgG!B_0
7N)L\
z#,1r0
{7q6
Tiu?
EEW<V
8LAbOO
)PFheuI
bOVo
O]f
B|3Le
q.^m5
I"eO4
get_Hovering
HX~D
cEf)9G
D,"<
IN! .#
@f}
nFPb@C
t M0
zO{Eg
b fV
@ 1s
m]cE
pw^H
jpz =
.> `
~"3X
4W^j
aXWSEm
V9{O
jS=q
<K6;
Load
.h!3
V*M8
NjEXS;<$!g^VpB"Ux#LTnqNm!
)D~9^`+VT[r5Q(]XG,h[@BPZ!
QSe
~h{J
`oC\
rs9 t#
&.Bi
J7).
System.Drawing
4&a[
YrT`UDq<H:PcQiac3(^NwrM'%
5buw
e A
`:#{
@p`-
get_FullName
kkSw@@U
r?TRy.
s0i!25
3 Beg8F
)yR+
]HIz$2D^~lR47Bg _?Hz:6O+'
grqg
|O!3hzC-o]r"|U8%A\ Ao{vY"
soV!!-T #EeTzz9;MqF:,sz7"
BeginInvoke
HUvo
o ^c
F@ZZ
ADf;|
n}~ {Elt
]<SXkr_m//H)p0>a$zjoPS@N'
:vP1$
W~WU
^* G
(oL\ {
T6}y
d 4-
Kx.;
l5kB
AIZ$`
|(\x
jdYr
q\^)
.*|+ju
U ~"(Q
0Le[UvJm">=??C+gp-H?T(&c!
;|&^n
//m6f8/_sa`&_gh/$a*'`\J6'
DI7-
6(J$v>
.G3S
.ftQ
KA/F!`
VD{Pl[Wc~?:4EY) &;7K;,ky'
};4VhD
z>$3
C>t%H
Mm= x?
z*gua
Z2XW/
Z-5
9`(J
T5C!m ?r
HatEJY`@*v82zX+m+"alW"^8(
fUL7
?9j,
p^oP
F9D
Ewmn
RuntimeHelpers
%fhttU>-z@hoY~a-d>Qd^-;,%
~_xy_ld
9dmV?PT
/c6a
U?Iw
[=|@T
bVbQO
U gR
Q aw
dBe&
v7fD;
'+cUJ
`O9n
UserControl
d -d6N
<e88
get_Enabled
"kDS
CN(q
6a <
-o'ic>
&^X]
G>HN{
~jNu
j2{T
<4m
H ki
)+%h
b@}.Y
*KP)_
j6?Kf
pBDN
lwH~|
H Q#
&yNi
DAg4
R0!?
ANc?G
|Xw X
g`L{
.7)fV
X , sj
C<]+
E[2`bo`A;K,K3ub,K;Pni[)0%
`H<Fp
<Z#S
"UEGn^
9 9
F' U2
dBb e
65-yA ob\2i{\#A")g1k:pJZ'
f{A2
Qj@y*?6
};,
JCf*
!GMX
KoF]9X~Zk
ComVisibleAttribute
"%3iUIxb
dJIV{Q
Pn-g
^jm4
zOm}I
&]j@T
2wX:
]JZvf
7]
a}i>
h.4'
!sd
tLuS
+(V?4
U^3.
0=[
! OI
!k!A>=
qH@O
iT_X
!I6
x.=g
Xq90o:m=4|;C#wrr;|Vf&)"X+
1Za9p@FEu\%/?2>?+&WH,2VH6
'P}A
lkI
6xId
s" <
bbX,
@?T@
x<UC
=E2KO
SJ*a<14 \Hp~9HL&%A[Rj[r}#
[ _B
0~c/=
}~Kr
)9K$
b*T\
ir`
-j`:
{A Ea Z
&itTNu
<)X&
AssemblyConfigurationAttribute
i42D0Q8TJf#HX3Nm9]A-GnyU$
Fo{2
_$dG
U9Fn
Rq;lj
8%pJ
iG*@<O
Jw.Y
6G,.
s-Ty
OnMouseLeave
*_,C
I)g2a
L ^Y4fAfNeU
S0w0
\H|4\ND
s_w~8R
Ch~?J
lT6
;@@C
EX j
Fw uM
Q2daC@Iu
TEGS
+S$f
_it8P
UXEC
r 4]
%h _^
v P$5
t*;.
~RtB
U<q~
Stream
b4Kb
ME^K
63DH
