MalScore
100/100

man.exe

Is DLL Packer Anti Debug Anti VM Signed XOR Related 2134
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 487.50 KB (499200 bytes)
Compile time: 2017-05-09 03:14:48
MD5: bcdd86256a47742877cfbc9d377367d8
SHA1: 6b25faf4c04c96285b093a92b3afd2e5740f798f
SHA256: 19b656556106d1d00344fe66ad8a415e28fc677d878aa8498e4f8aa3a4b024ae
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-02-16 18:39:54
Last submission: 2018-02-16 18:39:54
Filename detected: - man.exe (1)
URL file hosting
hXXp://prosciuttiamo.it/ice/man.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
No report available
PE Sections 2 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0x45dc4 286208 548215901b414f04ef93c49ea14afebc 94bb544404474ef87564546d7cc2da2bd8ccf104
.rsrc 0x48000 0x33a14 211968 897506dca4575c63c587ef36f0f065c4 faac358857553648dfe2b2894c538ab0be739383
.reloc 0x7c000 0xc 512 fb32c32461f4542ada0aa2795c8d67b0 b1af2f975aa5ecdfb447ae0372b2739e5bed1528
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x48130 209740 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x7b47c 20 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_VERSION 0x7b490 920 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_MANIFEST 0x7b828 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: Copyright \xa9 2018 Northeast Utilities System
Assembly Version: 0.0.0.0
InternalName: man.exe
FileVersion: 14.2.22.1
CompanyName: Northeast Utilities System
Comments: idebuqos
ProductName: LightCycler\xae Master Mixes
ProductVersion: 14.2.22.1
FileDescription: LightCycler\xae Master Mixes
Translation: 0x0000 0x04b0
OriginalFilename: man.exe
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Library
mscoree.dll
IP Found
14.2.22.1
URL(s)
No URL found
String too long
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
Northeast Utilities System
idebuqos
14.2.22.1
VarFileInfo
Comments
f06422c2-a597-f15
f06422c2-a597-f14
f06422c2-a597-f17
f06422c2-a597-f16
f06422c2-a597-f11
f06422c2-a597-f10
f06422c2-a597-f13
f06422c2-a597-f12
ProductName
f06422c2-a597-f19
f06422c2-a597-f18
f06422c2-a597-f142
f06422c2-a597-f143
f06422c2-a597-f140
f06422c2-a597-f141
f06422c2-a597-f144
f06422c2-a597-f145
man.exe
f06422c2-a597-f120
f06422c2-a597-f121
f06422c2-a597-f122
f06422c2-a597-f123
f06422c2-a597-f124
f06422c2-a597-f125
f06422c2-a597-f126
f06422c2-a597-f127
f06422c2-a597-f128
f06422c2-a597-f129
Translation
Master Mixes
Assembly Version
FileVersion
Copyright
VS_VERSION_INFO
StringFileInfo
InternalName
000004b0
LightCycler
ProductVersion
FileDescription
0.0.0.0
OriginalFilename
LegalCopyright
a6d3cb80-2cc3-98
f06422c2-a597-f119
f06422c2-a597-f118
CompanyName
f06422c2-a597-f115
f06422c2-a597-f114
f06422c2-a597-f117
f06422c2-a597-f116
f06422c2-a597-f111
f06422c2-a597-f110
f06422c2-a597-f113
f06422c2-a597-f112
f06422c2-a597-f137
f06422c2-a597-f136
f06422c2-a597-f135
f06422c2-a597-f134
f06422c2-a597-f133
f06422c2-a597-f132
f06422c2-a597-f131
f06422c2-a597-f130
2018 Northeast Utilities System
3[x
f06422c2-a597-f139
f06422c2-a597-f138
pM=z
D h2X
gSN4
|m2i
30R8
X</[
)M|T
&*A&%
Q0 s
yOPd
53{n
)5]C.
C708234F139063BBE3CBE2208BB6ACFACBC50333
T9aR
PNG
y)wl G
\uQ7
7#?,
vzA)b
rp+}
~eI kn
OP$K
zD^X
P{BSl=
o{$i
KJPv
(5oj
:4tx
]w r
ResolveEventHandler
3w3O0^
[xOzV$
W?mMB<
e1 e
F7k
A-pNX
0xUY
=a&>o
+Sx3
y"Z'
p@1_3
8v+l
K_9e
_t"e
B{UjJ
/Ju
fcg
?Zq`b@
*yc_
ch^> ^
`BKx
;>
<PrivateImplementationDetails>
Fe B
Db6xc
7DZ,
o%6j
hVY&k!
6hFAACg
(.Q
lF_D
2 [w
^kr8Y
^])!
:*Xk
N2 %/
zKd?
yrUA
{tj!Ae
lj Y
b{W"
%{\<Iv
Drxl
ea\Mg
q_eu
(3J`R
~l<H
XS8G
%\o_
"t=yv
K'<
cjgN
kj`%
JKqi
p09G
ArgumentNullException
b?rwZ
:S+Y,
&X9B
Upr
fLw;
grTd@
M&|#
.K'J+
rM;
_nmG
-yQ
|S}vy~
R2zB
L /
5lFe
42}K
]KQ'
vc!`*
o?qB
qLjZ
q3Pc
T\":
Nl2V^
i[1M
xT"R(1
:jM"8
LV/j
gXhiP5
RuntimeFieldHandle
u7g:;
{ .B
System.Security
OverRect
}IDAThC
RXpi
WDVn
GGp'L
9BsK
ObjectHandle
WL m
]b;
5@#MQx
PFL
A}9x1
n&Y;
M d2=
"N x
2#F$
u+SLK
ryIy4
s^ *Q
xzaq
O%>PP
XAC8
_a?P
EndInvoke
[-|c
dD k
ly=lFM
!+t|
Y5`
ke`!
) X&
e|,gI
N"G}
o_Sm
Click
A:&d/<@
'iW'
.99h
tZgI
l'b0
,i'<
_&F{
|[:z
/&nl
dh &
/QN.
tM _
D]OW
Vy7~
W 43Hh
tFWwL
B}
\PFk
?0U$
j/<,>
OnMouseMove
ZY0
caQ
RvXq
hz.B
set_Alignment
zXs4
lhm{
pPWG
[ 6m
>N }
;M Dy
rC9F
JubC*
