MalScore
100/100
MalFamily
Malicious

chrome.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 13/66 Related 2376
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 313.00 KB (320512 bytes)
Compile time: 2017-04-16 06:15:33
MD5: 1efca8245d8deec9a133a2a12d7b10cd
SHA1: e35bcd275ceb1a1bdcf041dc7e152abee4a5626e
SHA256: f47e18c0abcdbae1f028618094b19b5b3c49e81ac9987651698c86bbb06022dc
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 5 Tc| ,t8 .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-01-24 14:06:04
Last submission: 2018-02-12 20:06:21
Filename detected: - chrome.exe (2)
URL file hosting
hXXp://wesleymedsupply.com/Geek/chrome.exeVirusTotal
hXXp://[www].wesleymedsupply.com/Geek/chrome.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-01-24 12:15:04 [13/66] VirusTotal
PE Sections 4 suspicious
Name VAddress VSize Size MD5 SHA1
Tc| ,t8 0x2000 0x16010 90624 64519b3e4944e223c6b0d57ba15f4676 8348be8f24c6762f54d228c4d2d66cc972812c10
.text 0x1a000 0x37560 226816 98b92b62024c41d51b24f74ec21dcd5e 2700e46a74918d189f6ef4cc7327a7292735e582
.rsrc 0x52000 0x248 1024 2701c1fd0896dd71c770da6eb7602d68 5955eeab2426afbf87288690fbdad69d38c6c32c
.reloc 0x54000 0xc 512 1d1a4ba68a8393b770a4297b45338c71 05d9a0d50227b2686bbe4c954c82fe96889823b5
0x56000 0x10 512 42dcdd294dc3ec0b2503752ee404bc01 949a2a65458cc6bd057456a18bb3ba562d0fa903
PE Resources
Name Offset Size Language Sublanguage Data
RT_MANIFEST 0x52058 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
No Meta found in this file
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
No packers found for this file
File found
FIle type: Library
KERNEL32.dll
mscoree.dll
IP Found
No IP detected
URL(s)
No URL found 
70f8f8a6-3bf5-618
70f8f8a6-3bf5-6131
70f8f8a6-3bf5-612
70f8f8a6-3bf5-613
70f8f8a6-3bf5-610
70f8f8a6-3bf5-611
Q8n
70f8f8a6-3bf5-617
70f8f8a6-3bf5-614
70f8f8a6-3bf5-6137
70f8f8a6-3bf5-6136
70f8f8a6-3bf5-619
70f8f8a6-3bf5-6127
e2c4a01f-40b1-9d
70f8f8a6-3bf5-6135
70f8f8a6-3bf5-6129
70f8f8a6-3bf5-6128
70f8f8a6-3bf5-6121
70f8f8a6-3bf5-6120
70f8f8a6-3bf5-6123
70f8f8a6-3bf5-6122
70f8f8a6-3bf5-6125
70f8f8a6-3bf5-6124
I4`
70f8f8a6-3bf5-6126
)3S
70f8f8a6-3bf5-616
04913297-c0a4-71
70f8f8a6-3bf5-6134
M7f
70f8f8a6-3bf5-615
bc4519c8-fdeb-062
70f8f8a6-3bf5-6118
70f8f8a6-3bf5-6119
bc4519c8-fdeb-061
bc4519c8-fdeb-060
70f8f8a6-3bf5-6114
70f8f8a6-3bf5-6115
70f8f8a6-3bf5-6116
70f8f8a6-3bf5-6117
70f8f8a6-3bf5-6110
70f8f8a6-3bf5-6111
70f8f8a6-3bf5-6112
70f8f8a6-3bf5-6113
70f8f8a6-3bf5-6132
70f8f8a6-3bf5-6133
70f8f8a6-3bf5-6130
S1<h
r~+=
{OGX
mdp
'WCn
7X~Y
s/8
&'Mr==
--\u%aT
AWuR
17vUJ
Xo@W'j
QFUH
$V}KP
1])iq
15$bs
H26`z
9,3n
6;yK
,
FV4x
yf.C
PWV>3y
Mffc`U
z4%e
PNG
fVR]
ML6
"fH=l
>!D
F%DqD
.H-,
_Y?Z
D13%
ekm5)
lcx
h|PM?
imti[3
!I$y
E>O@
nB!c+
}E(<m
lz2'
SR3.