y%)eo
I:<NS
a-13S
SjNP
W\NLFo3
(j|
sRGB
%Ug(
Pi?*_
xIDAThC
<}nd
;bmzVqM
kIDAThC
O'PNl
<)EE6z]d
%~Y
RIDAThC
-EU5
9t[]
CreateInstanceAndUnwrap
_7_:-&
6U(t
9hEk2
#=NI
&hV2
?a2)
0EerMv`5c=*6noWxB"d;\XMu"
*NU)
a8'=
>7?(
vQ4*
]9#$
y=Xi
FBftK
get_Control
,=ji
P6xU
Y]$C ~
z//1
3 h
}:AL
+O:
Confuser.Runtime
j%m:l.
un_]
DB
)L6
-$8gE_raB&fbvjf1#m(]kCDw"
4KH:^v +&JjP/]jD*-4Z-NUc
A1i/z
7wx$
%FUB
|#azPZdGG2q\Gb*BX(r;%%a'-
N,yfJu
2I3%%.
]=P<k
*?/Rd
RgeH i
M<$X
\%8go
m}
spEY6
uIT]
a2w>DG@n
V%Dw
U}zQ
IRe|
~^7&r+RNOtt^NnkdF9*uf>?q*
+]*~m
QQy?
a$PI0
7vV!
WytjK}z&4
$ S{dB,
d|rL6
!NWR\523]@u%+X+Fa12w\tY_
U)Js
p&KM
<NxMi
#ztrjL
O7bx
U%O4Y
Q6LYO
jqQC^
'EuQW>
5IW{
.lqMv)
I l X
Kd:0
-`C%@]A!<_f;Va&0{Z;QS38!%
1B$G
4} w
AOPC-0H
]>M*
c_0@{{zo\=q!p9 p*#R6i/Gh&
+EojC
Y1*X
set_ServiceName
>GOz
dFtC
P_<b
$sH[
7FYJ
n,3g:
#Ty+Ce
j[Sop
`UU9,<cc-IBGk$!PS{`vl7P1"
G5}5
C;.]
!L A-0
J0@]
IB3P_*G
ke_2
[ d6c
zH %ZZ
i?fn+
3y))
n:#i
J~f,
\/A(
491c
Q!qS
<DJ U
MPJ2>
Ff;v
nOfVK
x-{ L
K}>-L9BU
LzG]
$HOfx
gkB~Z?
6$%3
pW0Eib'
< 8{/D
hBN9
4S$Y]
cHIg3j>8vRA0f|]NlEbE_q7V!
i9nNF
^<g}a
pFqC9j
|"G-
{n U
2wR/O+WVq)"[VRH n1ZqGJYD0
set_ItemSize
^S(6
mWz
h~'u
I2M
8xP7
AX] @
dxAKH
?Y^i
wz[h
E8kQa
i]Rd
@ZkUj
pU
oG5.
!+ E
,#XU
5@6
Ac~
Lh1iL
J;Gq
_qf-
Z^W
99w h& b4
U|+IREq=y:n)]UJyJI,Z#gSJ
,$Bt
zzKh
ek5r
&"~
f!tC
GetHINSTANCE
glem
[%96{Y
Buffer
D~kX!
J(
E4s)
Ez !=
6,j
c!!6v%D&:<P,96*'ob&s=W{q
b5%!
s23`
\ "l
s@E|N}NM=v[PcIUnyjrJ}@wH
Lc)/
#7b,[x;7w3a XmlHW}*/l&KI
d~=]Fl
IXx!L6
6m]a
D&.w
Sk>I@
MhVs
Fj0
'}xK
)b/a
88>e
[dqsc
h)X0%zO]Q=`!H?@D:\_3-#j),
K 9d
3gEnh
->
X9 CmN
H(Bn
qq"$.Y
u Hz
-0&'H#K
3Dw@
mz)<
HCer
0k+&W
} ud6
YF5dA\?OR#:3}cD|+ekxAJfT'
M5Z.
2vWR
m!23
`p;fGBP\EY40c{ITjsWyu2la"
}3S^7
Z$HZ
"#Qc
3[a=#
iUFh^
qB
%Ejji
8 !
6l?
Z+|5
\p,h
|Rx>
\m+dk
%NiIRg`]
kehP
rrlG
iTH_
W;y\c<
[C7P
mo]N{j]riDZoh+lB0,_!p`Vj!
h""Y
f?vm
csdv"G
yE"* $(j'p>2C-A}2A^,vz_z"
Bc%
2g=~ U
+RzrV
:];%W_,
s,g