J-kA
I!r8y3s,
bL 4
G|E]l
co}-E
<tw5T
h7BR
@>J;Hu
@O*p
i~7@
AV`Cq
s 0+
CAQ{T
?o1DE
ZX9\;D
lzb,
LqvCu
V$%I;!
2R ;
Zj}
M+4r
AppDomain
GjE 8{
`# ,
~ f5L
_VPN/^6
c C?
wi T
j* =U
+\ql
get_CurrentDomain
/kG;
get_Height
sU/G
e>v5O
O6?EM
`k(9
Y<|`,
J X
b#4Y
dfL_
n& F
9jeeq
yK~l
#6:O
%*XOjm
arcI
64*S2!
wC#t
`UjFJ
N:FK
N5V".
A*p2p
|X d
p4)!7?
nIMYq4
~WVx
>/mhTy
/%,o*
HjH
/In8
4>M[
AssemblyTrademarkAttribute
IT J
}B'@jQE
^-o>
Nu<9}x
|~c&_
BO'Z
1]A3g9
`88;*
D[
"$0n
Y <Z!@v
i" /7
=?OV
5Ggu
=Az5
OQ78
f";&
]r:>
?<&l
=,3o
+zkIpg
"G(t
bIkd
44a\
:znajBd
rZ?b$W1
_T;D2'D}r
W_(o
0 /[a
%[2[JW;j
a@G22
yJT
C(NgG
.=y3
gFgRZ
H~*f
x* dE
Y3o=
CPxO
v]L'
zU{k
L,jE
rpw?
'Y +
\iif
6Pm`Is
')Il
^Lf'/l
-h'
&x6
FOgP
FOgQ
\Oz
)7t~
"wo\
R6{I
jM<E
,u`@<mI
-B67
\bLJ
Type
QIsl2E9
FOgJ
x8K,r
Ri>6
?)";
/RT4h
p[nG
IEnumerable
z+T6^
es2d
,gp<
_k/>:
3+$i
S`zh
Gq(8X
=!}{
qjK
UaUn
Wp^x=
qY !d
;"k7O-
fZ?^4
v"|a
mf PfP
!%?zE
IiTT
ip;v:
bg|g
]; |
C/0
Wr-8
? _Ph
K_LN
PU_qYO
Hovering
a"E9
Char
T_:U
0!)P; #N M
W> )%
BCjP
p-/1
mK5I
w~7L~
Ic~o:3
h{"}2
ygN~
dSZz4H
L!}T
IJ1
_?
[!'0
0:r8C,rI|
}#:t#
~_O1
/RT7hT
5(QO
Yh}Io
`&/m
'G9-
get_Y
~m7Mr
a&#(
b;{j
v$1F
D2!&
,T>A
xKs8vK
R3Mp
/l K
~]W^
Gmpv
<XuOj
6(?g
5\ k
[ Y2
RUP8ZuZ)
P,* ]
<3f
sy$lA
mwjq
p[Hb
fJ4n4
Fg \
~[4c
) Wd
?_Hk
Gfft
*Y+Oe
,6 #
/zH)
!G'!w
K kou-
WM4y!X9C
B?>N&
E6gR
VX",n
KKL,
W.1Ne;wg
3\&d
bS^H>
?v)Z%R6Yn=Tq
Mea<
@NEIG
WrapNonExceptionThrows
@dwj$
T2 "yr
BaseRect
!\:F
O#6H
882Kf
Y ]|
.text
1!Ro
6AS.$
Ln/hP
_qGM8
rKp[
E=ubK
m+J_
1=}q=
s+05i5[8
Q1k:
*#k^Cb9
s<EO
v [@
S&q`
5-Ay3
g'1R
3dAT#
-z&~
object
J}b <w
(L'8
<W|uT
lvoW%
K(!]
j\Sg5
Cy^r
I_=l
>^T
/mdVY
N8SV
ax _
Cnnf
`C~t
tI~%O
`)6z
[7So[
IP'm
HB 4
~Mq^,e
%k&:
F:GwwK#%9
Q m!
f+{]
7#HF
u= 4
WA|[
NGer
#+rK
set_EnabledCalc
Y ]
UcQh o
AiU!D
<Q0}
%ZX4
,yR?
wv=%
/t
FX}]
}#r?
@ `5
_jW e
$~UZ
W6AP6
?rBu
mep;
Gd8}Y
},?'6T
C Es@
3*!C
XC8n.
s@nn
:.m`9
=@
Y4 \
o\M.
GR h
`aIlE
Assembly
SPmE
}S?|6v
I7*(Y
4@ P
5J@Or
I i$0N
Qfh%
\iZf
.sBM
iE`CW51.
ArN9
`.rsrc
-</:
% Yk
B^A+
O_;%dI0g
l sE
%r l
@2
b zd
$:_X
O/"e
5z~ w
nzyB34/Y@
k`-nc`OC
result
QP2PP
ErG
l`P*
BF ;
X-fR;
3eV#7I
C;$r#,
qb<d
l4No
/b@P
8'{r
R$4+5
H<6>
!z>Mst
`>^7
mH-O
CG`2
!si_?
?6R<
^A]^#
MvrN
5 De
Fr:A
M%'k
{#NqA
KT<%
+oJ|e
$',5
+ NL7
p~`b
(]Y1)
CK_R
f[.e
xjpGK
BC{z
n^B}3
UKu&v
c-fL x
uEuY
get_SelectedIndex
/j67
HM?j
IE+Dw
KP $
NI: 4
7@#
?Q/#
F^%x!
xOVk3EN
PPBj
s&PH
wP%&
;"`NG
5'i
K;|v3o
ControlStyles
xKzkp
!Jw&*|{
MouseEventArgs
!!?v
`&nf
+^s.6
]V@m
9ew9m
Udj":
;1dN
/x=?Dzj
U?Ru
!2Vd
7Z1P
<WRD
DBU
s3wi
}e?'
+0@b
*N0X
_7<<
xZ|`_
OL"[H
KbSL
,o};wlj
\;)]Rez
0%Mhj15
0l#~#%
v'3g
Ugu+
yfyz
\NH+{r
L!i+#q
jM~,
S{1@
qB$?mL3[
*<w<
|%6|0
~Mx}
[* "1m
M <MdLwE
){gK89
96GYA
ojqu
M\;d
\9*|
r?[e
&cP.
e:6d~
System.Runtime.InteropServices
g]xF
bU:#
8R+j
15=9m
U.4HO)
QGUG
?;@T8
S[1!
P]tD\`uO
get_Assembly
} 0:F
SY/B
J7 I
=s}dj]&X
5bi|J
VMSF
Pw89
lEw$
Ttl]3
$Hj6
_da ?-~
v[q
?q[~
K#=8
NTVZ'
|s[Bo{
Invoke
)VNG
x?$C
oQ'=
RSu#!
MyIX
zuzb
{Ot#6
! vmH
M2n_g+/
=]3L
H t
r&,
H[n1
>5&Hm0$u
Console
Ct|-
wn'b'
Zw9o2\gC
$"oD
tvK
wV`=
M9- i
+dmT
G7_x
)cb#
Avzo
OqZt
j?yjU
- uq\
">y
q73{W
LcX
@w1Z
|oCQ
.:`Op$
BA5 j
rROh:
,c1nO
&*89
7!cf
XdXf
^ f>
LRjb
5F}L2
8g-;
Wd^s
&*8V
PN5-
QOgU
5Knf}
b*77
*ya/
4d<6
IHDR
E#X9
&*8A
r@#>
ZMfS
TQJ5UQJ5XQJ5YQJ5ZQJ5[QJ5\QJ5]QJ5^QJ5_QJ5
fRU
VH9n{
Y:f&
X1vRm
&*8|
7<Xxu {6W
B?54
G!3+6N&
3wsC
&*8y
(3{d
twIIww
S 8g^|
j9 u
K8@Y
$VO4,fm
b_*R
!iDN
DL!cC
Vz":Tf
d4M\
System
EventArgs
Zn*w
'qF
3,_V
^m557}
P '?nU
Vd@D
pgCn
pSQW
YBq
hT4\ ^
sd?jr
~D0Et
nzb@g
pNFy
!r P
K=^+
*d?#
SJVOP
DYw$
7O~-{
^~Vu
*+DpL
Mz2U
=zBk
59?"
[N;2
W@
=:d-
26o%
w} B
lJq"
V)[
t'$Y
gT[<
ftG(
LA4
;}eP
G32`
Bee:
5X1s
MethodBase
#Strings
jL@'
kGbo
A` 46
P0\v
F - }U
System.Collections
J\Or
&*8i
D ;
+}p9
\m"*
:d-4
~)1D
iWz
):]
l7KMDe|
InQ,V
kSB${=
O}s
khA(
n'ie
9q>6'
get_EnabledCalc
Y:z$Nl
mj8"y4#g
_ v)
,{"j$
oHt>r
/'Fr
QGgp
CL{x
jEaU
,$-x
y?zr
@mw3
G~%N
^IIm-/
Vb6OJ
OB$ ?
98g"v>Y
0RA,&
n[_.
)r>Z#
get_EntryPoint
-z q
vFM`
Io 3
;8=;
!ab8
,pf
)h|h
jLaX
rS*?,
fCQ_5id
6sa2qK
!n8y
nFkH
;@l<ha
%c4H
Yhwt
pMpn>6Z
9RL h
: -m
I/eG
79RH
e[0ua
PV1kY
; onf
IDAThC
Y+*e
chj?
J".
Pw;J
|g$T
AssemblyDescriptionAttribute
3qe Q
mm+c
set_OverIndex
5U)
)o{bfY
JPOr
+@ E
53bj
Py3!
e78
t7H Hn4
_(Z)
.lXzI
" _1@
in&h
&` X
|kl;
rM9Q
Z"G
3TVN!
)C~pfn
t=`t
y)zJ
-@a;
\wiw9CG
A?1:\
42]4_
P* O