7>-:R
U[lv	y
Ynv^
Q. #
;5R-jh
nV7)
"nv
:J$Z
)*('/
~AlZ
.[JC>Y
="Z$
j(
Qf
h[GR|
$D=h
x	B$
-H|@R1
|mLF
,<=
=6kc
8O,KXm
F0|<v
)-s1
dL%G
Vzux
))a
.SS=
kjLLww
BQ~C
GM`K
h38
X"g1Q
D!E9
C;&
7
g^z
D#\_$$
:GmE
b!i4
x\lQ
8O~c
%`v_
evL(
Mv&q
l)H>
Q1|g
r?A%
Bxr'
U' j^d@
10X:t<
!a18V
S+	b
)[gu3cW
B8wC
+"3(
Y
yf
?ak\
/irB
lB_
7OB0"
Zj~&\.
+9s;
qK+0
yT #
=v%xh
<sp5=
hy5t:
Q*Y4>N
Xw$L
@n\2B*W
P_e
/
!^
jRSF
}yL:
bJrl
/:y^
kUw*
V -u
4_M{
cFrSx
[~&{=
(]	+^
tK6<;"
oS:C
Kq,J
t?a@
Marshal
bWPm
aa:S
z3ha4
mI)q
fE:H
<6A
fX[/,
KO9w
}w>(u
*QUX$W
*	AG
^
V.Q
Gyr3aF
EU;,
v"m:
)VRA
,J2)
Gyz/ExP
s|o~|
S\jkm
.v+y
op_Explicit
RuntimeFieldHandle
{0S>>_G ~
gd?]d
School Project
j~\^
~
vf)
I.tT
b)MWt
._
<
$;is7
D	m>U
mle2
i
>
E	9*^
a:Qk
aF0mw
hC)_%
h?wcm
;&a@
\-v9
Q<v9
P\
D1P#6
Ce1E8
!5N|S
"^o{x
3ybrr
z{<M
$oUBxi
Gv4O4@Y
r@VK
2Na
l%^Ro
5"du
[#4o
b/:
@4!b
%i_0
[ke
a.Ll1r
''w>
!=a*
vv3?
$eu:
U1d2
~4e6
\J
U@DM
I~<[
/PQ_
GVtY
iYT,cx
)z,t
FTQ}
vf%N
X`]c
eb/8R
7.c8
N8UQ
vB5;
*Gp
>=rJ\>\
AssemblyCompanyAttribute
D%HX
?1/-
2	F^
3qiK}{
")C@
"a'B
7IDAThC
(AsU
z\<KB
JL?D
s] 3ui
]1mu^
3/Gn"
:q"H
5R7]
D{t]
#9&S1
3G@d
k[k5Rk=
$TG=
N<XM-_
rD ~
GlDL:
oo%p
7/.k
{pj>
)NNBrWgz
U6y!G
$IjL
!Q8d>R
QtR[
AppDomain
C{I	o
pORf
Q]x3z
>\sT
TTx]
xr[!
IVuz
T22v
S,xt
uTZU
!w!2
}~oB=
KJ:nf_6
C)ZeA
eu_cd
'n o
9;K$ENu
Fm"2
".HF
n1'Ns
OHh?
X44u
g`Q,gM,s
2RO2
iK1S
\6 #
z4Xp
!?p#P
NSV_)
r0qw
@]u~lV
.-qf.
[PJ?Md
RC-T
!da_F
1)x-
Z!C#
i[kk
2_H:}:z
vk%m
GA7<
^LL(_
f{1K
;g*"
Ke@^
AssemblyTrademarkAttribute
0CE-l
3N9k
JgIF
=jew
j]Z{
DyA!!s)
~<B
`;9U
ec4L8
Io#"*
pX
U
F[`Z
bzC.
