MalScore
100/100

ban.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 12/66 Related 2582
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 513.00 KB (525312 bytes)
Compile time: 2017-05-09 03:12:22
MD5: a28a7c48412ec7327ed5a881925b7d71
SHA1: 97d93f7b8b10ec98b9591286d06e9f88dea64706
SHA256: 68ea2f3e5d46cd34ab27ad225fdb8c211b57c43888971fb3d56d8b9a67d4f8af
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 5 eJzWv6s~ .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-02-16 18:36:29
Last submission: 2018-02-16 18:36:29
Filename detected: - ban.exe (1)
URL file hosting
hXXp://prosciuttiamo.it/ice/ban.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-02-16 02:04:27 [12/66] VirusTotal
PE Sections 4 suspicious
Name VAddress VSize Size MD5 SHA1
eJzWv6s~ 0x2000 0xe1d8 57856 392bacf37c5c0c8399b69ac39e6efb4b 8cdbfbfbcca120012a13efca2ea9c682f89481fc
.text 0x12000 0x3dce8 253440 4ac6d8000c226a6c2d3b3dd5ff6a999e 5e6d48b594667e1b25579c394255794fc1f53451
.rsrc 0x50000 0x33a18 211968 41f77d4878b7c51cea1ced46fddc7f5d eb41c03b5aa667b18fa285a9437fa4ef4efb6e1b
.reloc 0x84000 0xc 512 310111f6a64d7896bec05a4f1135f25e 9a30212cd9fc37ed282009cbe959e37bb80736fc
0x86000 0x10 512 f284ba1b9cfd1eb068cd558e8453062d e686f70985feda2285b8c1ed050fffcf2c70f553
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x50130 209740 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x8347c 20 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_VERSION 0x83490 920 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_MANIFEST 0x83828 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: Copyright \xa9 2018 Northeast Utilities System
Assembly Version: 0.0.0.0
InternalName: ban.exe
FileVersion: 14.2.22.1
CompanyName: Northeast Utilities System
Comments: idebuqos
ProductName: LightCycler\xae Master Mixes
ProductVersion: 14.2.22.1
FileDescription: LightCycler\xae Master Mixes
Translation: 0x0000 0x04b0
OriginalFilename: ban.exe
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
No packers found for this file
File found
FIle type: Library
KERNEL32.dll
mscoree.dll
IP Found
14.2.22.1
URL(s)
No URL found
14.2.22.1
Assembly Version
Northeast Utilities System
fa96eef8-fbc4-70
69a6cb91-b85f-6118
69a6cb91-b85f-6119
69a6cb91-b85f-6116
69a6cb91-b85f-6117
69a6cb91-b85f-6114
69a6cb91-b85f-6115
69a6cb91-b85f-6112
69a6cb91-b85f-6113
69a6cb91-b85f-6110
69a6cb91-b85f-6111
69a6cb91-b85f-6130
69a6cb91-b85f-6131
69a6cb91-b85f-6132
69a6cb91-b85f-6133
69a6cb91-b85f-6134
69a6cb91-b85f-6135
69a6cb91-b85f-6136
69a6cb91-b85f-6137
69a6cb91-b85f-6138
69a6cb91-b85f-6139
FileVersion
InternalName
idebuqos
FileDescription
Copyright
LightCycler
Comments
Master Mixes
StringFileInfo
Translation
VarFileInfo
69a6cb91-b85f-6141
69a6cb91-b85f-6140
69a6cb91-b85f-6143
69a6cb91-b85f-6142
69a6cb91-b85f-6145
69a6cb91-b85f-6144
%q^
VS_VERSION_INFO
*)-,.,1043536373
69a6cb91-b85f-6127
69a6cb91-b85f-6126
69a6cb91-b85f-6125
69a6cb91-b85f-6124
69a6cb91-b85f-6123
69a6cb91-b85f-6122
69a6cb91-b85f-6121
69a6cb91-b85f-6120
ban.exe
0.0.0.0
69a6cb91-b85f-6129
69a6cb91-b85f-6128
LegalCopyright
CompanyName
000004b0
ProductName
69a6cb91-b85f-614
69a6cb91-b85f-615
69a6cb91-b85f-616
69a6cb91-b85f-617
69a6cb91-b85f-610
69a6cb91-b85f-611
69a6cb91-b85f-612
69a6cb91-b85f-613
OriginalFilename
69a6cb91-b85f-618
69a6cb91-b85f-619
2018 Northeast Utilities System
ProductVersion
{23/H
d^cZ
u?'^&
7*M!
+F@v_
qODZs
QtM
v.$Ss
*S;`
LH$u
gRs)7
m)u-
wD`X
6hOs
dRZsJC
^9, ,K"
dhm@z
Int32
);2
gcI>
-NL%
&t ?2mb
.?~
8R$]
G7Uc$
ObjectHandle
'(y`s
N^r}
C4(l
u2zK-;
k>B9@
y*d
CRBD
Kbt#=BZFJ7
bmwo
I 3\
;;9N
^qNh
6h%p
_4#J
Vx
W;P3
ResolveEventHandler
(NQWb
get_Height
24nb?
m@s[)
pp,
g&gl
Nl+H\!XX*qn^[;B(bX4V&4nR"
P y
ae,X
;K7g(
=7 MS
/(NS
v =W
=0C~
IY"l<
:5:9
NXEHk
ej0:I,
M?/y^
GeVqK{ed:pJ&@G10/%T(`EjS!
%TPhw;5B7zm}'Ffh+RRq6F66$
{@r
*v+[
l 1W
ku@Y
= < < < < < < < < < < < < < < <
TFKf
rq;)B
KS\.
pVuZIL$6
Version
p$VQeFVr%zL|oZ0f"+waI*uM%
clxH1Ou|
/oBq
A7>x
p1H
Fv dy
eFNw"
wS|*4
X (+
k$B$
r0_+
i7FK
set_EnabledCalc
> s*
wR+#)3s d
c hc
&Jo"
^f_q
] "
=\)'M@
pQu@Oh
G?b
2`%h
K>;VU
"3Ap&
,T$_m
xo%H
hS0%_2
Az !
@&PzV
;W;|9
3YsW
u!X^!
f1t>
%QN
5.S<
Q%
APOw.
TGQ*
J)<vK
ControlStyles
qdGx
Marshal
C`p\"N2V{kWw;#4!Q[>[vx`Y#
.cctor
VD<6 o2
r[T?
+.w7ln5G
b(>'$}0n
M 4[H
<)kx
iqDc
_ d'
W'cg
Sjgu >
Ltv\
TB>x
'11A V
m" {2
y/aoeEGs0z`IUtd&ZywtGap&
`Z,8
4nW8
hsi>x%
jD 8
w#\n
OIhH
}3dc
@P l
op_Explicit
RuntimeFieldHandle
uz&3
u0FR4
9DaW
8+64
.TJz
}IDAThC
PeX2
DeIiq{b]m"KC}D9#!D-q]_T1
'bN6W
W4LA
\(#;;
FsR8
Bc2_)
TsdyC!aC
bC?7<"
qy!/t;7Gw-'dORtS4tR*q$:q*
X(&r
6QxcoM,N58(kH52`-/_eW'>~%
kIwn
j+S(
_jk)
ZXJX*V
~KL)
ZXJX*J
AzUcs]
^;09H
]7xR
EndInvoke
JrGDBTA
f6$
!d)J_i
>& p
=r*+
d{fXP
D {87o]}
_5 \Kdi
]#VS
4t)45Q
U'xY
fD}E5
-Xj
HTLh/
0F$x
[VdTsM
pb"%
K`(8hU
jm/Q
2Jl
}""&)^jTBQAvYvZcI+U]jGXH"
{.8O
)2Q;nd'fr 7!IFna4DW#sw"G'
X,VF
\vI;
evvs8
27-\
Q[jz7
8D)v
) 7X
t5#M4u
IN^sUt4BzoqA3FDm&DGvf4UR(
8g3 <
set_Alignment
q}1S
xNOmI
AssemblyCompanyAttribute
t%&f
t; w
Y6z,m
"J!f
\xx<
_]t~
_#Rs
F=e_<a9&"T%NHN"rO:V)?:#~/
LmJ@O
ek2'
knA0a
<tBg{
3VI6+
' [J
Gg:8R
e|U$
%
(\ "
=Zqj
xdaL
D>>FR
AU=PL
u`v8
8 l4
System.Security
ha%=
Y|EP
(q+2
^9$U
{3 ]
3%o.
Enumerable
s5 W
YP.
PCtL
Dv )
U/?"
5uRRC
mMc\
L!&wZQ:@2y?IP>?6E-!vo(&*(
MkGO
mk]Z*Z\EWR@=0xp<9HkJ`?;d#
W#7<
AppDomain
8+Gc
3B.6
X +=yaQ
J5BX
iUUZmUf
nFSy
y n
+Z^f
* iH]
+DdVG5B?ze<&;C$Y7yLITST(&
Eo-Xlda
get_CurrentDomain
,V?G,~
W9rt
9N*S*
x9w-
qI0^O
[PjV
_]F\7#<
g4C)
:Urb
1UQg?
<4h}~
lVTq@<
k7*!_OB|W$/x@;LVTV_GM&,|)
R/i}l
ykM;h
3F.&
ak":j$Klp(g%D)jgV +v",6*0
K)o+g|u!bWJP[{dq,FJYAKkO!
37-o,
)Oo]
sR>a?v2|o$E=|(_c7%'/s`]""
4Pt7
iaeI
jMWC3
$Vs>
C.L
6W8T
2r(@~
o q}
)]$Q
=mIU
c!~k
r]`Y
AssemblyTrademarkAttribute
kxmu
;sm#
XH kp
>SW2
$0D3
PJ@~
\ :hy
F=C\
U;;m
n'fS
*+IS
p=ue
-V?
<fm%rJlfL#^O$k9kk@FsZ#/'-
h(41!G9d`0 `3,^IU[fIZF0[,
r!:^2
wF `
*KJ'
qHofXTp,I/7]|aK)*RI*@G~"
QCNK
r:.w
kM`:*
z.WQ
1H?_
+A'
iyc=)
C;rv
o/Py
Control
nO .
kbJ)
Ve$P
GetFunctionPointerForDelegate
wxI7
]NFD
Q{9
]p(|
y6x#reP=HDikG}BVX$W{%VsW"
Dy(2
x;U&rWM7_GNzZ!AC%<O0S9>2
NRYa
f852
Q#:b
.&:
-RtZ
#{:D
&fD;)
\( y
:V%pyY
WA_8
gr^,UW
!?IQ
BindingFlags
eEl%
%c|T
wv2-:97
F"q=
?r j
Type
P/e1
u :t5s
3`i'
.3{$
7>'O
E- )
' 6 C w
+dPK
;c}m
gPr<
;,L\
WniD
k+Kb
nn]G n
/ |*
KIH-
s?P"
wBL.
?i-3
~M{\_
EIz?g
!)0B
bH~}T.
%2@x=
}tQ\
N*GwCXY
L>Az
"J0!b
~UK2
{T y
NO:2&-)o}+5SQ51U-D!eFae2*
@d
qAN|
O%~S
&-G"
xUM@
G.T@
d9:\P
d~|H
$Q{O
Char
1qBl-i
HKk@
{b47&
D04Lw
+A{*l
FtY<
H0`w
MN/{,
~Zz
Yhuo
*aQt4
i|x}8]&z
3-?:j
*L%x!
!em P
)6@)Z
z=0S
pbW
GetValue
89~="Tf
_Kl?I
} mE
o 5'
<7KGTT
s n%|
\?{C`TFe(w'GF/)Dax0ao(K~(
2)@)
get_X
get_Y
lEFz
gBG"y
' m{
/vef
rm%N
:YI|
VirtualProtectEx
^pzN=
wN?%kQ
VJv_z
uxo
* %;
*.#6