LLFq
~\qn
&?wU'J
Q*!/
s=f?q
a>F/
L Q
jE"JB
Dz IW
3 `]Tx1
Pl+`1
]HJS|X
wL\W
Color
F1U <Q
i 9V#
w[1K
"AxL
b8X P
iZNu
{Opm
aD)gJ2]
x^(f
Zm 1
IeY/h
set_BackColor
Yp_9hV
O'&(
H&~|S
<&#P@
5 P^
e.#O
!>m
h.<h
get_Width
g;= D
D6vz
q5v
KE9_
VH0n~
rR+o
[?)@
5D~'
)9RL
A_ue{H
sN )
w(u
wLp_
DwA j
j6>{a
#%c?-
`3:I
4F`x
$z7\
s%qB
7#Q?i*
A.Wz
f.jkT!
#CMfl
NkOxD
-Z2}
#F"]
_bg
vRB)
6</E
;1I>
<@ TW|+
set_SizeMode
<&"]
RAS@
NO&jm
=:&,
~K;C[
.vFf
:4@2LK
P'!
{Z b
rM 3
MdK<
GfVZ$
CO]n
EIro
s7kk
1eQ$|
SRM
VV&.p
u?'HD
wBVB1k!
/A5{A
}=Pt
c`UT'K
kM;z
^?B'
|8l
%]*6e
T>d<#
n7W8
2!"R5P:
.vyW&
TbII
=?cB
Ie>p
w(c1
Y ,s
Q(Ln
VH0n
+Xl0
U,sX
H$kZ
idMI*
<3;
0^6_
z9}|
qJz]<1L
v)wU
o>0)
5OVl
(=_$
p C{`w
LV,h?
|}6j
3* O
*:Np
5Y27
S;b\
x =i
6r L
_1^1
4'[{
7h/_
N+ZC
k2``
~b1
AssemblyCompanyAttribute
G?zD
+jFD
O>gI
#GUID
N0Ro>p
XH+Ue
L$lU
!DLsn
2&V<j
c<ZL
eO5g
!xl]
{IDAThC
iQIU
62#zy
p-YQ*N
E$2T}
Z~ r
}sM6CR
!v7_
dx^&
aDF2
x= ^
J(D>
uG3?
M|=
3g[
t~+ 4
~m 1
?=$}
o;;W
):od
set_DoubleBuffered
: |f
2QrJ
cO{5|B
get_FullName
'{sBv
d;\&
#,ZCZ
Z_ /eI
KK L
Y\dF^
w%R!7
TzeY
:l"aX
2Egb
8,}j
|Esd
~fZn
@-~+
=v),
bY!#&,)
<LOqHHC
Contains
(j:+v
$_N0Q@(
Z<&
IEvidenceFactory
'}rc
"<(m
UI:xFX
N+M.k
26gw
!,
FD|"
ValueType
nCQm
xlV'
GuidAttribute
N$.1z
16Sf(VQ
gY\:
emR@
6416c4bc-330c-e9.Resources.resources
GDV^k
<2c)
!)4 8P
_Yr=
w1\
4__,GI(h
Syc$*
VIrw
5<4$
Ilr
_85G=
Qr'<
swUcH
XR98
Qx'K
J7J
Y*"g
$o+r
] `
]k6HQ4`
IV@
=U@W/l
%WB'%
System.Runtime.Remoting
kA5u
:3 d
( z
@f8
IObjectHandle
%zNo
w]a"
W+&>
W3.f|
9 iU
#`<+\
BD\
`l;S
q DU
6&:(
'JT
i5 h
F%0Dn
dIm$x
]x7t
15HK
Eo3&
|l@8
_%mm
,I&v
;y\ h
j'W=
+}{5jO
jlGd
Iw)]
Gls/s
OnCreateControl
9>:w2p
Xyyn,>@
l]Tc
~RZ^
N&#/
Q@nbP
ju:T
( t9
fCudA
Lz1B
d@w}"
:d72
ICustomAttributeProvider
6uy`
"A2-?
ToString
i3|?
-5:rE0n2
6Csn
<!/\2
/5Mw
6+WE
g| W
hC*
Enumerable
| %D
aj k
jz;N
s- s
!xpQ
8>fM)a
Jor[
8menQ[
?@|b
_If~\
kb@2
c|\lY<3
0k1
O ,/
ServiceBase
p Z
Wp/gt
4c-o
|:HUD
USsx
W\IY
] M
W}5c!gnSa
D+YtJ
Jy9uF
0),3
rQx`
I.LY
@zGZ
o(e|M`
R0?*
K3 2
uV+8
7KgGk
as&(
S;u,
###S
i xe
U3nm
W>4ef<
`_CE
u+s4
9NwL
tLAGB{$
Usj]c
~K,C8
H`x>
AssemblyTitleAttribute
{q"l
!3 g
YC`5
(k t7
b[pt:
hc|f
# 5m
MVbr
lx1%)[)=
8~2*D
"7$q
MV 7(
6=d_@_
L/LGz l
X^l#
#$p"L
5%H%735~'
}:?a\\}
1k `
[ Y2
-ZX5G
-\0|T
!orI
vOcy
gc?T2D
9H`3h
A8*b=3
9JkG
tdY
P7u~g,
+v{qd
zqq><I5Z72d{
.ABI
Eg&y
`9Kl
(s%b%
%<vD
C\yc
Data
~K!X
$;hu,
x|GYy
P,iu
zi3W
b=,9
+#^Cwo
Enabled
yxNC
(d+=
(-+h
RV2
B"
6.^V{
zwBG
8bu#x
.l n
U|b[
@^ j]
Wl<rS
Z.Q3
q &&
US3K)
/S(
Z8e~h
|ck
XV_D
V)<zU')
pHYs
.ctor
QgO/
$LQI1w*
@ m+
wz"O
\@CC5F1
(D>b
5*wkE
_u}0
L ~n
amZ+I
vv`;J
get_Message
|']3
:# UJ;Mj
`E^^
U:h:
4 8
a-$c
+M E
$'v &1E
lUykx^
?7uQ
`Y_M
<V_8
I].i
'u;7
Main
(z{
Rq5f!?
+0~
!#PP
t<;='
} =Jdr
T 4L
>aqN
ey,e
5S]A
\<D`+1i
XAu&t
.FLJ
3`0b
"){:
e*]O
` 7j
sYBC
5|\\
N23`
_OMB
V8 /
66Vh
Ww&A
Container
6 XQ
zgh]U
e`Zq
(+5B
o (P
(H0dm
4~gV
g"Zq
[rX~
T)sU<
i?$.`
6}Tw
{WL
MFR1]
Array
:>sq
get_Location
%GtJp
l"fB
{VsEB
UCul
0IY7
bNYMW}p
;/K`
@.reloc
IY<e
}dnR
0M @
fv5*~(
g|'i
Gc@x
cl;D
! 3 Po
:^ ,Q
oG 4N
YNba
TGLV
"JJH
)] ]E/
C7M-5
5{8wM
|*nL
J $U
7{1+
X |E
I8e;k
TabSizeMode
h-;+ ? !b9
Byte
d>?^`
&e_7
)dPp5
"T*p
_wa
\C2H
;tS|Dz
bTMD
lvn?
XoId
Gn5u +
^ME 8
ITBR
Qv{&
; 1\
+Eql
(yml
Db:p
^xcn
3f))\
ContainerControl
Y0NS$
x?Y6O
!wr6?
^C7Dz
6;th
Ki[
yG@a
5C4Z
k:<\u5
Ykp^
Ma/!Mf
i {J!R
6G5
x`6A.
0auv^
4u MGhx
7b!ec
h~w3^
;EW4
3J9P
^ {z
={U
tFZ%
(ALAF
O;)&
5m:'
4JI
E,y _
Y 8m
lT:*
va~x#
8Dk<')
m3Y;@
;o@5
3AwD
Q r
{!4m
Q< 9
6>"*
x-c;
N& l
).)W
buSh
IList
>6cD
9v8RO
K- 7r
YK&z=f
*g
iZ<c
AUS9{
B Z_
glA ?c
k#|hK
}'jb
3PV
p:RQ*~o
5+UP
poP-
.Gg=O
>"3
`"6~Jr
\WA69i
C?H{
i'9<
GsRX
TopTabControl
^aKi
64\V
RuntimeCompatibilityAttribute
|qWY
Pn[]
st9D[9
YQ2n
hJPOr
LN,B
/!0<D~$5#
4DvZ
/*3}n
s=0r~3eO
4/Z?
d";}T{
t'^%
R$VT
rK|4
t*/cz
iha
R%~'
W{cD
DSgQ
+"Nq
bJ\'~']
#wez
+T4a
tjZ+
J &?a
6OW>
;wvy
J^_)
zM7
l.`J
&EVbz
# :
`M >
bj_O
Invalidate
tLww
UK)|
`VKU
1h#HT
|<_=
.bn|~EpZ4iv
v/c9
xapUJ
}+;}
BeginInvoke
25uV|
4?+~
mNs C
uNwL
It7/
V@G[K
v\o<
NewGuid
YuH gE
pV9w*
cHN.1
:/M>
/o'>d}u0
set_AutoScaleMode
GU!2X
XtnR
@;`,
}D<s
92vn
ZF*r
na.Tl
JJ|5
{O3
%r }
lT&Z
D,asx
`5%k
y33@"
UW]u
F1VC
[&;~U
5JlC
,}5a
LXn{wRU
hG% ~W
7S k
n5'wK3;Wb
YwQ
xQo@
8 -I
eNkMgl
rg*jW
,QC$
DT_
G& "
DN <
(zbr
(W:jw
Tg+J
dU`W'n
b Al
?=&[
{reA$/U
3f7+
=vOIp
}t5B-Fr^o
W<(I *Y