?!Vd
zA'n
lg7u
]^O$b
AO1Q}
jX_5
m@}28L
]4do-M>!(8+#vHb'R%IogTfl$
/Tk
}`\=
jd2
OQV]
P6RD
(g<f
[e'*v&<oMVjH2w9FF"}5f4?i"
j~.
c_]pT
Copyright
?1O+s
uoDcQn
;NS`!FgHirjD_$S|*gK1A=66
`^!"
ArgumentNullException
=X \
$c5882b6c-ac31-4000-80d2-b79c113e6c60
wcKc^d
get_Major
YHF=
j\_z
}S"v
N*-'
.",#
{*18
z&-g?N"/XnwQ&x_)blr#3;?u"
"du`N
r 0k MyQ
~<Ff-
Point
,J(+
k@^?
m< r5=W
gwiHehk
f:R5
*"Uw
jjx[4
FpcAQ
;lcy\
f h
v2.0.50727
fj&t
g17N
{Y~*
PS&6)
.Ntmzn
\<7)=KLc`?^=5O\]7C]pAtt1"
]8t-
0vM:
N L&V0
xrN Pb
y~mz
H!pv
UM{jN
v,ed
Tosw'3'm4TzKTo8K){^ f7jW#
4_D,=:rFVr LE7w7a4N`IBvJ-
B.-i
+`-#]
9]T=L
],l`kTWa
tB6/[
|"%H%
le5^
y%gM!
0= ?!
|PUK`
.h +a
!@q5Z
3iY
$@)g
3FI?l
s}]1
$#Q8F
f_/U
DGT'"a_^4[(]LZjN8@+~>*=R-
XO26
@l3M
TJfe
vI\^o v
[sl(
Gfa_
N6g*
5is
Ct:<
bf^$A
F`y<
+ xQ]@0e
Exception
+6Q&GxM
Tm8<T?8XTcl
Jvyu
-]X[e
-$K+
W TY
ix*`
I.>6
]O- ?
%!%
oe/MtuA
mRKa
eEj#B
qh<?
(27Vsm{aKIq9T\e,/3d;8$V]!
p7w]
bE~v|
m?w8
K h9
$"Zqq55Al{)\-B8g J?Dp)|-(
{OU/
*'>s
Bma p
V!W
9H`k
(,+4
GetTypeFromHandle
IAsyncResult
u3!R=a
"Fv<
jlxU
!W6(;
Q]Ba
&bC{hm$jJ08=d&KhCZP&RVID#
|6 7
P=Yxh
h+o
>ZO==
X3~g
Wc c
U(ll
$?<yJhM"p(Q"@{r~80+Hg>E=$
9Yr#}
cuu;T
GetDelegateForFunctionPointer
-"a1
D}&;
RJ1a
:x4U
"ElH
|;0Z
F|f )
x?@p
)xZw
b8v5))
K$st
!i4|
<V;T
kS]
p-*
: (jV1dt{>3/1<Y*1@xO=92*
yIDAThC
+[b{w
`tXe
OP52
Hh>T
System.Runtime.Serialization
6 s=
Ib-L
s O/r||
}tW@U
:6LD=
3rSgf
g@Dw
t>}
3G&!
Q)3HQ
ARJBb(E
,qP=nPi?
*ZQy_
+?I0
gWm ~q4m
#bc&v
J;BL
&/k9
[ [flToLb7$$@7 ;10o==`jD;
{tF6
~IDAThC
KLng
ki=4
.usn
c} jv
b/}r
',,\y
XK(.
YlDZ
YY[T7
M,yF<H
iC_#
System.Runtime.InteropServices
Z]
h4-K
lp2]X
Oq2:0:
4]_9+75Z)%guBmsIF#$t_Ui8%
Math
&l3`
t koU
= UQ ~zO
rV >
Ve j
'H3/
H")aN59Cig[U_bp$Mq_Hb%g]
OZ0P
3 N:
|1d+
:xXH
, Zp
Cs>F
vuZl
4K~U
7xfai
@Zi
F`+y#`
L,[t2
Y4y
23G&T
ic=_
;.&p
D 4
System.Runtime.CompilerServices
{Mm@
~vNH F(~'q
5N+o
|oaZ
z-1kZ
_%sB
T )w
SuppressIldasmAttribute
Y9=Y