6N> S 9
5r9;
v;!S
JJM6c
*.O3
Pk],
9${I
wCx
;_]1
_Ho`
9IgI
8ybkGm:BuWH%Ef$"$A@8s$~S*
hGybntj
*3nqb
A%u^9
VYa)
^\D$
m7Nx
MI6w]
G&v!
IW<`
s O+
Y9"o2
``0 ZPUh
bSNphDp
:v-8
H#WC
BT 8
z;n!D
zXy["K
f [gAZXiQ*_hk$Q1C6}_N=f@%
System.IO
<Es_(gkEKqv+sa\{sT':2Cb!
b$79D
:%<Q
KO }d
\]D_
$f<#
?CdsC&
R]BB
[e2d?
dO{q
2;c|
Te~u
PkRVN
'qi0
+9{3
.text
{79r;?
$:8Z
/2gUv
; Y
Y Zt
$40433d80-5652-469d-b32a-89bacd144f54
GetString
dEpB
RH8C#
S_ARc
7*SQ
Jf!n
.4zw
f2to
32%P
$ cV
(bV
8G~^
YXS=
O)ZN
Enabled
object
smk.
zS~`
AP[p
E4u,6
=u0s
nr#p#p#p#p#p#p#p#p#p#p#p#p#p#p#p#
$Y4]
b 2Fw
wHX
System.Reflection
mF4-
;4 R
_p?N%
C:;G
e[K'
+QEJ
"!x_d
Hfsu
`L>M
9b ~D
?VD%
_p(%
["w>
_?#5
Z,h(? OV~|/4TP&=Y=Q*RdZ4&
%`,<
?vP_]
v<9-
VUeuy
*dCg
)kI9
Ob.K
Gr3cEI
(Uad
!TwjB
t<^"
fzDF
} :w
sZ -
26CpR
7fiU
Jsyjp
SN@K
ZGMKcL
<e6Hu
hhQ{+
eY+n
7N&-
uPSd
iV2Hs
at,
]XCH{
odOVa
Ju2B
pj<}m
i]XO
\(^x
_M_ t
|f?(\',
`FQ*
f/K+0
w'90
DmSd=
4)Ob
[xQk
2z0
179Y=
o&k"
XPm0
g\V_
QGI|" __
~/i:+/
Rl3R
`m@1+
PC ~
$=Sr
fs]x
N#>;OOb
NGw}
|?8 voNk_O[v+YX^ OsZP'&r"
5oep
`.rsrc
ckj(
{=gb
X@!Z
||KHR
Y#B'sI
#BcY
-&E1"X'*BXqRJwMXIW_E%RKr&
[8DSp
*u"ve#$MYbUydedHhW>]eWj5!
%o-b0X
get_Default
'n?F
ERF2AJ
{V<DT
mG s Qiq
o7y_uy
fxruF6
kernel32.dll
result
@@Nx
rV}!P
Y{TQ
3"EC
$,]6:
>rYf
C^~_5}%
@yZt
>:=W
RU}]
<U>t
BF 2
wRgi
@9UVL
~R #
9oT9
3pb<
TY%.
w|KGd
{>o>
fRa
Q^< P!
m.$[
jy?1
qA"=
\ wE-%
Vt=d\\4
$)2|i3
}*PcR1YEei $6Z:0p1F_Y'JW"
{]BW
5 +
oWm<
IM.V
(di)
Fg<n
6Kin
+Sf+
sRXv{s|?{{L6ld?iv"I!c@ZE
>6=n
2Oo
I4:D
ISF8
PB D
A5JGQ
s1OZMvvc%zS"Ar_cH5xHuw|b!
~~_G7
'kj2
<j)w+K
tTv\O9 I
&Oi_Pm
\3dh&
e\0
W\
zf:i=.h
nseX
a3|"5K
CoGBn6wG+QkK0s|#>q"LGBYI
pg@Q
S:nJ
+%DX
kW>0w
wN I
["DF/r5
pg78
*'|!C
$O\L
vg.3y
}0Y;:
*G2E*zx
g@ 7
Hs)]\\
MouseEventArgs
vD}m
lyO6
I#1_V
H Eo
{KM
r](=
+?1VXpckCV0A?fu%}Zz#u))6%
^*0A
lU<7z
(.s?
d_FcL[ps!@{`9:!0WGuAqR7-!
EoZX
t)/'
:&Rn
EteV%
^y!'
Z2bAK~
eTDd
zu'2>l
@:v
LA'Xza>D|"yh#/il9DyBO-Oi&
!umLG^XD?s`a1kV]no){)U )"
h#& 9P
v8\8
O61/
|O[,o<.
fsF>$j6:dDI1>jbe Koq=WU{$
(
k_1
$G,v
v4lV_
kifH
7mi@
3C.}
J&rE
Py.G
Z4T
cnB__~@
aI87
b{!
x.wO
k(H?3
8,+r{
Iygk
vPcv
|W p[
&X7p
jt>1
n)SUE
-zb7,.
@JL+'
38V-
EOTO
=M.|
0w(
-d+<
r!"ed8q Dx5
?VFbl
S TWVw
XJX*V
J>#I
~@Y&
eyP%
u>AY6M_W
Write
!<#\%
&SQA
OnMouseMove
]_I"
~ g.a
rs0?i/
8mupD
dH#s
?(/$3#FjuL }%a6|6)Sl',Lh+
.A _
=ub4mr!"
,9d7I
get_Assembly
0!?B>
9IRo-0
"7+=
?u}X <s
}jx%@AsO=SBy?+:+0s8X%'9J$
hM]m
i(s p
YOE.
g =Dni
zco)
$ j2
y8i
4E3P
_;29
'w 0g
7r3f
3:ek
r.$o"
TJt#`G \
z]`So`9)Y-`O yj$|5}F0SLF%
{I<
>ntV
T Vph
2ZD`U
d70v
&T'`
~4/(
SD!M<`
'^mw,x]Bwc-&yo 5;RZ`F\=$#
%sN]
$zS/
;}y
4bIoh
/k^t
)qo-
Gt:
9yED2
k(gNz>
V+#1&OmJ%2]GPfo?),,W\c;U#
,8p!
TM"b5S`:NF#zfM1F9nZ)@Ohi
IhLP
WrapNonExceptionThrows
alrNNM
l9R{V
"?5#0m#?v
&jT$
!Qy>
r0gYN
d G<w
ur}j
Ui<?
Console
dfu=t
K9lo
Nk";QD
,Isiq
(C#|
B3vi<
lKXJ
K.\B
V[zWlO)h}O!'/408PF(*Ko`$"
o~,L
OQS*
qjb6^
+UI8
FEs}W^7MS/!P#$f9g!se=]Ck!
*Fi-
?$mX
IObjectHandle
r%!$
*l%zb
Pz8&
\1t`
*fx,
g@7s{
;1H
2-l3
x@_OSw3DSg^Qr50?k:ywg"!w"
fjr/
9B12
Kvw{<>
_JP#) 2" $
1'V-
?win
IHDR
$LZx
!iv(
r!7g
i{P"
7Pk!
/l8N
4lg
]f7u
WzA
MLd 3
3leH
8OC"f
qT`}
k27_
|_US
j* :
[,3}x
BJn5
&Ep
g<dJ
m {z
:O:R
Ce_h
i1 ;
]Zvbu
MtHk
P IHg@
j)| i
*uLO
9}M^S3j)D^@<+IeHn`rRntYu
EventArgs
5Z>,fS<4_|!W-\#&#@#hxf=B&
T_i6]k
UY }
){, +W
n: d
p*{b
fUrL
Y'4Uk
MaR&
afx ]
!n%J
K.N
?6}S:
;6eI
0@I^
f|s|
UWS
e6N
54 .)zL:j
hk>9yH
%20
HPwC
F5 g
7himm-
*xts
}Ut4
(.)
%37&
?+Ih
E> L
7L:B
v\Zr
FieldInfo
KUS0
>d35
;I:i
RINV5
MethodBase
#Strings
lDx 1~YP
%MC
D}u+mWY>AOqdY6sI>=,qpe>t"
wYl/
u_I_m
3%mh
pCV/
<llV[{@3%NQ:J'J\Zc*Wf'm*!
w"ChNWE]mb?gS9A%m[LNZ[xt
& dV
O/ca
,<Dq5
Fq0~
cjv
s;<~
BXe
R,6m
G^`KNfz
mK8y\?$J]~z#Vy?PH*I1u,?h*
uQVL
ejaj
7{C(S
|7('
SUX<<
~`G`n
?L*A8
.iXV
5S Ez
c}AMm
uAg9
l%Q,
9 w6
JX3(
Environment
d/#+
get_EnabledCalc
h;v5z</iGg8c'z35DDrw~M v&
4@ 6
}c8^
[w= ~
VirtualProtect
%F- z
~ 6cCJeSxFr(2(![EN,n* t7*
.FBi
em'=~
rX3!Y
u "@o
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
& \?
^W j
tM5_{{;(tU!j6T@ov]<DrD]@!
eWAS
O,2AYT~1U\l 439-!9+1dt0T"
Ks!,_< usw()TRQ3"!l;!f]z7
"ez|w
<V+o"O\D
Gfzic]
Fa q
k$_l
m -u
! !'!
get_EntryPoint
&k90
)?86D
@twE
UzHR
hol
mY]Y
A L1
yufyNw
%;#yb
uHdk
System
D r3
zYT:YSo_u
pR/m
q"0>
j*"!`
]v[9
.hw
3`o_
.o %
~Lwr}
?H9<p
J{7)85
w3m*
EeUa
?M.[
Ry5J
? 7
GetType
DeL!e
zb. 1~
k'9;%
kkg>
bb&)
XX8,-
k;%[
_v*s
add_AssemblyResolve
@mmWF
_kzu
/:z#
_YyO^w
IDAThC
2>)I
\B
<6T}
Spxk
sK<]
l*]
QZ>,;
il-p
- 0=b
RD?aSj~
doy[
set_OverIndex
j^G&/
r2lh
jX~BC~S8`0Q-dvIR2WNr'"tV"
g!1FC
%XNC01w+^H:dH%/\Q 3"R+0e/
4,Tk.
kv[ &[
3%A%M
yj3>
%n*OtU
Cmr0
3\^~M
(AE>
;'VJ
?]HI
oljh
v q
]\@;gE&
TabControl
cd]
@nf[X
shi/
eA.ka\
@qoy
Ng,o
5a<]
zi6M&
>C]iG
=<Y8
Uf D1U
K%/d`-SO4=OT0&0ueTbjjOcT&
&guz~
GW3@
=FV
>&>[
&A-"@5Gd#:Do$pCxCG:<3?^Q#
^&N#:>[
Color
~d r=
wpHGo:I
%?&(
Intern
2=@R5LQjfvg{_?_3TyYha4Z/!
x Ca
T<jC-~
ruZe
8WGY
Smd0
8umW
g9dP#A
U)~Lcg
set_BackColor
I+IK
Kh p
f>[de
AV/~B
get_UTF8
{#AA?
&ur..l
get_Width
e")7
3vx%5i
<h~`
bJ6M
KZZ@&
%4[}
^~(Hlnxb$aJ/eq|L\daV[swp
nPg=~k
bIA2 A
ZX {`
r$B
)Fq5D
> z5d
V3V}
(l9sBd
get_Revision
U0_+
X6O,
L,k`
{ 0`
p? &X
/~DF5"
rp~+Kx
"gzkO
kOk:
?2L(
A|~]
Z\kp
7p|s%
_gVRYMDI9'l%jSrs*wGNdRZ-%
S~QL
t19qx
d^53
Mt`-
D:aGI
~`(p
^Z\9
8am
H6Jy0-\
SjmhH
vg-Q
cJjk\2L!2r;@ \v4PD@~rcE_&
6:zg
U+yZ<9
ZV0;
D@#-
Q _^
a*$y
2uIe
d\S\36
jlb<
.P5J|
1PS&
^l^b3_
fa ;;
u4wuM
LRU.
DFF@'<[Q
',O
~W d
QhL
UPd|r&<
Qi-B
%(4
u7iI1
K 7t
Q}$Ei
p7}8
8>nd'
T9-DI
iz]CyGD;8
[ki<
c\e5:
oj7`G
ts*</
(r.V=
s.yg
0f[W
System.Core
Kpsx
8v^H:5EiLZ0u KH!"?{,XQS&)
^ }6a#%a6KU
$gvA
*zUK2Q
YnH3
2JD?
wzt{
XEt7Y
=5@P
a!O:*
cXtz
xztKpO
o84oi6W
.'CY
XV #o0
~6nM
k%c~
|usM
'~(~)
9|)^
\hAq
T$][
|s&~
XZ9O
eqTE
{U%
TTYsbE
2r@h
u2C{
}r`s
wHy
>$`R
84j;<
dS;Wk@^=n~4gU/mcP 5QTB]4#
X +4(+
l`R>
6f #r
PoBZ
$a!cr{E+
C=|r
%'AI
>944
QBxS{
S by
L^Qt~Rb]*S]A0YfSEb=b|{-H!
CoU|
d*;0
}ZGV
d~4N j
ModuleHandle
.-dL
^z5/l
InitializeArray
;!t)
}GK1
rE?;[
gB~3
J[#h
uL3%
<,eh
bG8x
D6$t
{IDAThC
z*Mm?
X:~
u&p([
N?P gP=A
AB.
J }z
@:>m&
t3GAeU
Rd{)
>;m1
hwPs
/3U
v.i*
6 p5
E]C
E'&J
311b9004-15d5-31.Resources.resources
&q~%^
l1$AoC#Ut:r~<pOP"!SjPUmJ"
q z4#
set_DoubleBuffered
/!Gw
,bgd
get_Length
{KJ$
J({4
S-8m
E_9x
YFE
Ht{0
g7Nv
=Ic"
uR{~
System.Collections
d#*c
hI%tx
If7p
,Kh~
ZtA1
lhc}`
'3o
1`?@,
H7"`
lk?P
ZXM(!
R{ J
cf m~K
1Zz
Contains
1$U<
0K[_
5\Z"Z
:u%,X
67D@OC
S:Dq
eRFC
Ox!H
5AS0
!CLT\d3)
B'pg
E m
)lAiPg
[MJlw'
v)o
aL:P
6s4y
ValueType
,iGi
I3yi
GuidAttribute
PH*
1s2 A
o"I>
we_'u1)1&EV"d&0$p_{\=@6L#
jY9\
w#zv
?& 4
R7 %
-kT`X
x-@C
ya)B
W)YV
?n'Y
qrJt
7S5"FR
n*A(
#N~C`E
^#42[
:"QWGXi=$&,3lblc")KIwst0"
3%O#
l\*z
get_Count
fE'Ex,!Xk4:c~8JqLE{Q#J1R'
<Z`'
.jbo`
H(wS
M v9
lZ1~
&GgF
xeBwg`
N qe
" uQ
=v[Q%y
_t_^
\-ucShn
i]G'
1y{5
k9W9
($#e
I}BS
GetField
06%,
&tbX
<6rn )
^G;m
jjWU
z8KB%c-
61WZg
hFISe]`w
A0;7
nXA9
Q 3
HgKx]wB
aXQbY
i{&s