OM&O)
ibDU
Abgu
X t
O,(,
=OwU
VH0nz
Y`lV
&_'3
veR~k
6jNZ
2'MV<
~ZgA
u 94rh
if' Nj
)r W
GSE'
x9 -f
TIH(
w$ G
%RgZ
0Gf5~
*[$Q CK
/"=c
F],Tx
8I
BGkF
#Blob
R\kFP
Control
T+Qz
U _ZDJ
get_OverIndex
X ;
fVk .
Kl[Wy
?@2Q
TabControl
_P\*
e=>w(
;t X
BI>_
v8jK
Wdk8
disposing
1uSA
%DWd^
JQOr
?%$k
6?Ir
7[ $
u Nd.
eq1q%
GKZ3
k(b7
Cursor
` ]-}-W
i4da
_tc
:[v{
:yT?4s
9_15U
]WrB~
5'$k
[raP
OnControlAdded
"tWJ0
)QX[
)XZD
oVJ0iB
%gU~
-O -
fcAN=
\I=M>
`2SH
Sr1:
.D:x-E
[Se
P|cc
t@GYK
j(>m
/'+Nt s $
f)|,7
U`D9
}*Ux
Q*(Z
j8&Ey,
u}hgbb
EXMf>
1x4_
: !
`2&r
{QV1t
n (9
#-;,
AssemblyProductAttribute
HK'H
[U+H
(<?D
BB2
#qR]g
y 0(
>"2FFb
Y0{:
c/8[
sII|b
>zA$
31 v
7 @F
VCY,
>Lwww
CNOpXI
Vdb
m4_jl#8
a;WTwq
`y?*
Z" X
Uge)m
(r;EA
M Q6
x!2C
|\YY
S~bt
@ ;w
g31Vx
$+@
1)b J
!Uil
?_oU
>G5
1&A<$ch
Jkx
MM7?=
{&~LC@
{4koW
c _'
Y 8%
/(+i
9TQHE
@OO
-P\{Ku_
d3}
?@zL
m_,Z
?Y.L(
0Gp|r
$`e1
lm<h
&Eo!
>H, _
rhd^
S 2^
RuntimeHelpers
47c%
t}R[
a(yA
+V,m
e!-B
H`z&
0%}VH,R
/Kb
KjB7
DLI&.
2Jd5
ktGw]
Mq?}s
zS NUT
F:6 M
elRy
Y 8W
#[vY
g<4cL$
Y "5)
c 05
ICOl
ControlEventArgs
qoEB
3+I`2
6g O
& !>
Q<KH.
X^rS
uw{a
!6"
8x/}i
3b :&
& #4
sj= ~
,%g
}(zb
-AC
y~Wx
9Tfr
Exception
;@\t
@dLA
$(KOm
S? =
]FH]
^1K
Yu`jf(5
d<A:
~Y~gM
7|Th
@@aU
C\jJ,
?cgLtw
]~&,
Rg,y
dQHDuX
<"T0
[/ZV
t.Zi
aP1w
f=Wi\
7u'N
.o1N
5nvT
0;2N
sL ~
djt`Pm
`Z 0
'CRH
2srN
k8}P8N
8lt$Z
1
T2Q _
MulticastDelegate
SI2~~
`_ f
gAMA
F{hyI"
XZ )DstS}B
AC(=
%cH
AutoScaleMode
6cg'
0ou_
PVQ9
$pNd
U lB
tXg\
KZ=8
K<.k
s6d%
./I-
lLVr
9#;p
7E+:
{-a{
<0)
\)QU
rBs
.cctor
;v$rPZf
5D:P\
Q|M
mscorlib
_R{<"^6
ClickEventHandler
*[J($
2tcVoA!~P
~w"R7.i
cH[l8R&
]Yx>
JvG4
)}2j
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPADLA
wm j
"VB
7Pw/
SvvLX
.xpW-X
1r%O
NCA4
E4 l
&YdP[
u#^Is+X
~n x"
66P'
0~%n
x`IY
VbV y
Tf5xm
Q}gFQ
HR]s
Guid
%r l
q-RT[N
|nwAx
Iy>Z
vvh
EA\,
X*30
f6+?
H=@F
J?5*o
r#&x
,)yG*
q>Kp )W1[
I>Qa
|yK
SoLO
>+m}
System.Reflection
E{ Y
V<[J
Nw9wW;
[x S
RT2k
]+($
RuntimeTypeHandle
Nj4S$M [
+j3v*#
C_/j<
\_@
method
en>MT
~f']
Oaeg*
(btc
&;do9
L 43K
A?"
S {f2
7Rqh
$<^\
E0(h
A2)$
DCoZ
[7$]`l
b]>\!Q
t[Ed
sender
$n!W
Y?4m
ct]6
get_TabPages
w4%x
R._'
System.Core
Size
Append
Object
#%N>
PXzF= 4
H|@
S_Y6vt
System.ServiceProcess
4G:y}
@yWZ\
Q a@
C#
xbhq
Incarcator
YSun
-?V"R
F[yK
xo/oe
w>^u<F-
Q ap
7$v=
ede#
NfHl&A@V
GI'w!
41x`!Epu
\Ed{a
hY"5~+
]ijI
l^ 3
*-se
tswk
Kf<}
bVc|i
;y13Y
JUDn
r2|>
U`RAEI
Xu=T
M(mK
juD9
%iFl
e"RC
Qy '
=NZ:%
XOsN-
9jB#
8LL
2H^St
NB=d
xHpH|H
)'V2j
z4e}
`n e
)|S`dy
j %m
X7ZV
~>>D
BSJB
Pi7;
k,>#
gi*n
EnabledCalc
~9q;dE
4(:`
CsAW
e<~1
)HAf:k X
#/$Yfe
oIE.=
.__c
S^i}
T_ X
bps&
-?5U1
^45g
\,TH
'+v;
O>Ui?
6h
g7+#
3TiD
%(}
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
adz%
,_*D6A!
*0O
(3px
'Gk#
HYyv_
N>tO
<X<
/G^`
:I)N
_Dpj
Y,:H
1lIc
)t Dc=
(?Bj1
\#*
|'=b
EMr>D
!This program cannot be run in DOS mode. $
!iGI
G^Sa
`.NZ
1'uL
W,jp9
Vi.1
^DE
.7*y
Q<6+
f#r8
V@GYK
QI8+=
97t
XfH 4
;$8Y
Dispose
uE|P
VwUN
Kd"e~
(v i
Z nGD
/$LG@
|}+VJ=
[oy'P.
0|B1
5 D:
4E2BE99140D24066CADC84F74FA899FEE5976B68
;Wv
4s n
Z%RS
LS3vk
?d8n
5=8k
zJ:0
*i/@
{q{I
?D a4-f
3z;s
H@n4
"g8@%g
&y~
q()G
( Cw`
&3]Q
DPRG
UJG
/Og3
T5ql
a0H.
omC
^MQa
g\SZ
i.xq
b(.i
&t[y
>c_)
; bR
|b~]
>z -
8 sNM
CTul$Z
RQp(C
Yi,-
}6cp
6l~D
f<QH
!eZ
n!a$
SPEX#I
L> e
7wu<&&e
lFgo
Fs~A
ZtK>
&"SJz
x|I
}TuH
15~Fz
b'ip u
q| e
y'GD
L!+C
"0Fd
78W!,E
IContainer
.k8~z
LX&
!s6a
!V6
8j}N
uwn:
!z8gaO2rW
5gV>sL%+
"atbB
u./7
B%vR
w ZUd
vqD<
K= wC
Q.y
02Qk,UA
%z-g
ExE_a
(%ov
V@1n
o#?!"
&5%u
twOM
V#>w
){Ti_
I ^.
Ua)u
i/n@
7+xL
\*6
\0qk
1}\S
jYq
KvYP
@&7B
=lL~L
Pu6>
U`-@
]7'G
NSP,
,J1O
<w P
$Q;~
3rQ|@J
Z<$iz Ww
loPT
5'47
System.Linq
7|a=
e0y[
8Kv-
|*yX
cO)b
6p'&]
Mfdq3
v `Z
611_
P:+M2
wnld
sxbK
bS 1
<8ds
k,t
8j2
2KP++
\\~|LhC!
Q0J/a
i8fQ
InvalidOperationException
E})
VH)$t@#s
uhU5
"W&Ia
'0~>
kw+
y!E;
P8]:
c)>
5y,7|c
SPH'
;9\s
|ev6
{lVG
6DZ?
`o(O
?$
aM OM
]k$u
%dV*
/[de
KVa\
^\c+4Tt^T)
AsyncCallback
gX%"
zaQ*
pZ%
O{vy
_ ??
q%o
Mb<u
_kc@
GetTabRect
|)2ql
O7<^)a
cms7"
QSD
Ev*'Y"
BU e
:Vv~
+o6Mm
Av@YM
T<.8
2)Av
&j\p
p n%
3})MRq
N+y$
VdN .
jWCS3!T9
2D`>$
N=:n
x8('?w|
get_White
? H!
@S2_
6[7u
<Gm8
naN>]
Int32
Hyg.
)5 V
set_ItemSize
,-)^
AS=Jo
\=F|J
$6ebcbfe5-8b04-4d5e-b0d9-6a98e1a0d56b
cfP
GQe"z
="nND
HI+{
<(~sf
xN2M
m t9ko-
gS!6
CC5
0[Yb
kK;F
W8tU
`*!_p
Za58
<_zC-"
m q!t
MethodInfo
TyA5
dH &I
@eti