z:M*L
ma<M
m ]X
J xN
D$B
-Ct}
^c23
?-btk-
rH5f
8V)[R
?@h;vqaX=w4]gK5Q/%|k:wQ'"
R/TuJ
v}]X
)H*
+X#i
tPw9
!nt7
Rh``3A
9;q,J
F(EJ
4c-$
) 4W
D^e/
6].n
kTH9
d %'
7NnS
CNI
NJ4d
>cHP
*^ a
lv5"{
H6$m
GnM-x!g<smbMOT>nTt`+tSLr#
oR0*
S_*3lzPLL}DFH1j3@&|| Q'2$
iyRT
cPzU]S5(BwgLK3EF:4Qt8HP,%
2VmRg
tScDVb
(3Q Oq`
U_5(^
^joO
\H%`
k_=mNB/p;!(+nhCA[naAbnPV!
qAc\ m>
]i fD
w,'N
_NdAXF`
set_Font
f'w]
}~\Z
2}@Py
!s1/
I2%Nu
Z7i )
rc<!
s]d-x]
dgMo sj^ZS'n}\m@"7`mSMM@!
)Tzi1
N;22cOeN&M^\uL`/(YO9w%\b,
-D0
"L<#,1YO
M{4*
rym<
ufK~
dWB+9ZC]?
NI,1
HW K"x
IDisposable
~N#W9I
g>cFb
wn>NW
0ES-
9 fP
gTTr
@ E4G
=vWF
f8MK
!cWv
G`1P*L85^f0?_^"A1*:RCo[U$
+ H{
"0.|
*{s8{fesfV
t+4s
i%%u
HT]"
}RXq
vLd_k
\\mI
E9.#
^Qx[
}M5C
&'+[g
trr0h>
!Y"y
%9&'K
qAAfq0S
331XE
yL:l'
AssemblyProductAttribute
+iEJ
?2}{B
z502Yd
&[YK(
'w_
YT0o
EoGC
'deAG*i
~2G)
n5CL
nSE]
x5$)
=Pfj
=W,i
<Module>
GKk,
@EU+h!P}C,Z~"'kTrz&-GZ>:%
Mit#B
uznR6
tzZ-1
gOCL
Z]u[9DwuRC(S|@:i@xPW8X=U#
@U,z
Ts$W
%nYwg
9qS$
^ L.z
xj6rA
;ll{
Y:A"
MulticastDelegate
2#uP\
A9,PfN
j-mb
vBX/
>.Sk
j8ax
?\%FbwD
!m_pData
/+no\
Se&.
A:Ed
=-6G
s8a9U
value
vsBj
nuz!
DH$|
:i0X
3`nxk]ST
}v [
2018
HE.{
t'C[~zS]~ke0a~94;}u75'fd!
zi>z
A:
)]a
XwG 2})
;IF|!
#?Ib
a(!Do6BQh(1{hm#ed?\/u9In
9A =VO#6x4fB{ZW>! |oVR~<#
(b'
WBo%
2shA
upo3
YsVl
Zk{+
OnMouseUp
k|>Fk-61Co%r{3]L-8>uW!\{#
B2K q
7W#5
F,W^\D9:M_&X'N~d@*YY%)A]%
k/3(qp
{ :#>v
Jw6b!-
L0Iy
{(#r?
<B$Nn6ZX@r}B$U%GnMD'q5wg#
xhYYQEbRTJzK2lTl@,-9Zc(?%
:9Aa
?,U(`
1<F
SByl
RY`r
t%,H
UNz{=bnmV&cT[Oy)n+mgPfT_
@z.1
r*}jX'm
9aYN
-qrI
)MI~
#GUID
/HQB
eN-n
~Bgk
uR%F
D[3c
",lR\znBkp{5/ ip!1bHzV3N%
>?RT
=IXj
b qQ
4;*
set_SizeMode
]BW_
.Qx&E
3N>/
ICustomAttributeProvider
/}9TT
KuV+g
)MI wqA
%H5W
Rs5f~
M0G&
Y6%W
J6du7
3nb7J
"wI=
|+M[
z\5 v
Ro=U
S nTgg
%:yi
%MWPp
CpO6
05 C(7
_[@"dO
+cQc
0hz;
V!'$
sJSWFH-
b+N3
@ Dc
( i |2S2A\Kz)QN0X%skF:^~!
!N*8
m J,%
%SJ-
X +U
!#q.&/
_$}r5La]q#`#A8=\\#F>m"!c"
Nullable`1
.zv
Hx Bo
h/GxsM$qr{`s!ys}g"=Il[I?!
hsWF
vW`X
J)0
fzeA$3
P:t
{&?m
cVhT
Ne(YW
8#pF
c&*}O
&&Wq
0c$E
{R S
Z$GTvpVdS|t-EA$GkVoY%;FV
18=(
rT{cOd
{L{~w
d]c0{e0&ARhY|n'oY~rq;=z\"
&C~t
get_HasValue
U]gF
?! M
jP+l
fW1[
/E j
Ku|)