#;kOm
s2Wg
<CI
Y(v=
&hVi
CjQ
MZ;
v=-}
S6.+?
+T|`
;/o_k
K 4
)$\*
A;G<
q\c U
u&/r
UInt32
=n+wWoHu{r{Ixm]<([$*q6Q0%
l7IcC
4Q/M
ssSzq
`R B\
;7?&y
pKy'%S
get_Version
sO=yD
ICustomAttributeProvider
-y-nT
ToString
9cV0DFUcllnos]{Q8:uyM=hi
Ck$Y
dMsOf
be|}|
9Xwn
hpJ"
\ +R
dL,C
O4m|
3Z m
#7I=/
624d
-]{I
=3Q|
dSd?
xL{r
U["+3
X
bvZjPL8A|rg8"Ir%I3Ql uMX'
N) D
6x`}
}/m)
2lGXo
Jddtr
MYTpvD
t)4N
s;i/N
VM_]
pr G
ServiceBase
p7m]Ru5>DSp]@JPl OXcLa7a%
)4h=~,h
pD?Y
'lu(
trJ#^z
&@KG, T
^ d2
jhIF
(Gat
k$">lQ
w (J
~|]
(]rp
g} ~
GetTabRect
m?9]
|94V
D1~Dt
ZMx9
7<4@Rs
+)y5
.F~9
a"t=u
{/X;
>!;
NR*p&<#gWGt72_#}s[$j^?~J"
eq!:QIl<v9}Fp:=+{ETZVA$M!
+n6w
;m<x
Dmji
>C'f
:+R[
AssemblyTitleAttribute
b-!M,
kzQt
/X'DN-
G9Hve
pDZa
JqF=
^Rx@
\G 1i
8Joe
jte+
N1Y5
y!Wy
`<M1vg
^6\^
)kR[
5&+k
q`Ov
OCFQ
:-\
G/yg]
AiKn
V[bQM
|MX*
LyCm
)b[K
tChf
k.Vk
OwH{
0 k&
t,5h
`&} sBNW*zs;>jkO:ddG'jY=&
dWH`
q GL
xDps/+
XP`1
N2g$
j=))N
ydT=
q2K\Zw
uyUe
u<<n
E B7
G%A3
xT^b
hP A
o-v3
{} _
Jh{n
K zA_
};pEK
K/&:L(7hnN!R]n?R&3G4|A%U$
$-Hd; m
CF.c
Z=*@
=fh$
=~/
K|Q@z
Zz N
@x:J.
Data
NS|#H
$"I@>
~~KP
o})m
Lk g
+p
![(FR
4f/M)
Zjtm
n[@L
NfeK
D`di
:W&
i&kh1;zt^p%ns8u/|_+myuRB%
7*=e
tD9t
y3>n}C
!O8'
=Pop&
:{{*l
'08mg
H"^q
oV Lr
6Y&`
&|#d
%L)@a
||g_
A&4}
:#qjj[
{Gi!)
Z fJ
pHYs
.ctor
DUhS(f
6pS.U
;2bXRaR^-1h2V__3-41M!(",
Y/]a
'@RT
?&dBB
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPADP
get_SelectedIndex
82Hge
xpP53
get_Message
Container
-"hW
p;oI
O2j
g9[G
D\Lb
Vu0vz
Qe#I
Y72A
I+)S($Bk\_!5M5g/t;Yn'D}5
1#F\
Main
eb-@
,;C!
fnRw
N4,BO6\`
}_ =
Invoke
IquT
? &s
Pct0
#;9B
oUkt
q5gV
k"<U
ZXJX*
ibKt
5`d,m9
tsu5 QF@@d$ew-1ov)['qo9-!
!E13!k`K!7FQ&:UkaB*:QEl)$
U$D;=<}
G/j3{
y&,R^
M5zc[o
;u3=
0)vV
ekH]%k5
znx&
L,RV
zA}]
yp82H
"N `
d6ik
4 CF
n.SU*
P"_A6
0}vI
CExi_z5n_{FG4S|n|D=*T;aZ#
_if*(
_ZrPC\cu1W5k&;s- +bHse4%!
Y$y~
n/*m
id1Q
YWu"3@
1Q H
Module
Bzlc
7G9+
AwCa
:{!'
Array
v#
= < < < < < < < < < < < < < < <
X<7o
=G0 7
E"a]
{ )pq
C_in
j!:
emg0
" V;
@.reloc
w ^d
f"xI
r =K
Z `"
2!NFEK]LZ{2lFm)Y,+ksb4cA+
A5e-2GF
+{ F
j*lQ
,{P#A
-!UX
k%QA
\s%G
TabSizeMode
Byte
_<:t
"3%v
GkVj
_L~rn3vLOpe`:&a09VF|62$N!
:wO7
j1x*|
`3,y
3 +m"'w
<e s)
="q"
[F7\
m/:
nsr/8
mI^}_3wq7^!8y[Gx{2 X/B2Q'
[t)u
p00`
#5~PZ
HgAf
a]Cop
#%7%
P|Yj
h_&g
=z m`
Rval~!
Z1H5ha
~!="
ZQ z
FQ|>
sS,4
FZ:Tz,AL"jU#[>5lB^`}OGVN!
2Dj:
IHhX
6)kiM
yeB
(|I{~6
fR}~M
UT 9g
h^/e
Wce$_
P2vn
{%w[
5z9S
;L,U
rVS3[
'lAEV
ZH<%
P2/z
k |
.Nha
qrm%
3P?j <y
K<A],iO]jb!8?X{JYXn&tmzy!
sP;k
1:FwwH H
Rrgk
F:+e
M C]
4- WMqs
x.8$
nCU-p
[x5vsP
0We%
(5pi
;7KPHa#6f_q2sG_ iAP3w{8e
get_Location
Tna>XV
X jl
\GBc]
TK^Z
LVlO
?!j`
u|ug
%/O,DFF
0*O\
ZaweGoVd,KGI+/"b%w4)9y/q"
Jk4D
G&!n
p#5I
gDs2^4
wo;((F{8%bpZFIeE%+3yYfE@%
M/mB
]1]q
FreeHGlobal
b ]
.{k#
I ah
`hO`
mkxR
K'S%H9w"'d->nvViq+S6N9Iy"
sBG%
s/&e
+gFw
8FG(7W[n:ikONLCu57iQMuE_'
BTf}
~``p
^d4#
%4u^_k
igcp;j9 FNI0a6`RBu#qfgu,
k@pd
.cLoa
NM&y~
)7*(+<
>dv>
C-\k
"o;o
T*UQ]+
.-E?y/_V
D'k7
RuntimeCompatibilityAttribute
:st?
eFia
-a[+
D(Ox
9WW5
pDydw?1[x?pT/Xzo<kReKn#&%
+R(+
DZo.pz
\SNv
Assembly
@a+` &'`Hj)#8jupmi;{rJ;8&
%T82X
iJ4]*_4'2\v\:&eUTbrZpG~D
%O M
*G|+
.[-Y
t&8*
k;\S,2{
' u(
d\;5
(|#gs
PLW
Y.gN4
^gAh
TB)
JC40v=!
(;|!
>xMU
Bq}sI
@{rYm+*#6's$pcwiGfH?qX--
8dS!
G"wuM
MJ !
j#A
0WAv_
ZZ2(
14RR
N]mT
'[Yq
Gja[
%DTV3
I|]2
m%s!P
x`^,h`
get_Chars
iS]8R
mXd<
w4R-
'|YL
:m#,
\3`3v
9~.o
d(W1
hVh9
E} 6
v0}:
d{8n.
Invalidate
n\4
GEw4
Etut
0:'%
Zt#H
i5&
h/9Hc
/V+t &
Aq+/}9U$T{GU!>03PvQKA"G^
RjvH>k
tr<h)
vRH=
I/]q
1f*ZvHO@iGo DG|J^vQ5q$[d#
_)mU/b2;
Size
U `Vs
: #+
aOG
` {)
wCK'
NewGuid
~uH<
5^=j9
6# $
3')-
Z!HY
+uU_Z
set_AutoScaleMode
] ^ZAFq);k~NK8A4fIJV~nwp"
D,8pG|$! I96?dbha?eYX'G<"
XSyk
CYU;:
VNQZQ
(J/P
S+8k
qm<L7&!xcANhJtS=DFg5fC3N#
Hppb
(oB_WW7+/mpfO}#Jz3C!m`nq
:^~x~mc
sW` eC"*1
ebh
o|I{
,~:Q
4"w
i,t|
6 kQ
SVf{v
g6q\
l04;&:
~@^9L
X/~V
2RcG'|Y:E p:v>P5EYGKE3fA"
'++
WZE>dd
q)[
xr/[
.XF
M{&-
QD;2
I^Zx
X Be
uwl?
IContainer
k w8
v$u9j
]TT^
\ap9Uv
%7U\
AMqZC.M
8LLw
E@Gl
Tb'DK
Y]gs
YQlbS
,pC4mwYRqtR#fx8Hg{IC)]/1"
xO)>g
7u8B
~l3&
d p#
}[+.Qym
LPmr
y"hfcp(
8>cL
FSU \g0
[wH2bI
zlG\(
f$Ko~06
x{65
Kw1%
> b9$
K/oq
+P:c
b?}jc
Z:`p
nr,2^)
N uQ
Kmom
0v,q
7%dj.e
[j`k
^VHJfW$r
de+sK5aA?=rKC7L_:TclKB2,(
W$6?
Ol{v
b@|u
W>T1
##E\
s#)p
c,Q7a
\jZrFq
u]F,
,j_J
bUZlX
0PIk
8shX
1vor
2iB4f
`Zmn
TM cw7
#Blob
HdDh
La>*
$W(@ 0
Q(>o#
$#_@
?0Nip
get_OverIndex
fq}#2_):Ip%6gAOM($ELa(M]!
} r[
~}9"
EVjohxu*hHMdL3by^!FrNWee
9D}j$
@2;*
)!(v!R
k H+wf
B C][
*=f"LYeio5
K!oh
s#)9
M+ZY
V?"P
]$RI
4X86
3Bl\
Ew/~t
[OCg
x:#I
{[.G
A%=7?
40}7c4)0~C((OMpgK<L;!gES&
:SZu
1\aBO
z"GT
a|Z}GG
;G@_
+~V<B
Zam%
8a?j
IY N
/]bt
Of@GEgJBw^x-L,B))YVN+[]Y'
ContainerControl
|o}'#T
FEd`]
y3N$4
y!GZ
y:YQb]
yPcCB
ji6r
fa H
:lz-
=5
N#uQ
^\@q1
K'WM
\|Yub|fDHe`E8Jd'~5"@_nM
D7x8
"cw'fCH
zhK=$YdCvkEsP<NWj~A{%~l#!
1$'/
q[.QA
Wp)%
@-j2
ReadByte
3-\1
MbJ]I
(uLq)
^ :"
K_kH
<_Pw
VJ~2
#'S|%&S
3F1764884A245F1B3FA91DEC2E25339F23787561
#98U
WUZB<
>[}7
Eqa^~vy
hINpd
CL @
&Z5N)
D>x87
$V =Z
dQV<
NN@*
d65l3
KwwwwH
t[=e6
9:WEch
4IDE@5
AllocHGlobal
XO>$r
I-h1
+19"\G
!gI;
^mVA|
hY@z
AssemblyCopyrightAttribute
/D_|
=k`m
<H jme
9Vsq
zNV\
*Cl Mv
.Jx>;
? 7
#uMCb
ql?Z2t
B$Ap
T{""
`$6.
)/9N
|LJ$
!| |
K@@-Ft
|'m`MY|WN`1:_yyV<Dyw!vZC"
/~T+
w<{Y
]N|/
QfU*
-Vg+
9S^r
=% <
n1ls0
&H\J
<`>X
>$%
{oOZw
%f ymB^{,JVRw$@=][V5Y^W|"
zEFs
C;nJ
[&C%JDPc4#<5^@;*&|xP"&C((
{!lL
}#.9B
Yv^j>
*}:/
n"5tO
7=q&, ! VnuBDAS{S"bBLcv[#
",+,
7tu(
f"Y+b
\Sna>-
)145
4f{*}
AY\:
OB t$
5VV)
2 jy
$a;C
#t"L
2Z&4m/
+]];
=o <6r
o_kH
_b<[
<Module>
:Ph-K
ct:"
0L{S|
'B'j
FI*I
vc2{
6-R~Lms
mWb\
L]b>W
<E0]
&.2WC$
=|0
Du!Q#/8U!J*\(T:yme@/xcGF%
WT:aHUsbF]X]!w\[a,KjrD{z!
4o(nx5gmdB5;V[-6ujMVq3#l$
HJS\2ZG&_~Z=:XW0dVpw@4)q"
"<J*K
,(Gg
ControlEventArgs
}8HHp
e2[#
qH_4[
nBc0
_W{U!
>;
PNY `G!
N $z
1oB(_
C%#%
TT=k#J&m
2E56
#D?5
set_Enabled
MC+C(
,RdtCI443IXw+5Q=Ef]o:%Hm
VY{wm>
lzHM
bR*xk
L+>^
$}v
Y`*$`VYO`<`jQ)0O3{))Y:$M#
W?[yP
Read
j%\zN
g I
@M '
| 5BE
o[lS
eQ@.
f ]U
!ir3
Sy@?u]
y66=K^{xK*yVJe% Cs_E$]g4$
+"sp
U}Rn~%
& JbE
1[(ox
"&17
v$l|
i-oG
w:m"
~5J7
Gb7u
!}{/
sA3<
1.rj
get_Value
gzl/
kaV[/|Lo{S<<Tn)-/PJ[tqXi
.Iz+u"
baug_
gVaNE+
25#aj
>*EB
P]Ve
Zc;k
R&t3$
m(*,
ZI^E
FKP FrVg
$L^ZdbQ}e(3(L2c}g)"WmPsl"
PA q
P&M(Xe'Upy'Dzbg$,FTJ*u~j'
YpViYXhS4y=*6M^ly3'A{}"7#
cq=|
["<WkLiKkKQmGMl8XCKtT~S !
P(>O
GFL'F
_])Hp
,5kY't
get_Enabled
zt\]v
T>]f
.71
LHG{
zn3%
t[gk
[%dW
=[fGhc7>zjd-@SlT~(MO+bs'"
v.t5
s!'B
" $
c{ @
v'L-n
4~V&_(PL9b1J[6Y^#_[_1wIF%
y qi2Xn7!zo/r#,lD*t%Y`*c
0rb
AutoScaleMode
{UU
nuH8>6
tLmf+
MarshalByRefObject
O:oC
)Dp'
4 ?
B04'
&EPx
fu1L
'/CF
AsyncCallback
OBm
N(ie
mscorlib
?eCV
59Xt
&1oIqs
A/W an@
PhN.
?`',L4)
ca0
.ARt
6Kv-hg
/RM2
x f
9e=gs
9FMN
4E @A
8yM'
4e~a
pV3y
djZ|
v|&J]
EJ_D"
get_TabPages
T90J
s;$+
A8*?
|zi
Z{B>
9Srz
]|8r<
<H|zT
,H?[$<
z0aO
Guid
PAmst
|eZmx
YFVTT
ZLJ|6a@
pRrP
l0 ~
;1>u
e!_~