\vjU
%U:N
c;~$
:
Q6Q#
&6~,
higHX
8=x}v
NxP02]
Ey N
v^5
- 'fS?
WcFK
fN]j
G,?M#+O
hYU|
6<E#
#Blob
W]_`
!?K
e
^"D
2X6{
6k]:
OnStart
85L
qpUB
'M,?d
!i'bP]
\Gb;|b.q
!F@A\
v$bM,
g|Hz3
1TD^my
~!'d
%3Pc
aI_
{=<D
:U:o
r09n
FFA?
S`.
di"t6
4U<#
o)0S
S>bwf
v.6|
ivQ>
LWY)Q
Type
zm|0'5;
&+q4
-RRc
h!NxD@
TB?m
#XfH7x
8+}0mf:
+)xs
T2v|
k'
x
vvac
O^OK/
~}]o
$Z*jf
w!-bY>
System.Text
uHZ!
PH+t
'B*xBM
DGw{
+~v"3
V+|d*-
X@8E
$@se
p`E}
,hvU
}"8Z
"	Uec&
[+"L
y:
b
?1w.
j6/5
M3
@7o
bI&\
}pIl7
o=mh
|D2	e2E
rYNt(
pP	7[>
x|R/
=ffkc9
3VhwN
!~c|
[_cz
1h/9J
lCz.
<$YH5
.#wM3`=
ySME
8SZj
Char
Wx+u]":
Njw5x(
/sx
@~QW
B~H_
-cws
up7+
,NG
D)DbO
+
rV
!dci
ttDh
`jWvU$
}e<am
b.p[`MO8
{^RN
6[\1=
Zflg
P	!`
8Pl<!q
' 1h
&&_5w
tRt9
]O'U
XjW:
~]yQ
Is_E
U"=$
oyma
l5	}
6dfe4
C1eDP
dxl>
t&yfY
+FuW
get_FullyQualifiedName
hz1e
l{k'
H()`
i8~-b\
^
Y#
U<Q
;&Z[
M
V.
Qpt<
9NL3
]]$1x
]"MI
4Sc
*;Lh
5s
v$
t#%%
"wx+
sI,|
lD`J
ZA8F
v'
j;SC
n#b{
S)sRP0m/f
FYIVf
Jc8P
tv]#
2j0L
w/+]
&Kb2?
dJ4
XI
%
'$B:pj
GwN3
&	+G
m]!'
FRWvg
w%8
{_
~
.text
r!4h
)q{do
d*wp
0y+7
ZTS%
/(%=>e
FD
d9G
[9pd
Component
}58F\
g9k
<!=r
^.F;
dnL\Z`
8n]&5
jx=.
U]?N
co.&"~
ge>k
i3K6
dLp$
(qf!
`$\W
b/$C
#Qo+!
h#G#
Jw&C
iV4<Q
e	$"
s%aY
W`"
F5,"
gNXP
Q`/7
`#OI&
_[K<
3-W
VF
l,!w
H5,'M
]+NQ
kHRc
p#bWH
9}i&r
KzC5
)^c)
RvT{R
I&mg
f:E-z
?4
bf
NThg
(Om
Jp-)
OVJj
[+O<
5Gv"
V)	DL
r/ym
3\Lm
?/p:\
i}=m
dg?x
IDMa</K
Y	{_W
KSf?
4lFi
/|UV9
J-Yw
^#n}
/nrm
5V0<
pYK/=Z~
'~R&
L{4[-]
_J~
q(%N:kK
_IfFLU>
"V3EJ
3f;?F
/YF"
(.+XLb
S_p7X
%~PpA
5z
z
dUqX
&)i5A
VU;
z#s#
U0ye
-+8.
ae%l<
Q
N~bi
.%webj
^
|*X
TP6GQ
`.rsrc
5Snv
E$EPY<
2=e{
ro:n
Y4O$
@:
CX;a
R)^3
OL0B
k:_U;4
$<Gc
_\P	S
=.v2
p3{=l
S'g
R
?j6Q
^b=6
O9	U
wo{
sh:(
kernel32.dll
}_z,
x31_
9nUS
+@u	_
*G|Q1
$'`
W|,
hW9B
z08:
FgRD
nsM7
XL%S
yEKtN
9*29
B
MSC.