wSH_l
mV}"
0PPy
rR4el
%E+nk
ypZ'$\
&d]
^pEi:1b
c6iB
lu&@
Gp!b%-U
Y]gbZl
ubS5k
:CHJ
b~)A
Encoding
ZncP'
plssA1KJuT_S/,kIoGJQ4Kqh
%lR>
1iM:R
-TXxJ*
t,fF9
/cOD!d-:
TOO4
dNZ
&*";dr
jz <*
ePIc
<A%T
xN];z<K<[F0R7A?)K:]_\-!f)
x.]k
IEnumerable`1
o_x?S
} c?
>U_e
get_Module
TabAlignment
@?).
\pQ+
d+~aQ i
n?mN
L!2#d
9ys.
L_2Az
mb:'
>1yT
"*E
cpE
9N@&
J<M5
&`.ys
Zdd8
u:[!
si]G9tG/a?NJ6omVk1ALEkB8%
Rectangle
.:?q
>oc||tFC#L?h4'FKQ|O[O5O<!
F[TR
.`Y!3
u9T?
!VS2
+"ry:
jr@]?>%
AcFu[
Cursors
+JkqA
>a0)
9Qk):
get_Size
>pv?A
qdvo
^N5<
CvEM~
ZECw
mXUJ
RAasf8o52g ]~Jghgofh^1by&
K/>b
'@Pf
blB
TxB0
%+{fD
x O`
95Nau"d}<82'y\s(F^t&VP1&#
1ud`
ViVl q
7mxC
S ~}K
}(_5('_+(2\ihbkm+Z%o71\/#
"5#&
M 5?
$l%E
#mxNm<qbn=/(EJ Up94e"Xe%$
FvLAV
n?i_
System.ComponentModel
y:RT
!UN,nN2)5?>d-+k]"H$_aNit+
Ark.exe
O:b
~t<,Eh2
(5W~
436534A617CD86B8557AEAA31D433ECFF38B112F
gL@Lg
!@MIXeGSdY>'bE|V Ix?jerf"
u\UB?K@|gEIxDTWB\@82umB{!
v t7
A"RN
R~rm
Sh.
!Y5d
-edVjJ;<%z&"KMn:!rYFd\^^%
c 5n
-IjS
fsUnY
DisplayNameAttribute
wt%Z
Ko?P
&e}7
~U0nX&|
R7^b
k+G9TI
vde
U0C#
C648C0E55DD0A71600A3C979FEC05C180303B2F7
j9U4
_aaoKy.
k=DH{
T/kK
LoO4
jQ`V
6#S
{fL?8NxG3J-/M?MBCxZ{B]-$&
}G;=Ip
s0WH
<t=jY
'<n%9U&f}Is%T=:+Y |Ba62o!
WIG0[wT
Iz!#
V9[3
z/^"P
v=6I
f=vX
gnMA
7/n.l
System.Collections.Generic
! 6e
8PDY
u]tM
ucn5lvD
G=\
Gt.A
+&VN
P DA(q
A7so2
R 8cRo
B3\`
*"x-
|IDAThC
'hw"2`B
,:TNz
h<{U
System.Windows.Forms
set_Cursor
>DK-
)9C
t[X@;S
OLMBX
K}I=!
}k 1
bDXw
a"h6k
~BJudU<JdS)DJ{;z?O1bH0`0"
zxe@INV%FO(CWF1P6adhSZ&0-
~(?
cR "#&i f
WriteLine
Wok./
Rtzh
z^QtuA'g2tYyW(:y%~^8aU*k$
System.Drawing.Bitmap
~G<f
Ned<
b%FI
'5Zj
[6?y
zKZ?
|7n7
bGj.
1u7"
IDAThCc``
,Y\
eO9b
Y& 4
SetStyle
Wt}<
In2Xk
{[g]Y
%%Ce
kU ~>Vv`
O+ *
RAs{
l_C/
disposing
[@+V
Z*L&
B168
}f/
g.y]
+ywfx*
OG/U
aeHD
[IDAThC
s:@5
#&!Inhz":lj6(gd-\FL;B+eH%
P;NdB:
h5|/
jF t
WgY$
@pk"72
q']i7}*
GQ@}.
n %UW
y&S c
Hz5{-+/>LO&!N7C/DX:8U, ='
(,]a?nF8a$ djr(9AV^Yi+J-$
wgaW
(
nb5K
t7#F
)t:q5
MaDO0
U@|$_
4/v/
_:|-
(Js8
c27xTm
1B`
gADq
kO?E
ne )
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05b_64 Seven05b_64 VirtualBox 2018-02-16 18:36:08 2018-02-16 18:39:01 173