Mf K$
Pul>
P:Wg2~<v
H*XhT
0YW:5E*nA</_xryKO:2oQ7}>%
*L)P
=E
{7]y0
pr:U
Z Jh
:jE>D
%]2
oHnP
)a8GC
xVc$EI^
%DAh
A~l{
&Jht
3 Rg
> r.Y
|O=U
MC*Vz4+b1ljY#cA)WkLl1Gdm%
RuntimeTypeHandle
'j\w!
VKG,
: *a2
/]_K
Wh8,0JB
bcd@
"P$Yb
z`P
kNfm
nPFJw
6?;w
'nd@T
(T*@
<eK`P
vg^&
`/ 4
8- 0-
~CQ01Q
Y:15
f<t@
c ri
Cursor
efSP6/
Wgf
sender
dV.lg
+{z
U3SI
[8ZN
]a)ke\
B>\v
x+C(
^ssi
@5*c&F
xB [PC'[dmQyvBm:sR8mjo'u$
5As@K
(*cQ
Append
<;O7
PCl[
f9"B[PeW
7,R)<}
K`8s
ksk|c
/s#%x%M733:/AdBq6G,)MOU="
Ti r
\!GGc
;R+
System.ServiceProcess
op_Equality
A#[O3
5,:?
NVN~
,4k#
a372E"F
6{`X
;,\z
K(DQ
nh5z %
wW3H
N "2pMx
Ih9b
bQ Ve 8^*
xR! Y
8*3l[
^@1K
Idr:
GH)>f
C]<8]
b.Xp
+p+Z
sg5Cx
p0aX
z L0
qBDog
lJYC6
`gV
AssemblyDescriptionAttribute
_N\3 I
m[={
>|80c&|
`YqF
KgBy
<g"Z
FI+
Rf%wH
Z{Tj`o/pZ7V
o+M#
EbK.I
0i%N,]+-'
vYq\(}7/&M&K%dhP5!}+~6=k+
FK -
da61&
`j[,
H8)LXM3{TjL!; pS2eq}_P7:!
c.uB CPk
,9)xN
F<,Y
%:!ZgC
%6#o
:@;c
uK7S
'o 3
]@ 7U
U"6+
"Mm-oI|n>Of89WSGECcuL9b"#
X~!J3:/z#@+hz'IIoGsm71t=%
d |a
Xs'wxL
zg;$
V< `
V<.S
g6:Y
>^lO
C G(
?L'"q
! i (`
kcn@9q9
C2E
eULnI
Qg8^
kN>j
ws q
Ven
< :I
,+s*E
]t,O"
>!`>
>#M$
1Yh]S
Nf`x
txGR
Qp2KBbV5/2W3h23Y!@15J^S/&
y wX~
S[s
XpGlEvjS=KUdQ8*W"fvcLJ6w
4_sJU
F9.a
'|` ="
D3)y
)+HK "
[[f(
!jW&
*&3=
Z 8V
p,V/
D`g#
F{TF
S1tC
PNS-
LKRM
@~h'
NONM
/FYu
\Om@U
$nDg
4!3(
fm-o
82zR$C^>V$4Cn9J`h XRp\8C"
*h>\7
bg,o
mscoree.dll
!This program cannot be run in DOS mode. $
flE7
F4B;
bc<-
callback
Q9}F=$
zO|VpC4j<:vGVB0$-)w(ZD2F&
<R. EN
,(:hl0
a:#E
RTmLCq
gspoK
N<g}!0v|+O 'i_8((eA+Y|D2$
M& o
+ W:A
y2m>
j&F'
Dispose
XGG4
Z?78
kG@!
um|o
}]<.j
6S9b
p=~6
9:y(;
K?#wux
yQ%Z='
+wR u
!(./
]D815
4E2BE99140D24066CADC84F74FA899FEE5976B68
Z9"_p
no8-
!o c
eNK{NN
Xu':+
{^8iSNSB/4?^{]1E!YhAT'SJ'
\Dz.
D~Z
}A'H(
8$ kN
#33i^Q+
_6FBk
htCa<
6Z :
/b^4
P}?eH
?){f
FIua
[90M
iin_
q+)Y
&}i_
c-u5
nAyC
M z
c ^ft
`QEd
&FN_1EyK,q
Lc.\
k53}X4
lvT/
zIDAThC
X(Th#B}#_Wf[+sFyG<*tqE#E"
NzOI
;F`Ie
n~#
Dnuj
L rsl
"+eq_
G3 S
%oJg
dD,G
]8
8-?9z
|shrNpH]*qa_X }Ls\+rv,zg!
)zV3'
v1|yn
Be|(IKP1}psJ0X7n&+{Kdhi`!
Z+O3n
wmHR%V
BSJB
8SU2
9.OoS
05(M
w!p4_
VhT.+
Li^G!
e#rb
sV?RrHc\Hd4-o-2i'B+Ep/!*"
/:$i
1ofB
R9)[pN:9nm~n=3<z'jW(D`O~&
v}X c
)X{5u
$b5e'
w'jL
9m9z
hAsO
get_ModuleHandle
1Q}o
89{U
vw:A
kfNC
K'C{
6%l@rph2*`7=5{&HGJxy] @F$
-RZ=
@T?y_lmY^DA;EgaEpX4*-~]T!
&,/@K
:SQy=Kd)0t?RBw!C+6knb6]')
6'g~Y
G.(6
IUv:L<V
> -a_
rb+D
IntPtr
o\6)
/Tzt
wB@(0#O
c<9s
fTz:_
{Ogy
OQ6e
GTG$
\ /,pSGB
&ycr
QY<,>5
<Hb l,
I,,j
l3W$
bG5l8
Sl{3
/@)E0]_Z#zDMh]w6FQ>WFJu!$
:54T
}y T&
,3.$
B:U5E
JQ/`:/_z%2W[0q{iEMW)q &-%
@w}E:H[?J"!g@W`5h}>u(6$"#
"Ce\
NI4? @?
> \:
kt0D
EJa@
An0n
lkdL3
<8;7S)LlYF|:HY: "sf\g\&u#
1}Se8
l]hw
Q.46
G|E"
'i<&
]'N~
t;Q@#
x]bV
7w4^
System.Linq
MLAo
2-MFn)L`ffR3AQ-'^r<i/J!l&
MFEY
_w+#[^5+vm 829epb#%j;eeR!
C708234F139063BBE3CBE2208BB6ACFACBC50333
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
, 6f
_,E1
InvalidOperationException
;QkY
0@&
ak$8
!0`h.>y
K"(Hj$c
W?dP
NV%(
.4o|
M[Le
d6>_%
wxouM<"K9Go-TPFsvypU{ff7
zI!Yg
vsU:d5Ms+50<f'5];I'1^BA<,
r8(HL[x;
y1ZwuzN
keFMA
I34>
=?~:8
S#@Eh
vdh&>
gZVq
?pd+
:& DZ2y
cA-S
\yun
?n |
H3/AH
{0U4
nJjI
fdyj
f}6~D
P;ZO
\=5U
BlockCopy
[bYy+?x
k|W8mB
h6lR
M!h|
F jd%
e_\[9
^br#
get_FullyQualifiedName
\>nY
A|DpD
fIK)
qaeI
)~!CYP@a`nky31Zi$ZD-IeG1!
h17Mbe V
GaSw
6Vl5
w:OV
2yJ7
bwQn9$\V&iQQ0^J#$V7\6pha
Z &6
)Sw4gAf<^prcQ< nKY?HC0HW
) =(Y
MCBh d<
uL1*
^[UO
I4#O
7gYc
Ir4P
T^m5ic
pSInYH
[40HD
\PHH
T/:nL[MLu`UkuS$K_QL/s{ !!
[}+
QFbw
XbFM
BKE$
HEdQ
0?tUl
&\0y.1`
U%+r^
5BE?
.S8Rj
~C=I
5)7:
E+b
?5RI
ipx[
m4}&
O+tr\+
<=?GcC,!3h'$zv|R>?2h/BC2*
v F
"yo
TN?s\|_&pe
oqpV
@%\4l<q[&CqMHPV3F=UX1]K!'
s\u7nI
]~)jp
[=]l
Z"JF97<:Ly=^rq7>2}D)b/z
\(5 N
A}<jG
V->q
bv*e
WI}9"
tG!g
66 .
OnMouseLeave
X^7D
PkTr
D%+$F82x\Z5:Kqv34K;*?god+
e/ ~
(o/xjl
4t X
AD>
zq^zD[
W*.eIM
3"e
f:%zm
5BiY<
3oi4
%8:m
=0iZ!
GL(b
ix/eTI>
MethodInfo
[D_x
6lU#
tHLJ
f | (
~t;R
.;&'
11'1@+{&nNl$`|2EO5+\"H/[$
CompilationRelaxationsAttribute
NBda
t\e\
TabPageCollection
+1t-
o?t}
ITPua
HCG9
J6 n0
O4b3M(6a[M6'Ys/4\[<<V8CH6
agd+
MemoryStream
Rh$Z
50^ ]
8A`OP 7yGj9c1eR+>ea_wZ x(
f_FJ
1;|; S
ResolveEventArgs
L]sKB
M-.#e
RO<|$s
sNa3
EvKx
l _@
&Yc<
~Ny
/M*h
k.N.
L Xr!
DM%[
OnControlAdded
f?KhF-;Vp036u3i/PT&m(x4[,
d\0U
^Y*%r:
!k;-
S1P)o
e~Wd
T*P
]!/CU
, h1d
;0c'
%R;$
[XQ'H=E
;Mvg
U\wT
]by{
kZx1
@_p
w{1#+q
k *[
?v@_d
Z(1
q))I
^J~4
r0D}
cD,\1
2 K
O}rKo@
[^,#q0
]5pxp
; /q,g
,BL,
[ M?;
3/iJ
'u]q#XK
w""BB
V[kW
tr=(
4+7;
C&pJ
fC({06
T_>:
IEND
*i>t
K}]2|
-=?oR
^jO\
;k/g]-]+<($0"n1yU3)lm\#<%
Q.W
,Tm]
W_.k
`iK%
a3*Y
:Ur~@
/4_ O
5>SGK"@##D\5c|TW=Ic$_Z`H"
!)6%
IcW
4{oI
]^s|T
QU=
f<3m
Qwd^u'#u<#tsr7*!T=fC,{Jz#
Cq7gO
Co^%
>%!V
41oP
iNwLwn
{6]WW8)amK4G:-n7^0D z>>{!
7^i
{e;|
$B y
u(s6
YUcQX
wu.Sk
6'wV
=sn^
\"E
2g,g
Delegate
Uq"
No[:
J#!E
M\ZA
LiFp
cKuz
PzjBW(1MP"?VM&c'~5l"AK@C
&Fr,Q d
v p8
h<6'
e(S{
EQ>x
Mutation
OT1P
Grpl8I&<wCoxANg) $0C!89"&
>hk=d
o?g4
get_White
.p!
PAx~Q
H\>XP
bjJ%
retn
e:`w
M/9 6
Z$<q
<w#q^
Nh?X
han] @R*(=uwO%uu0$wn)d`O#
cj7G
R'<7
#0jZ
Concat
R<D`
:@oj
=DYE
=f6S'
G:gcXM%[v#qZ8$58O}Oo"uK1'
StringBuilder
jf-n1
*F)
jmRH
uG70zG'
?P?#
)D4g
@)`v
(YQh176U5?wdA3Fm;}IJcPog$
t4(c
H?DUO
-gUUB
J9W>W
okyT#W5
n2+y
&Gp)
ZfAsR
&$Y$~
-yG%VC
P.KP
+sH"
JMT/X*EJ(Wa@LOI8&Kc}$fQk#
7C!oq'_`pBZ%*R00v7u4G>Xh
KBo
V)Q\
R@M?
sa 6i9
^]717
QoO~|BK"(!hF-\KiFt\F;KVw&
|$ K;!j
Y4rT
#rT_
(JYb|u
Zy K
wca^
get_Hand
skypw
4k=
]JyB
,"|
@[>F
quFK
^^5;
#C4Sr2T5e
V ] W
CoLB3
*|T7
lx,
-]O
q%P Ii
bW0w
STUX
;:+5
,9io
X"vo
k)CN
pss?
<w882
\bE
mt T
+XAP
ddwt
@|L=&5]ees!-*Hh{7\ Ia*HD%
G;{C'|
AssemblyFileVersionAttribute
NmUB
_Qkn
System.Text
'Z20i
8)idBo
ldI&
pmF#ZJ
$){"9 3{)mh My4b&{deYF/2#
Uz B
r!qgZ
Vay;l"F7t69;z<}//1~'$<'1<
_f<z&,
ggS
CGCb/
<`LnW"
Q x^7<WI{+p"=f8R>;-*1p/y%
SUuq
-8/U
|Ehp.
koDR
k4.}
"Q#q
F;+ph
u=M+
OpQrJ
<B<n
+#^_
!y-S
IRlV
$75S
@a!G^1 _9QbI82>^H?zK/4"|&
gS?C{)C}7T2ngI-9]qd4,?0\/
"/w
-Kf@
Y;1iV
ZzOJY
0D>K
GetElementType
G=Xo
K$+$
S}Tnu
'H ?
t H9G
?T>S
+k4^
h@N?^= mFx"3vi\&1`{|R)=,*
(+
W'/
w >
ag u
#'r)
}S=@z
~p,E$N">V[uFWYJYYx/#dauv
XT.v
bVf:
O/Np
V%d1,
P"wzf
Dd?"
XMt8
'D%#p
n-'J
*j a
nCPC
<XOY
CXhs{
$ojf
HF~W
9e%ac
+ZB6
Ar?JhD
\b{J
U]?G&
_>uu*
~_Q,M
ai)k")
f?(!59
<o@ bwuo
%||la
e9IjX
z rSt
>#;
{iv%
~VTTa_w
X4_s 4a
C.q1px
VhEi
1sv--)f_+bXJe-xJ;y7$(mx9$
?Gx6AJ/Z,=k$,wj[];0BG4'X(
hk t
0+Zqt
6Yij