QvE{q
I20#L
uruw
'RI1{
cbyKd
Sdl_
*RT0h
ztu4
e5r
kPB&
.t}c
String
ZK/gsh}
3R#j DTu$d=
TabPageCollection
j:y!
*_So
1tEg]
3,Yh
KL;;
Gm0H
cl[SN
#6]/@
Z6OF
=MT}1
o)F(
=I-R
)+Xj
)C,
\+Cf
+4 E
_1U+
i 4.2y
X]W0}
$?@s*|-
{wK2E;
jv%a
BTt g^
0Y2W
wvYN
M 0H)|
YeU7
zu5 X
gS]
U`bzW
#>F'w
wo:
<HU]
GeKn
0=K]
Br&s|F
7Pg/
7B8g
U"Cr
Il,T
/:58
4I_)
add_Click
)CI4
J!Z!>.
R")
w vI
OJi4;
sDD67
N;TQ
~\l}Et
eN||
Q0]y
z;CZ
IUXO
v\pv
(G_M
v2.0.50727
(I-,=
IEND
x0vA
Gm\D
2E9A
= < < < < < < < < < < < < < < <
zxY7
,'!R
+zd-
a@lR
&i*4JU
Xrhl
D52Q
%1gV
A_/%
K rsc
*: '
.*F\<R3
CZ{*
*XS7P
;OwN
>@r?
-fjo
!r]?
'fw<u
##=S
QJlg
h~~w
NZ\{<\
B}D!
H{=D
eE@6
fy-!
() %Gw
8lz#
v"hz
LS%?0
4>kO
SjP(
CXRW
gdG
w~jBM
ziz[
-)|%
]U(]
t9?(T
AqKO
DB 7
pq({
<8$Tf
d_Z$K -
ItemWidth
_|i}w
?!ld'
wG/x
=wR[
yM!%/[
&WS,,G
9L[S!
BK;#
y4Bi,
+#9f
Concat
l}V2
FjF
StringBuilder
4HJJw
Xps^
2pC[
p7_4
ls=|
_V{H)76
#M$ SK
MrSa|
YH R
"SH7H
7/f
^abc
N"Rk.
QhE\
a+q)?xc3
2ZQ 9|*
2TQl
mY+9
jhIa4
U%N.-
weW?
z w6
qbnK
2As;w
hs<h
B.'e
)_q-
*pUF
zA7"`
{H156
!+ 1
get_Hand
.+hp]D
X5Hh
0'7`
qh'(x
2>S
@=N:
ae`E
remove_Click
[4gG
Q 2Q
hSPx9
g.EY!L
IAJj
MGfp
c-?4
#^c|
S@ O
uuBA
r'T"
y!B'
L]hu
zI<+
h x
+55>
AssemblyFileVersionAttribute
kde>.
$[o^
Zhf=
jf ty3
System.Text
N S+
$G2
X]I)
) JB;
_&,G
hc*`
,r@,F7
b'\v]
U?t`4)f
8mNc
tKKww
Ie[
cT`f
rND!MY5
Gg%1U
Us`[
&"P%
o"knex?
;$~}
4#!n
W1{5
?hQ*+@
CompilationRelaxationsAttribute
=)dn
:,6^|
szGn<
Hp#M
-4/?
//~o_
#%tj
?d{8jo
I.{S<$
GnC+o-
/Cg
6Xmb
!c|++
r 7 M`
L[WB
pYVY
/0CnL
S\Q+|
~Ymw
M,JsR
=g}a
jXYI
5#(*q
T*m[
Sx|
NSnr
X<Jb
IWin32Window
C95\@
p! *
-dpc%0
>#
G"d"
A*LI,
V'xGm
<K~}
0a0^
]z0V
yc$ W
+rw`@
XV!:e
}G&b
.{JJ
OnMouseUp
;{^L
GdyLn
fb_q:
dd> |
Ysi1FBU
/Ly-#
%"yMm
jXls]
p`|e
_CorExeMain
|`'v\
_[wUi|^
!v\C
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
ok X
bai)&
~-p| P
3 V
#<D~+t
T "6
hh]Uu
K5oB}
K\[
]0EC0~
% ,
hZl
InitializeArray
u WR
YDod:5A
NUVH5-
A'4b La
5 Rd
>|Or
q* P
lq8/}
Qx,J
!&KKD
q/Gg
ToArray
/ T_D
CreateInstance
cgPb
73Wb[
a=%r
EJCSq4
AQlg
Rpea3*
<A(s
IEnumerable`1
} 81
>C* J
hu\,
U@'}I)
<*_j
YOS{
9_`a!
:@aO
/&TQh
;,}R
p,|5
M kQ
`HPsfr/-
Cursors
CKCe
Zg7O
System.Drawing
GAVH
m3j ;
}A41
get_Hovering
xa'L
8]gQ
";={
snD
cgP
D~6daxv
|
a6C9!G
K~6cv
BGy}
>G5 g
6724`[
zRQ5
Load
WF[I]
y;4c
\-(`
2d 1E
U<{c
V=.O
VBBo~
lwNv
=)xX
3vgE
} X
3}PM
,j'b$Y
qPov
i'o0
~InCCR
gza(
`&h.N
QM2S
&t33
`PYUA
KSv[
vKR }
$W~hd)!
:PR\
2;W0u
wrX:
G1n.
!~!I
]4wDtZF
^U r)"Y{7C
6@}._
~({V
G6oX!
/R^#@
-8xA
g0 |0i
wwRC
WWn*{V
j @JU
._JU
<sKO
ZW7$
`2
?8Bt
62:B
.(\s
"\#8
OgkE<
RMP8J
4^-6$e
!D-m
"{I=-
t9("
_ tv
yO+>
z*M`
g2JFQ4
*\ln
UserControl
:$,\[W6
get_Enabled
Hx)a
*fp(
b,vQx
a)1L
ZUM
n&b@6u
1[&c
On%&.D
l rB
&\Y!
]$avk>'u
sz t
nqm
..ti
[cb~
ng44
?xR8
@j;cm
~"M
z dL
:P`z
V;'S
c9VB
R6p!
#9"&O
JX e,
D/U6{MP
{4S($|
ComVisibleAttribute
u\_E
Nded
b%qI E
R*`|6
8a< c{C
''W2
l [uW
Dct1
KTS>
=wEk
#w5*
YVZF
C8]F
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
U&m>]J
Mqqs
@.AfK
.A#jR
M(5x
G{DG
7' ]
H9*[\S|J
lX#|Oq
Hc@(
KwDR
k={/
H Y0sc
~NB/bz
d%5B
k7.-
kbzs
AssemblyConfigurationAttribute
[i<=W
'w-
.y{6
e<rxX
P#Ypb
G@XiK
#?8t
ac:o
YUl8k
P%KgW
Q {Ag
3EP8+D3k)
OnMouseLeave
KcEa
DI0<h
Dbj
8[_f
1N3Y
E!Hk{5v
w]b
2"g
a7"%
VIGSX
oal9
Pq9W$)i
*/PkO
Tw2p
e~]@
,ak/^p
IR'AN
kE<-
Bd]-
=fR~
j k
wm|HEa
U
{y"
"=t
Wc35M
1}cLG
9,XM
3 Pq
5_uH
sRGB
,YCM
_A>n
y XV
r-d@
LM)MK
)=lq2
>ka{
=z,
CreateInstanceAndUnwrap
1YQ;
*\'l
L(=[
get_Control
?s91
baEZ^mtu
o7(
u9(shbZ
ZL 38+T
<gRKr
w~SC#I
=Tr
P)M,_E
vjF,
qhg9+K&
;d4
mcg&b
add_AssemblyResolve
Tw@%{I
@y /
~:si
k je
_,
(K4Gz
' E
8ZIZ
^ d# $?
54h0
(GOZ`H#0`tH
<Rqc
' Cz
Wk !5'
%%DS
7 ~MNi
r.OSk
,%G4fR
u8QK
e* *
M%yS
1.0.0.0
set_ServiceName
R{I~
Gjxz
5@/`
&r^m
#}>
KG3MW
=_[T
CE/[
a!>l
t&{|
6F4
3^3r
cBa<H_+
e3sN"1
0pTW
(:o/
jkG%
\~I2
3^dC
t f=
u 6U#
}3i/
c"]j
a;Zn
*_k|
!uI.J
zx,U
u*,:
`cTG
%H9>e
p,*,
n+UU
&0JD
+BNi
MJ:J
!9&nh
6KD jM
~kk/E+
Ark.exe
T =#
{4zT!
E p3
m<~/
=9]xZ
%f[f
W @
k3Gx
GVHtp
U~Nr
callback
Y%<0
'8{
j#,""L
[D$
^<oM
~ T
S19B
|ae0`.
R1LAJ
t. CO
W Gs
q<'"z
h~@B
m@6\
ResolveEventArgs
{]!%/
mH7*
ZX@Ll
I^1E
4mbi
@UV~(3
1S<(l/
-(%!J
{ve]
bJa!
[N5*x
Tg{7
0U[v
Y{3"
POz@
L=]U
0@ZZ:
/O<3
X;AR
q@c+
b]d
!PN[y
{2L`
Au*
D5m{
_y cv
Rectangle
YP
G:wH
iGO1>
x{s F
WAM:
A?V ?
pr:B8
%,7>
3YCm
0[Ee]
Dn\4 oj
d9f9
5r=,
>ghu
0'12
1_5;
?(=O
A>1 H V
vK7o