9 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05b_64 Seven05b_64 VirtualBox 2018-02-16 18:36:08 2018-02-16 18:39:01 173

10 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\boy.exe.config
C:\Users\Seven01\AppData\Local\Temp\boy.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\boy.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Users\Seven01\AppData\Local\Temp\boy.config
C:\Users\Seven01\AppData\Local\Temp\boy.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\Globalization\it-it.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.INI
C:\Users\Seven01\AppData\Local\Temp\4a5ab21d-db3e-4a6a-97af-5fddf9e6c38c.dll
C:\Users\Seven01\AppData\Local\Temp\4a5ab21d-db3e-4a6a-97af-5fddf9e6c38c\4a5ab21d-db3e-4a6a-97af-5fddf9e6c38c.dll
C:\Users\Seven01\AppData\Local\Temp\4a5ab21d-db3e-4a6a-97af-5fddf9e6c38c.exe
C:\Users\Seven01\AppData\Local\Temp\4a5ab21d-db3e-4a6a-97af-5fddf9e6c38c\4a5ab21d-db3e-4a6a-97af-5fddf9e6c38c.exe
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.INI
C:\Users\Seven01\AppData\Local\Temp\boy.exe:Zone.Identifier
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources\Ark.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Local\Temp\shell32.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe
\??\MountPointManager
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2420.27672781
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2420.27672781
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2420.27672828
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe.Local\
C:\Users\Seven01\AppData\Roaming
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows
C:\Users\Seven01\AppData\Roaming\Microsoft
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.INI
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\236cc13b-7951-412a-a849-acf40771587c.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\236cc13b-7951-412a-a849-acf40771587c\236cc13b-7951-412a-a849-acf40771587c.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\236cc13b-7951-412a-a849-acf40771587c.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\236cc13b-7951-412a-a849-acf40771587c\236cc13b-7951-412a-a849-acf40771587c.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\shell32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2620.27677093
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2620.27677093
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2620.27677109