q_'k
,JvC1&X]a;|I/uw631V-o#C+%
g(MgU
n]ho
d6D
tecAs
$0{rk
jBR rN/.
`5^Y
owpokdomC$:kWMl!=@j3n)8%!
3DU;
6^3UO
Font
rf&Z
(7jl
J7(9
#;nx
0=]
0
7b;B
jh(w
bNI
X8uHg
*F\@
%s1BC_
z %I
-pgeu
|<R1LF@{
t_xV-
tZ-#KmZb@yfuU28kz^wiAl}("
String
o!M\6
ICollection
_CorExeMain
JGX{&:U0j:xT-l;3p#_:Q,`9#
qN]nx
r/q%
N\-X
) WX`
RIOU9
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
<U 2O
esGhV5
@--@
"BFx*
I^ 6
^ 1*&
VE\944
9 KY
8@(x
~|F#$a
NZ/%C
&6VYO
U^"S
k#L4
jctJc
J5[rx
lcq,rH
C8ij_*~0]E<;<7nt@7W,(p>q#
{,;O
{?T
8*VF>ArQk2<jNvk6GO_=vMmd"
R0>vm3HVnV"N$}J *yvc37YGJ
+ 6X
[ 82]
5iZM '[r
{v#4-
Rj%{
>yK/
hF{}>k#2vCe
&aY> ~ }
bjR%
Km zf
?/ A
KeyI0
yy=_
)2[.
a)A
b<g@
bAF]
ToArray
) tu
"84
qB5([
CreateInstance
!zic
OnCreateControl
Hwgp
n>._
K-G5
Ro.9
4^o*
FuHj
XJWg7/&Dm_[H5p+^:4]esZRG%
zw/H
S`R:*=])z`3X)f?c6o@(Fh1r&
m[Rt
iWeA
Q'|c
F~7Z
Yr[z~Fdct:Y`bC:?r,`g W:\!
j+;e
@E@F
K$~9
fl-P
l\/1{
hcdl
get_Hovering
?dwJ
bOGL!Q-61JH:ASN3@W~E">ZJ!
6:FP+
%h c|
#M'N
+ b ;R
i]P5z
yr2#
SE4Dx]3xIP -m^&'5o!wlh E&
1T2d
0[JH
f*uK
`AD1Z
&lz0
!!# P
LdAR-3XO+st2|Z (BaQxoz?;"
K+5b
\l8H lp
|\9[
o}!-
Load
/m]
:yXw
2(mp<
2PQjg-
T' #)3
;4Hz
9*^ m[jz
3L_(-
System.Drawing
)uE<
%k h
dYS_
eR2w
get_FullName
58 ^}NVW-
E)GN
zCy~
(6Wv
%X&J
'" W8
P&Hj/9ehW/ 9y1P8:O3W1=k}3
]I= NI4
RO\n
BeginInvoke
&)Bh
{$jm
>m '5
&ApM]b
vd?Y
tpiP[
G?Aq=
cJ`T7
wE i]
q@`n
wJ.G8u
o8L
N1qM
Y{ 8
=N]
i9MH'
bZ K
+OJ&#
>6+B,
laLr]
n759
0}XE
n*k&m
M-K~%UG
^vI|8UQJr,!'{wa>u4oJ5cWy"
|x<
`0[
lX}I
nQ S
6*:%
nv{%U
]D}CBV
d*]9\oa
z%1w\
5f=Ij
Bdv{
C f\
DgUk
~~e+
=t ~eD({trbea>qc6oAhq!8x#
~hx!
90U"S
]
4tWW
RuntimeHelpers
aa2>
.4/f
_Bg
VU+$
/)GF`t
W(Vypc
?Gt\(rN
R%Hr"
UserControl
KA@{5
s;OB
C;h*9**
U[ll
jG65A2
6(6q+-
uQR4mg
$.lF(
Zn25
8q n
e=?V
N c
T|:v$'>
au>a
':#}
B"_
vZlf
R_N
,9NRy
k0#K
G|85"Wv
' L_5
vA&M
KwV^
sYdO
LS:q
1Aj!tm
Object
L!Pw
}b$;ee
Fs`6
!Xy/aw
e$:+
lVh!
ComVisibleAttribute
6C/w
0tg`
;E^
Q?utTN
e>mS
7ZE}
nc6-8
lJ8tH(jj}ACN"teIM*&Vx Vl%
'M:%i
8m-5
@0g0~6R*9yp_jQ6]glx,yePo!
Med8
}MRS
og^z
+$j%f
i$gt
j5'
.9g.
W$oB
!+APJ<Lh<DV&lA_KWQ/tD`c2!
}o7.#
I{ }Y
_ G|o
'\}x
7\-:L
;AXdsV|
XTd!
'a9$-
YAqGg1q
ML02
bK(3
^1 s8
/gM
TJ~Bm*L
h*&<!
{ vJ
VI*
P7<~
.yMq
KQa\
L&knAK@OBt7s|\QzrrTg:C+j&
AssemblyConfigurationAttribute
J'ey
A lJ
A))bmK
%3Bf
2Y=0!
(DQN
HRGg'
w>
&!$:
fQ(Y!
b j&-(">y?%"hor_$U"i%*)o"
ot6>
w A D
*<b{
1.0.0.0
68xn
y9;U
* avL
#qP
XZ>a
QF|S
oZ"N
3aoQ
t~\k
Gym|
cTB-
}n,9
j0<1!)=#%SnyIg5oRqfQ/',A!
zI@f5L
G,:z
o*9gnQh3#">@2808GLHT}\z#%
9L a
Sy.5
k*^C
z]y`X
)ui%
qhyz>JISR
o[ O"
3K Q
s-s6-4
Stream
e!3
L}y:
E}{*$C
)aYf
f/zo
TnbST:'qn'&wHN4D'tKy*:<a)
Z3B5
u+PX^
S(uf
X+'b
shD2
sRGB
r8Sz
0^0#
lg[)
\[C:/KXiF|&+\i=gR05$^*_1
F#.J
{8^nZcYp+Uid+_0`t,7Ui)FY%
#<r9m"
r /#
f
!bZI
%!*@~\8+|_w@}x-]O%9:{kR>#
}N,[
9-Y^HR
Or"6
CreateInstanceAndUnwrap
2wWf
QYV.
Z" w
ut.s'
w Cgk`)
p= y
tWo0
:X6#:l
EE X
M+#xq#)>#cWBT9n0L0SQZ8if&
HO`6$W#
OmA@
r7e:Q
get_Control
MU^Hw
Yk_w+
.Ham<
:w&uCK
.Yay#
Qo:`o
Confuser.Runtime
^I,A
M L/
h*$
a,Vu
q``pW
%Iaw
u}_d
)"7m*n,
ub<tdX
T(hl
{A6c
\yCbX
HQ ^
W'xE
\K9tHo+
&H>o7
\/
WXtmm
`@P>
6+.
'8 (
CQL*D
h U7w
*@^3q
<^:p
eiH2*zs
2LPe
]YNV
.FDd
DEg?e
Dz&c
;s;w
.OP^
-?A5
2=|Ho
[q^
<RM{
NJ|7}
set_ServiceName
8Cucy
y;cIC
P@PXT
#-3a
=(/ A
rc1h)1
@Pbl
4'UqW
g +!
K.0H
BzEnC~
4Uw1
{WoeT
0'z4=1@`RG=*K:_F`OTm|mb<'
UgU}
mK[I
EGco?X
2}s`
<O48
[bV]
8Bf"H:
@v EI
M[OB
96f?
Y] r'n
M[ &"`
mCs+
zKAO
_^"
OPA<l4HpK+1z{J&G/xR"l01)$
m<~/
DK/K
y ^\s?
;8;/
hbi^_
YxUo
L*/[
loqe?DX
!idq%6
64 4
G.b!
K7)Z
Yj}~
J|3Y
8Vm[ R
2E%+]
P-o2-
+t.`{
#g:
set_ItemSize
OYAy
TVLm /x
RD~Qn
c &4
l%"V
8 o.
{ RW
:om3
L|>f
.XMu
)1ZJ
he18N*2(69/(I>k?Yga,=`U,
/.fO
@q*nG
gf/
u;~ro!
8H ;N9#+nqERU,FKF}8?l{"D'
j*%P#@
`q~{
v t=
J1;12FeX-)g~%{+=!$Swyz:b
vr,*c
Ipw{
@eNY`*3I?27Ie;z^#+7@,t:;%
<kk/B
GetHINSTANCE
izL?(
*V|?xcxlgAL/9;DUs1\aOfd5
xUNCZ
Buffer
DRR@
Hia ]"1
f]*$D
dHb^
&]Q}
WM=MmD1NR
^}= 3
GjMa
!/,*
PeO/
yHBN,w$dBuGSKAd;fgW0>H>c"
NrGwv
N6>
dV=|
T?Q?k
k}wGLNpYr!rH3jbA0FL?/&'4$
]Ird$Z
%gJy
Bk HR$
GH$'p
QG[c
]-6]
KrNNbvH
G*!C
~%n)Dm
!1 M5
Z`x`/6P+\b'SJ|2M1s=dq1D\%
nwA}
qbjI
[-5Y
?Eq.
_,XG
#j|$
U1Z\
~jN$:s
3~ou
V'30&GC5CMGE}5DZtq[P%o 3#
Bo 6R
Ce}R
" N}
fK ^N
@OF6
1c}Pzfm1oz{|CHf}n\1BBmOQ"
[PNMb?-:}3wANddf[*TN ;RD&
c -\ O
4_~3zW
Az OE
'<&O
JF1yY :
`q#J
lsP7XOmOW/v"(2r;gk2n,U%E'
"0G\<
~dGnE=
} nV-C/;>-\l>n&5=PwpN0{,"
Ew$0}
;Z,3
pQvS
5O6kV;
$m0
H;U@L;
)@>lV_3*f1^L{%/+Rx@ogaUw$
{[~K
-hFvQVW1%}U^Qb2T9 zQE$3o$
-rM*
0HxF
9 -Gc*={g<VO_&'2VA=|h2Kj%
?C S3
c8sQ
`I3J
UoS4
DdJ\C
lU%el+
dRF/
CF5P
M[ej
W g4[
F"(
GbzE]Z
|Z:0
`*bptK
IKHB+g[o&kE //1U'c@@id+i!
n([d
AZi[Y
=4,Ac
R?7Fr
3TD
?Z8X
!XCn
XBDu
C?SV
/+L5
Copyright
D?|5
Z/Nov
ArgumentNullException
^rNZOQ
>m.is
cS9U%
get_Major
Yx'v
(}1Z0
~O]
|TB;
R$Z+M:
)$M>3
5bYQ
{*Op?JekZZ&(*^WL2gjej8Ah#
sthr
d\3
16H_
T4;
Point
,J(+
o3-k
n1s)
}7+Xb
)4 K
K.=zi
/%Gj
$ )o
,#.yE
v2.0.50727
b(SU
c'my8I
Xp "
XLBE?
S fSU[%
llI -U
tI%
]c98Ogf
4]Jox*wZyp6[s4=@"1E&@Y`H'
]$Qq/(}uYh8DEV5uCM`/NC/H$
IpHnw]{
D`][
;S'v.@
n@rX
xc `
zYca
P!yj8
=x~
6+to
H)gi
e /m
GAC+
^/D9
Q8pE
:a?0
%5t#<K0H*/jH(rLNiP-[^3XC$
m2T\}+
0-%wmEjc_ Fa6(mUVw%rUHp@"
7&4QN
d=HL
kN$d
uIU}
K83l
9C/00[8c3Q-[S$-6W1jQ}d0a(
Exception
Oi9]
JntK7
:h;R\
rHr2
YUFRPM
:)WR
R@cR
- _g:6EQ+X8;m%v#qD AjN;?
CCOIs
x;\^
w}\$
7 pm
NpL]
~?Lm
@ai;
t =[
6CA&` nd
V%(t
kJmH}NoJC6nlqI9CA#W}U3e:
Z"aQ
WwSe
p]?c
=%-8
n5'?
GetTypeFromHandle
IAsyncResult
ySEwJ
gQe`
5P*m
2ab{
{NfUw
-TG3<
P"8n
:M+C
)iS/
CR{V&u[L|s
);*r
c(a(
`hf)
k 7
Q,3rc
System.Runtime.Remoting
|I._
PM]h
L8RB
2av, L
Ln;2
Oie::
2cQ8i
@0a
GetDelegateForFunctionPointer
(r(;
0#qb
Y=_
%V&@
LygSa-/
b+o1V
nb([
vj#i
4t&S*>
97\q
y%E'
WZBD
;)>hk
|ACa
+Os9a
u61UXRZtGlvjg@x<DVIr4vPx#
fi0 v
8}5|/NE
7'Rx
G@KJgC
xG"4mvolZKS,l`eo`m$=_edS
5{#j
~3h
E2t;
'w%z-6
kCRw
:&FRKtR}6'NDdInT_+soU,-!%
}YQG
7 DZ
8~r/
*-|Ds
1TJDZD(,O#OE?t{+d!Cf|pwD
'lM*F
Ze^ z|`
4K:g*6
#9O9T
/sw,f_Lm~chQSH~uushPZo%6$
5) O
% amL
M=@K
5uS*d
3n [
Y.pWN
\zDin
c}Ri
*$/0
z]-,
~IDAThC
MS>"
[R6|kWS]HT*B1s }?X13]m;/!
>e:
jb||L
1cXE
j!LY3
XK(.
8y`j
,^Ea
!_TM
System.Runtime.InteropServices
irlk
XEmK
r sd
lmQc
@{z}
Ei;HS
KO WmWP
Math
U>o
7a6TJ
u9B6
Al>R?
>f&6
_R@k
vgYj
/K=f
6J/U
yt6o
V>#2
>& C
plxxk
)USP
,C]Gug\u
uTofMCB]1EE
Z~94 r
<Hj`
"Oh&
Jh2[;I
7UnFy
$-wT
E6|K
System.Runtime.CompilerServices
bqUz
|ml(_
P76-]
d?r2
SuppressIldasmAttribute
L~R
-2Pu