'oLHk=
g9`W/E
!.8b
0U%ud~g(
#>"
"H/tk
QxJv+n
q	.g
C6(\(
Lnjy@C
8W]n
+!Fi
Z*xt
>lxH
>Gq^|Z
Tc`w
?HfY-
&R(do
&$R
[d-G
<>slo
OI5`
#r{
dqvT
?y`4
iCkx
=zq1
^	"-
`&zE
Dv9z
,q
nl(pj6
a{}Z
EWC"
k!{
On?
mw9+v
2I>z
z7n`	G<&
eA|:5FN
U7k4"r
E8D;
:<K:ou@
V
N
+pD0
zX8c
NO `&)
).?t4
@L(}
UHmY
`%X2
o;|*
C m0
LTf2
'E
>
ZQF/
}~0z
2$JP
wX#z
5mSO
%zPO
vBCL
GJR
?j.G[
m@sYI
sJ(
U9;kf]c=
(
#lHE
FRsJ
9~pUw
Mixl
L> z
p2!1
u9EXA
.xm"^
r("
Smy\:
lA{~
(T=D.
R#	
A
4y
I
21Zf
V
x
@32g5p
(CVB
Y4kr
PrW@
sB	u
BmVz
74k
3H"7
6D>'*
r5)C
$X4t
3{*%
u(IY_
Oh:
Write
J mlo
-T$`u$
q*SCG
hZ
]?
D)tz
l&@	\\
qSEe4S
#lVxG
E*,8P
e\f^
t{h
0h4:
S"%4
F:O.I
K5pN
1-)r
QHTY
7)N
e<d~
8<G+
T$^KW
#oV	s
b4+)
#PYi
!x;Z52
84bd
$DZ!
OPy*
8[1B]
%~%1
kcr5
J#xd
~ +z
cd,w
~=J~y
F%Gt

jo
d[JF
~2i
,Z6`w
9tnR
6^'
}).;
3"ii
IHDR
System.IO
WrapNonExceptionThrows
N%Ak320
: hZ
\;y.`
4/Ei =
OZIZ
*{[A
>D+F
J
`^LY
UPiV
47MY
Uwf:
b=+7
0y$^
] 0l+
<"+f
-p}
4qMT
@0-#
_*Ln
~h;q
fhzK
w(fL}
39	
1
C/y}
rHao
^6xcR#.
ZV2?F
{j<zU\O
w&1S_
2<>0b<
J$u'
4Yb,
;zyH5
)d
}!CJB_d
%9
R|Arr
9}o
w!Z;
Q4rq
LvIz
STAThreadAttribute
I{/,
<)B|
QXR1
\htN
(RJ=@$
tj@
lwce
o3Y<
}B*
_r=f)
WWqG
m|P0
;N6A
Ue>b
;v=^
|D4+M
%
g^8&
jK3f|
P<^I
1mrLwwws
1F-i
L-PO
mZIQJ
kS%dn=TdW
9+D_S
)1YDU
K$Gn
4Tb_
h8#U
8mh<g
iM/'>
O}&l
d(F%
~s50!Wi
hc64O(a
T#4AI{L2
2!j0
}_.4\&
System
t,^
ac!J
}W7h$?