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\boy.exe.config
C:\Users\Seven01\AppData\Local\Temp\boy.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\assembly\pubpol23.dat
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe

Write Files

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe

Delete Files

C:\Users\Seven01\AppData\Local\Temp\boy.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2420.27672781
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2420.27672781
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2420.27672828
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe:Zone.Identifier
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2620.27677093
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2620.27677093
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2620.27677109

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boy.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3035fc5a\375c7a1a
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|boy.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|boy.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|boy.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.ServiceProcess__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration.Install__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.5.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\337da671\3850e7bd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\337da671\1b71387b
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Namespaces
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msbuild
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msbuild.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|msbuild.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|msbuild.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|msbuild.exe

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msbuild
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Write Keys

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msbuild

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
kernel32.dll.QueryActCtxW
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
kernel32.dll.GetFullPathNameW
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.GetUserDefaultUILanguage
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.VirtualProtect
kernel32.dll.GlobalMemoryStatusEx
ole32.dll.CoCreateGuid
kernel32.dll.GetStdHandle
kernel32.dll.CloseHandle
kernel32.dll.DeleteFileW
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
kernel32.dll.GetCurrentProcess
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
kernel32.dll.WerRegisterMemoryBlock
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipGetImageEncodersSize
kernel32.dll.LocalAlloc
gdiplus.dll.GdipGetImageEncoders
kernel32.dll.RtlMoveMemory
kernel32.dll.LocalFree
gdiplus.dll.GdipSaveImageToStream
oleaut32.dll.#8
oleaut32.dll.#9
oleaut32.dll.#10
gdiplus.dll.GdipCreateBitmapFromStream
gdiplus.dll.GdipBitmapLockBits
gdiplus.dll.GdipBitmapUnlockBits
shfolder.dll.SHGetFolderPathW
kernel32.dll.CopyFileW
kernel32.dll.SwitchToThread
shell32.dll.ShellExecuteEx
shell32.dll.ShellExecuteExW
setupapi.dll.CM_Get_Device_Interface_List_Size_ExW
setupapi.dll.CM_Get_Device_Interface_List_ExW
comctl32.dll.#386
ole32.dll.CoUninitialize
ole32.dll.CoRevokeInitializeSpy
comctl32.dll.#388
oleaut32.dll.#500
advapi32.dll.RegSetValueExW
kernel32.dll.DeleteAtom
comctl32.dll.#321
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
advapi32.dll.EventUnregister
kernel32.dll.GetProcAddress
kernel32.dll.CreateProcessW
ntdll.dll.NtAlertResumeThread
ntdll.dll.NtGetContextThread
ntdll.dll.NtReadVirtualMemory
ntdll.dll.NtSetContextThread
ntdll.dll.NtWriteVirtualMemory
kernel32.dll.VirtualAllocEx
gdiplus.dll.GdipDisposeImage
kernel32.dll.VirtualFreeEx
kernel32.dll.VirtualProtectEx
kernel32.dll.Wow64GetThreadContext
kernel32.dll.Wow64SetThreadContext
ntdll.dll.ZwUnmapViewOfSection

Execute Commands

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe 
"C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe"

Started Services

Nothing to display

Created Services

Nothing to display

Detected family: #Malicious

TheSystem Itself @ 2018-02-16 19:04:01