e.T
rhN*tw
s_br
xLsp
xa+9
U}1b~
2}H@i
]gx16
p z
Q%ahu
?{T#
.Dqc
{}tKM
@>rf
@HaS
Ut$^
)@?2
/(%Y
66;Qp3
%*6*
A~sN
g)Ds
UT3YD
%@*+U
n/spe
ZcrY
[ SDS
\-afU~
XyWRM>C5-9a&bT0z\ulBGrct'
g oh
e vFq{&
,Xmy :%(+ff_q#gsTn<#Xi*i'
#vO)
9rJJM'4
AC,X
#j$\
x}_0
]^A:
7geO
QkWQ
mA(.yI
cW][*
/}AEA
?dh
Ks\P
7TN?
bGHh
FGNx
a@i2c
2o
z4b3/7yp{5dh)h3fZ!2WJdNh"
-k:'L
=:xn
~[xl
+}3k
p>0u
Xf ~{
e".`
set_Font
=pw/>
iyR:
Ej|ci?T[(<
tZW
}1$K
4b&0*u
W|:{
'^&ZG
G;sc*
)xii
AI/#X
p5Jz
M+^ OJ
%W}^s
EFCZ
k$Fx#*H-
Qa-qS ; c
94(}x
IDisposable
h+ l
IY5Ao
Fk]E
$.
iW=
h_~\#
|_Y0
|] x
`fD-
{h(1_
37@w
D%QJh
bq(5`
:kHe
o7M;Z
<8 0
a#_8V
I9cc:
FvQ\N
^SG.
ahAd
Ln&,
>_wN
qL'\R^Ng:x7|O!OW+8o'$j |$
jK]Z
\*[k
Xt[G
qPFU&A
_Akj
_*V
2y"_
IComparable`1
oKkw
z@kc
vZmdGN
j-m#
;)%^
BMwWJ
9A} (
AssemblyProductAttribute
n%x<
ym@n
wzyC
_2;
11qwD[G
cVl\Q4{4vi&gSfqTZqQoGIH#0
`Dn
)7cs)b$
tAb'
KFag
D-"@9
t.#Y
;D9=
r`;I
9w3<Zd
*a8c
2UWU
v=aEZ
!btl
+Hzw
XtX$Tf
MulticastDelegate
&/hQR
Q0[@3
rpc/
UqHxlJ#)~)%CJ0)$b:1sp8KK0
j&)3/
O6D
ct2w
T7V@
4a%}
{ls}6o
7M q
!m_pData
~"8 u
value
:;Eso
^tQ
yO{mJ
2018
G&z`f
;C>h
| =
#~0TY
5sGx
HsDo
g)_}z
-jJe
+5M.[
kLBa
(bs|o
|I^;]
7r@N
T^i
.{]|
8W5
OnMouseUp
Y Qc:tSdT k0mfno>r!*n]~A"
qcq?
V8J |
[s{G
:Z;mV
XeZ`~
H}Hn
/JJ1%
hoNbk
upYQ
MT`Z<
;W8=G
[>Vy
C}0"*
Bkfu7
GjM6g
j^{{
geUM(79AR?i3k=vj>OwOE?];
*+ /
$1SIC
'[ ~
V5JV
#GUID
mwQr]1#$[{6#y4hF|g]hU,BV'
/:2O=wj_7UXL7=ZwY~lZGq$)!
.J[W
nN'd0#?v80L88u^i-e'8TV>(&
EqY$-D
-tx
jK L
%%B^
a\]+
@dU
set_SizeMode
+F^7
aE%J
5M{j9PI~Ek#?qW;1I|DJzn!(%
i\%c
Ii(Z1m
JfK?#
A<1W(1{_mDsgrvNN5#(5CV78!
1;9,
Ph);
EUO!bpRVJ#Py:kH^9=W>Li -%
39[U
0Wo
@sD Wr
uEIZS)X
u>y[
PN?qO8Gx-W
&AYm
}nPvW
<BKR
B*ik
$ .%
?G2'
JXY*
n_e]X|#
*N'k
?Rb2
$dg:z
<k30
IDAThCc``
:o(=u
b' C;
w#+)(%Jxsr2nMlOj]oR#-54g+
o=k<
X~G!
A6y(\
lb7yj
.30[
|zj3RA=]l#8`/t>Mlim=c?3a'
xSi15D
X +U
P=Y
+:jo&
C5.P
MC kGU+O
Nullable`1
t{b?g'e(i]tU>7fj$j`4l2A9
(t1[
&a3lQ_'
kcOwD;h\g/xU;/qsJQ~v}1J#
V%7%
Tacq
Y "5
k\9e
Z1VF}
DlBr
??c+mT
\X]B
T k x6
n?3-
mLOw
Ku%}zc
C6%0
DXQ
&|E7
get_HasValue
789
hp}Wa
'0Kro3
<Ot<
9OnCO1LQrw'zu__Ceo80f*A3!
0p30
1RR@@
{)gu
~LQ=
ABz{
]<`~G
6k-p
lb14K
b&E:DN
9(8
-l)`
i%b1
;%hIa"
Kg`M
#y,q
<oX=
>VtjIqNNf~a4Z;l^w/K5>8/l!
w)&f
&aO@
Encoding
%yH#^;$,4nQ*oYEf%wnNZ ,u#
n@++/jBNYRq?W&4#D!3yF&@z$
CHP>
%MuR
>BF5
M!>Zm
eX"ON2
{T:%qs[![sGV&hQ06@w_ig1h"
m|T
(v7o
~63hj
bnfA
>A?+
f{D{v
xBJd2
IEnumerable`1
:9L;
~;_D'K
%~\e
2)Xi
!=Wm
W&`P
get_Module
F2o:
TabAlignment
87+4mN(!@A'UiD^-mfzxuI#)"
)-t(o>Y
vM2ax[
5!+{2
,9U~
zaFJy
+KI^
,NI
hdW.
Y)a9
&0xy
W')OO
)I&z
Ha
C~5sD
Rectangle
i34\
QC|t
<(T8
6yP
&Itu
ubb{
olW3h
#:LweT+5>n$WH3Rb7,KF)F6~#
mJ0#5x$3\x
Cursors
H 0'
G8:\$I,hA6^apj)h;4YrT"<+-
'N%dD
5J8&H8
UV@;
^? -
get_Size
&(;
)n"A
I#Jz3D5[]WWZ&A!]?THGpG_%
9.5lHy
TN1g
aj `
e~&R
Wpab
%;g5
+'bJH
\EwHa
ui8v
9d6 o
o\hr
v_<w
!8Q4
ao='
System.ComponentModel
.:zr
?iX\
Ark.exe
%h^
~i0F e
i,6[,Y0)paxOGUQ^@48oG'6}&
ZcX%
rwqY1p*
436534A617CD86B8557AEAA31D433ECFF38B112F
jIhy5~7![[@`b -U(>Tc[> 1&
M( o
nzj
E5)R
4px4
']E8
5iCk
wYEZ
+ u
#+-W
eJzWv6s~
N^\R=x\BQJQ?m>wg|Cw)p<+6
=M 23FJi=P]wx1[XSL@#bF?V!
(PEn
DisplayNameAttribute
dZXb}
IEvidenceFactory
|OY_
L9ad-"}ubZe>h~O9NG)k}1XG+
R8(g
LY5e
t]'5lg R4#Y<Yy=5T8WeyV%q$
y0+YmKE?""BiG(MMS9{p>yZU'
C648C0E55DD0A71600A3C979FEC05C180303B2F7
p=xd
(Szw!?,*Q
B 3r
O:um
^LM>G
%qY1
v bP
$Hvxv1V5:qp@Ek73U8%qm1zE+
Ims7
1l2I
fP"M
vOJse
3=R7
fWI<
$+$
[2a~
_k]v
;<Dt
nCo
System.Collections.Generic
X?4>4
%8W%
Z3^jR
^9 )A@T
EShQq
lp|]y0
6Bm~
k5?r
?t]u
-R},zpj
<&&Q
g" 9a
W^ (P
~ 'iN
+MQnq
m*ZY/!xlesmEfE@ K/Z<n_&A"
W~r4_
YC_J,{
|IDAThC
bO}d
& 3&
System.Windows.Forms
\.g/S]
set_Cursor
iWXA4
[r{&
us98iu
3<>5
/08j
F N
+P"1
V?&v
UD4A
2zKe
k$N%
K=jz C%x@_9Fp&B[jdX/,L5/$
6t88
Ns 9Dl
[>g/
WriteLine
System.Drawing.Bitmap
%lqq
9a+*
T/>;
0&pk
zy'4:)&xb;"A+;RhK!\0E2Lv'
Tc5U
]\d!d
+V'0+
.;d5L@
S.!O '
SetStyle
C_ e
OmY|18%lq%W5N#!S-S`xx_,;"
4BJy
)g{c
0! <
)]0K
,0!K
KOdn]
Riq5-
t.bKV=X
disposing
i$+$
3|Vm 8\
gAMA
EjQIT
6d.tI
wH"a
D79 r
PM0Ei@
\dh'7G
t{ a
s?UUMT
|2 ?"HG
tP2lW
1M1\
f`yW
k4 v
Q?\1
@T#5hh
L+7*
C-e]
*d 5
PNG
g`e,
1ox1
f8(
N|R^
[$]yNb4H*2&M0D0~gNR6K8W\%
s~57
?b:E
+xWI
E-7 h
j MM
7XRV
Z*5J&?~\
/s2c
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven07_64 Seven07_64 VirtualBox 2018-02-16 18:36:00 2018-02-16 18:38:52 172