]pCkA
'3F@
4NM2_
9 ?e~{9
{}E
>G0
y%R2Q
q
Pu-Kvt
3*zo.Z4
LY^8)
0)%
Z+1Eam`
M&_y,
sVX
6`bmtF i6
`u8/QB
=v?1
.S- 1-v%
c8Pv
b/NW}
byD6
84C2h
98%Y
%-<&
xOp"O
O'blC
ZY0
L."c
$PC`j|
DisplayNameAttribute
C.k3
v"N4
JX`=f
] Md
[$}W-2.CGw+
7y,HO
E'i\
'm k
} {4
pCEC
N2"B
J[/`|
P2gm*|
?Op)
lWKS
o<m V
8W`8
Copyright
T'if
NMoF
QC5&
|jli
QD2Q
^iHf
5iP
a 1
2F|{
"@`n
*8l$?]
)Nl}
AM+{t
Point
*rCP{!-]>
AssemblyCopyrightAttribute
'q#}
!`y.
T& y
c]^<
zaE|
|/8 EBCa
\/<'
?p!R
?)h3
$,]3.
ib
j =
.qTIt
-U R
co%8
kf<mc
Fetm
',=3m
piB#
Eb2p
get_Default
WY7fK
w;3]&
vTDiS'
Voskghe
_@/f]
I:"u
MarshalByRefObject
5xEi
xh|0
R!P~&
KqQe
OB~[
RXVxP}
4I_(
G{ L=
Oe^yjW
/} S^V
v/sRY
<z;.J
GxDT
1n$f
[koY
f>LY
7zY(
Y|Q#
)b-
vzR3
@Y{=
J-ve
fnO8
LeftTabControl
mj uv
=g*Cq
*ad[
GetTypeFromHandle
IAsyncResult
TpIz
,okA
g,_0]
E{kt
.nJ7
'LRD
][P'7
EC+,
I{DX 'I
`w;[!
qJE 8
yJq8
fRa
_*mQ
obNt
m9 G
G]4Q
' A(DC
B Ur
}<<UBQ
g6_lm
mST_
>JmV
Yr;R
Nf27
6sAy
GcUM
get_Count
&`O%
V'(a
:.z^
;F@{N
h$y7
Uc%&&
Eg?h=
Db2p
EwXC}
om+eyH">
a.62
zr`T
wi6vCE
gXk0d"
Udh"
%r l=
wZ@dk
b{[z
D5ZL
#:5=
/4!?
%Uvv_
?j*(
17l?
get_X
6($L
#6+V0
3F1764884A245F1B3FA91DEC2E25339F23787561
\j>l7
yq 4\
? ,oz[
OverIndex
;3bfgY
~IDAThC
Ur;+
7Ha{t
zWJ
Q-T$.
*f>~X$
Z`J]U
D,!k
kpDp
Y,xm
{6>
_[`C
;P o
LG64_3
(k_H6
rsG"
gWL[
P<tzy
r)7Xt
w%A
*EE2&
5B #
tv>v
z0lU
7tR/8d
-~U|{D
88-.
.98"9
V_cx^\X
!l+T
Vb!
V@GAJ
[](k0[
System.Runtime.CompilerServices
6J'V
f"e\<
H!\p
Ruv6w
w8o9
{gP$
[w )
VeZ
SuppressIldasmAttribute
7d%m
dm)5G
5zf$!_B
l}8
/C$
WC.^
+Y?%VWW
5~ =
?Cls
DuX%
V|_"ma
QJl.
\LQ3
;jY!
l B
zd`t
o}M[j
=9 3
@> fJ
[}7O
_<HkF`I
5bX^
>GjJ
BaZq:n5&
|IDAThC
:Z!#1C
s&nf
^eY~X
qy8L0
d :h1
K3~
TAG'
cy|T
j}:C
_ yo`_
"k(Lz5
Xh.c
/~&AM
|;|}
set_Font
\_Ej
(@$k
c{B!
j hgU
7CP+
~KNY
>[9
OB~U/
o)h'
omV
>C?l
7\1_
D`%|
IDisposable
; Gk
#v(~
rpnN-
%I\{V.
4e
TW~lr)
DPs_
cXmQ
yP(~
-Y`B}JV
Fd$e
QX`f>
n|;&
!cWy
f^~S
c|V h
.hD}(
ec'(f
S<YXJ
R3Z ^
{c;u
4%><
S,.?
( LC
hrY>S
TbF]
zDE{
]@p
H; z
#\W
8+] 0(2&
x (^
-P!p
. 9P
,m*3
M|t,
| l[
zjG ^
u!Fk<#
>[GN
kI,q
W7f9
qO&'
YY=k-
+Vs_
<Module>
+R=B
+t6Z|Iy
r0sM
A? ? ^
&VA
M6VD &
~^i
5Y z
'mYt[:
EZRT
9@sK
L+Q+
N}3{
%o22
M;.
xyWi)
^Yp>
2nmw
hl'?
qQd4a
value
#S\O>
1s$
=9X`
#=:G+fq)&
|cmH
cbP"
2018
Sqo!kx\
rEN"]rFA
4I[+
k~;W
FV~Y
95J\l
#c"`
JXF;
b(z`
k`nu
set_Enabled
8H]
=FKR
5aPhE3
6555
eKlsu`
cq#N
>xZ!%
MGv@
2[1a
9k^7
kX -
!o&N1
cH#v
BqD
~{m<
p7?n
?L3K
}%#B
"[wzP
T \S4:qw
}A;r
JDB%x
`(Gf
+Xib
b`2e
eARN
9.HR
, sA
Mlq2
]"Iq
bWC:
M1"i
6%cw
#m[s5
I1]Ms 8
*4z=
$F/a
Fe\b'
N"M#
]dh e
8.vHA]
g`fR
wQft
T/zi
?^j\
mErq
piB%
e7'"
xfof
'-y!!
7BA+
j}o@
HHaM
s6b2
IM+B
f0n
Ark.ControlFolder
Fk8?
&.hm
Font
C^Cf_
{3O
&b@v}
Mkqp
J5E6g
; lT
CH0jR
Y~s-
Y KbO
tHV5Ii
lV,Q
4P6$m
+TeU
<h$4
O#nl
:K@l
7L[
w cs3
P/%SX
$ [3z
l9OnKc
)]fk0
y 9h
Lb<<
N |*
o-~j
z8*I
/ST4h
Y</\{
tlh>B>F
9TghI
kjoq
=Jx
_$V;b
7 !]
l]%F+
6]$ c$
tA[_y
1t?
Ia9
M<l`
k3Ek
QL2>
iSR#
OJMp
6&A}
H on
U'o[-
kFbE
z#dh
7kd
{T00
ButtonBase
@GYK
xa1: QW}
u3e$`
1$,.
78[Z
y@u,
]/,g1
2 Tu
/O^u
,m:8
D]$=
~yi{i
"VG"
xn!]
O9E,
ygLy
F-$'
0WE~
QF2Q
TabAlignment
[CBM
gqgw<
@tW=
}D{8
?:=pU
*a_]
6 W`
Y(Ix=
<C=d
w m
aMe$
U$i=[
5%>y
Z>Bw
}_C+|
js7
SZo
cNMfN
7o$P@
!Nt\
h&W&
sY#
.$1duT
tH8&0
S;!}
j#*>
+a<^
CO= < < < < < < < < < < < < < < <
xIDAThC
@Id/
2We
x{N:
[ V!(
&>'S
QXU?%'
E
8|I?
pXE6Z
?F 11
VQ 5
System.ComponentModel
-17h
c{ *>
9~mE
PiNv<z
,#S}R
} k_EX
| a1+w
436534A617CD86B8557AEAA31D433ECFF38B112F
>L5E
N4g6
M\qB
[4@e
?P}>9
IDAThCc``
z^`[
$rgc
bu_'J$ck
U m/(
9qurV
I%5r
mscoree.dll
wZyh
x\Zx;9
OO tz
WKvOqA
ftr\C
(s"$
N#a&w
: on
C648C0E55DD0A71600A3C979FEC05C180303B2F7
6& j9t
f8K
QLw"
sD281l
{j>>
zh]42
'l ,
| `)
X}bq
lYx[O
x]{d
+XLws
9s_P
System.Collections.Generic
1/cV
#J5I
2M'bY
Es| Q`BDY
0C/h?e
xt+Z
. l,
= M
5;E`
J vl
FGM{
`7Lz_
1$0fUl
-7wB
System.Windows.Forms
set_Cursor
)2/
m|xR
9^X.
r<$J
gx'F
kz,
".[K
uA[
nu X
HG.Q
^o.Z
3 /tw
|jFD
6 g$mz
WriteLine
Mpy@@
ilXI
System.Drawing.Bitmap
CZl%
-P ~
^qQ4k
m5:#
.rvx
]i9C3
>TF
RtzZ
v.H68
Sk!Z5
?^2;
SetStyle
(E>'
`-C`,
nWT0
ZIQw
> 1\*
3XXW
+XE+ \
ay~I
} #I
^9H.
`^(9
%OrP8
[/3
N"1w
zTZG@
b#F
FP4J
_U {{
h <?
3_oo
,>RC=
kxF&
{Fjy
g$ed
yS('
ewT6
/JbIf
Eb3p
wM
VV@M-g
fG F
sua
Xi}&
B4!X
Q<UT
`wn;
E&9@(
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven03b_64 Seven03b_64 VirtualBox 2018-02-16 18:38:51 2018-02-16 18:41:45 174

8 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven03b_64 Seven03b_64 VirtualBox 2018-02-16 18:38:51 2018-02-16 18:41:45 174

10 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\man.exe.config
C:\Users\Seven01\AppData\Local\Temp\man.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\man.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Users\Seven01\AppData\Local\Temp\man.config
C:\Users\Seven01\AppData\Local\Temp\man.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.INI
C:\Users\Seven01\AppData\Local\Temp\cac31fe1-9965-4d5a-a87a-0e74005e0740.dll
C:\Users\Seven01\AppData\Local\Temp\cac31fe1-9965-4d5a-a87a-0e74005e0740\cac31fe1-9965-4d5a-a87a-0e74005e0740.dll
C:\Users\Seven01\AppData\Local\Temp\cac31fe1-9965-4d5a-a87a-0e74005e0740.exe
C:\Users\Seven01\AppData\Local\Temp\cac31fe1-9965-4d5a-a87a-0e74005e0740\cac31fe1-9965-4d5a-a87a-0e74005e0740.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it-it.nlp
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.INI
C:\Users\Seven01\AppData\Local\Temp\man.exe:Zone.Identifier
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\Ark.resources\Ark.resources.exe
C:\Windows\Globalization\it.nlp
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\Ark.resources\Ark.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Local\Temp\shell32.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe
\??\MountPointManager
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2492.6042609
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2492.6042609
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2492.6042656
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe.Local\
C:\Users\Seven01\AppData\Roaming
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows
C:\Users\Seven01\AppData\Roaming\Microsoft
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.INI
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\436ea01d-d109-4e9b-a760-ddfcab98c8ab.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\436ea01d-d109-4e9b-a760-ddfcab98c8ab\436ea01d-d109-4e9b-a760-ddfcab98c8ab.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\436ea01d-d109-4e9b-a760-ddfcab98c8ab.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\436ea01d-d109-4e9b-a760-ddfcab98c8ab\436ea01d-d109-4e9b-a760-ddfcab98c8ab.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources\Ark.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it\Ark.resources\Ark.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\shell32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2768.6046968
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2768.6046968
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2768.6046984