8 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven07_64 Seven07_64 VirtualBox 2018-02-16 18:36:00 2018-02-16 18:38:52 172

10 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\ban.exe.config
C:\Users\Seven01\AppData\Local\Temp\ban.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\ban.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Users\Seven01\AppData\Local\Temp\ban.config
C:\Users\Seven01\AppData\Local\Temp\ban.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol21.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\Globalization\it-it.nlp
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Users\Seven01\AppData\Local\Temp\e637ca14-bda6-4d99-b819-b597168c5ed4.dll
C:\Users\Seven01\AppData\Local\Temp\e637ca14-bda6-4d99-b819-b597168c5ed4\e637ca14-bda6-4d99-b819-b597168c5ed4.dll
C:\Users\Seven01\AppData\Local\Temp\e637ca14-bda6-4d99-b819-b597168c5ed4.exe
C:\Users\Seven01\AppData\Local\Temp\e637ca14-bda6-4d99-b819-b597168c5ed4\e637ca14-bda6-4d99-b819-b597168c5ed4.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.INI
C:\Users\Seven01\AppData\Local\Temp\ban.exe:Zone.Identifier
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources\Ark.resources.exe
C:\Windows\Globalization\it.nlp
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources\Ark.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Local\Temp\shell32.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe
\??\MountPointManager
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2384.20442171
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2384.20442171
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2384.20442203
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe.Local\
C:\Users\Seven01\AppData\Roaming
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows
C:\Users\Seven01\AppData\Roaming\Microsoft
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.INI
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\9d29f161-09cd-448d-af0a-3038a8ff55c7.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\9d29f161-09cd-448d-af0a-3038a8ff55c7\9d29f161-09cd-448d-af0a-3038a8ff55c7.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\9d29f161-09cd-448d-af0a-3038a8ff55c7.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\9d29f161-09cd-448d-af0a-3038a8ff55c7\9d29f161-09cd-448d-af0a-3038a8ff55c7.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\shell32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2560.20446453
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2560.20446453
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2560.20446453

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\ban.exe.config
C:\Users\Seven01\AppData\Local\Temp\ban.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol21.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll

Write Files

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe

Delete Files

C:\Users\Seven01\AppData\Local\Temp\ban.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2384.20442171
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2384.20442171
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2384.20442203
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe:Zone.Identifier
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2560.20446453
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2560.20446453
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2560.20446453

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ban.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3035fc5a\375c7a1a
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index21
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.ServiceProcess__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration.Install__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.5.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\337da671\3850e7bd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|ban.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|ban.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|ban.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\337da671\1b71387b
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Namespaces
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msbuild
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msbuild.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|msbuild.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|msbuild.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|msbuild.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index21
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msbuild
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Write Keys

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msbuild

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
kernel32.dll.QueryActCtxW
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
kernel32.dll.GetFullPathNameW
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.VirtualProtect
kernel32.dll.GetUserDefaultUILanguage
kernel32.dll.GlobalMemoryStatusEx
ole32.dll.CoCreateGuid
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.GetStdHandle
kernel32.dll.CloseHandle
kernel32.dll.DeleteFileW
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
kernel32.dll.GetCurrentProcess
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
kernel32.dll.WerRegisterMemoryBlock
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipGetImageEncodersSize
kernel32.dll.LocalAlloc
gdiplus.dll.GdipGetImageEncoders
kernel32.dll.RtlMoveMemory
kernel32.dll.LocalFree
gdiplus.dll.GdipSaveImageToStream
oleaut32.dll.#8
oleaut32.dll.#9
oleaut32.dll.#10
gdiplus.dll.GdipCreateBitmapFromStream
gdiplus.dll.GdipBitmapLockBits
gdiplus.dll.GdipBitmapUnlockBits
shfolder.dll.SHGetFolderPathW
kernel32.dll.CopyFileW
kernel32.dll.SwitchToThread
shell32.dll.ShellExecuteEx
shell32.dll.ShellExecuteExW
setupapi.dll.CM_Get_Device_Interface_List_Size_ExW
setupapi.dll.CM_Get_Device_Interface_List_ExW
comctl32.dll.#386
ole32.dll.CoUninitialize
ole32.dll.CoRevokeInitializeSpy
comctl32.dll.#388
oleaut32.dll.#500
advapi32.dll.RegSetValueExW
kernel32.dll.DeleteAtom
comctl32.dll.#321
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
advapi32.dll.EventUnregister
kernel32.dll.GetProcAddress
kernel32.dll.CreateProcessW
ntdll.dll.NtAlertResumeThread
ntdll.dll.NtGetContextThread
ntdll.dll.NtReadVirtualMemory
ntdll.dll.NtSetContextThread
gdiplus.dll.GdipDisposeImage
ntdll.dll.NtWriteVirtualMemory
kernel32.dll.VirtualAllocEx
kernel32.dll.VirtualFreeEx
kernel32.dll.VirtualProtectEx
kernel32.dll.Wow64GetThreadContext
kernel32.dll.Wow64SetThreadContext
ntdll.dll.ZwUnmapViewOfSection

Execute Commands

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe 
"C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe"

Started Services

Nothing to display

Created Services

Nothing to display