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\man.exe.config
C:\Users\Seven01\AppData\Local\Temp\man.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll

Write Files

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe

Delete Files

C:\Users\Seven01\AppData\Local\Temp\man.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2492.6042609
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2492.6042609
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2492.6042656
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe:Zone.Identifier
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2768.6046968
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2768.6046968
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2768.6046984

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\man.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3035fc5a\375c7a1a
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.ServiceProcess__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration.Install__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.5.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\337da671\3850e7bd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|man.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|man.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|man.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\337da671\1b71387b
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Namespaces
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msbuild
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msbuild.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|msbuild.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|msbuild.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Templates|msbuild.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msbuild
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Write Keys

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msbuild

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
kernel32.dll.QueryActCtxW
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
kernel32.dll.GetFullPathNameW
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
ole32.dll.CoCreateGuid
kernel32.dll.GetUserDefaultUILanguage
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.GetStdHandle
kernel32.dll.CloseHandle
kernel32.dll.DeleteFileW
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
kernel32.dll.GetCurrentProcess
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
kernel32.dll.WerRegisterMemoryBlock
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipGetImageEncodersSize
kernel32.dll.LocalAlloc
gdiplus.dll.GdipGetImageEncoders
kernel32.dll.RtlMoveMemory
kernel32.dll.LocalFree
gdiplus.dll.GdipSaveImageToStream
oleaut32.dll.#8
oleaut32.dll.#9
oleaut32.dll.#10
gdiplus.dll.GdipCreateBitmapFromStream
gdiplus.dll.GdipBitmapLockBits
gdiplus.dll.GdipBitmapUnlockBits
shfolder.dll.SHGetFolderPathW
kernel32.dll.CopyFileW
kernel32.dll.SwitchToThread
shell32.dll.ShellExecuteEx
shell32.dll.ShellExecuteExW
setupapi.dll.CM_Get_Device_Interface_List_Size_ExW
setupapi.dll.CM_Get_Device_Interface_List_ExW
comctl32.dll.#386
ole32.dll.CoUninitialize
ole32.dll.CoRevokeInitializeSpy
comctl32.dll.#388
oleaut32.dll.#500
advapi32.dll.RegSetValueExW
kernel32.dll.DeleteAtom
comctl32.dll.#321
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
advapi32.dll.EventUnregister
kernel32.dll.GetProcAddress
kernel32.dll.CreateProcessW
ntdll.dll.NtAlertResumeThread
ntdll.dll.NtGetContextThread
ntdll.dll.NtReadVirtualMemory
ntdll.dll.NtSetContextThread
gdiplus.dll.GdipDisposeImage
ntdll.dll.NtWriteVirtualMemory
kernel32.dll.VirtualAllocEx
kernel32.dll.VirtualFreeEx
kernel32.dll.VirtualProtectEx
kernel32.dll.Wow64GetThreadContext
kernel32.dll.Wow64SetThreadContext
ntdll.dll.ZwUnmapViewOfSection

Execute Commands

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe 
"C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Templates\msbuild.exe"

Started Services

Nothing to display

Created Services

Nothing to display