8m|
k~q+
fs_
l4}X
IuTB
UF%3
gw3XN
b9T&
=iZ&
p*
j
H]G
?Gcl
j
(4
Fx;q
9iZ>
0t(<Kx
e~nx],#
6T$>
d+x
h
B*G
y-O4U
cmj
B;nq
W%KM"
6kM@
of>1
qsQRO
q?_B6
CreateInstance
_?8$3
C[
D<b
uT>
tnhZ5
gF
N?U[F9
H,b
{RX
6m%|aw
.yU7
PBE
tgMj
n@?!Ud
M!lgh
MethodBase
#Strings
Tkiq
2ipD
s5bP
LZEK
fI_rF
]Ehs
DP|o
R`eA
GbTf
[i%2H
wYl?
mi]6'
K(n'
j7m[
Q/G|
ad_|
O13'
?YT$
5
3
f'>B
O	#~
.x,d
,3Q3Y
f`N>
69t&mqm
u7Z21F
VirtualProtect
_nF6
[`-^
]gM$
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
    <security>
      <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
        <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>
;o>U
_V-H
l	f-
zI}w
I6JR
{Y+O
ZDv
get_EntryPoint
.D|v%
m<P~*
&qQE#
>]8+UV
ethi
qpO
}tSB
Yl
i`
_JW9
z@c
k4m@
Pb@J
R/ Q
[-%cT!TV}
1k:e
7XO
v'2-
b'Z5_
M2f/
qb6_0
XG/d
o)GT
y5 6d
EN?\
0>lX
3:(C
;TO]!5
QmR,K
AN^
nVVqMXe
w~Q:
SU/s
OB=}
6hEi
6q<__
:&A1
H?ax
au~4
?&_	*
*u)Uj
~+
vPAZ
)H3u
"upwK3=
w=x
%AyjE
O%
=kX
&)KV
ptYD
6e\o
L*a6[
2F#%tv
Zb'M2;
J|r$
T/Kx
|Ou
o)
t#i:Z<%
<2FI
Uvoj
[>8m$
s~|!
{<2FU
1%Y5
D/99
|$$"V
9F.6
*A4=
!~[Nt
r16]
D|mf
'Wj6
X|O*
gqRF
\k
O
4Q8&)
\DSaEO
8H$l
dRz
R^	r
i|iW
/$2Q1
J*	r
?tn
Intern
M4*N
f$k~~
XlG`
jRW1!-
'joC8
~'6!h
ae~E
A-__y^aT
!liO
eC{1
Y~Ks*Y
j&n}
@8cIq
;0)nmA
!sV]Y
get_UTF8
E,bX
Lo"wk
WI!^
qIE3
!5<f
}pS<
NvD+
}n"_I
lH7
i
4a,7
tV@:
AFH4
Kz={
4AY~v0
*$C
ONE,
G"V@z:
ry:	3
[ht*
4@6&
Jb"O
+WY-
?q9(
4a
lsY
Cl(Wd
lz$[p
4_['q
m$BM
bk]#
9X
|Fh9@
k/N*
"%U_
Jx]o2
@.reloc
{
2HoL
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD
Q_tI
mKMa
C3=WLpq
V{OJ
TG\
&y{
>Eav
gNZ.
g	Zb
K$F0
cW&!
]x4\
N4b
KvP;<
&O/p
W~*S
[T]5
:n^ZE(
!ESQs`
5!
Y
TkW|
~yC|Pt
:M*y
:md)"3e
?hnc
&$|k
;f*_
2Y8`
vnE.WI
9ELBE
x1X_
2j
3n
|B &
5cx#6
0Wjfs
K_z+
')tT
RoB+
YL+
1}Qc
a%)H/<u.
System.Core
f%}W
hO6@
.izC
HF*U?
1
:$
r:#6N
{:|X
6$zy
z#fJ
=xCG
0y{
{sy5
qDH.
4?)U
8_dS
:#,p
15dK
!X6
$\l)
c9y`.
B:[#5`
ymp=
tCQ
?~OG
)45e
U
`2nnq
7peW-
g@p$
!p%!
C!~d
j:m4
S2C5K
.exc
G)_|
",I
O++D
'@HtUA
(U:2
v[-S
?^b
`i8F
M[$d
X|b/
.YZv
94t)
RunInstallerAttribute
79_
aE#f&
>ZM}v
;JG!S
+?a4
`Xv
c
tGu
7X{dgV
sx5/
]la3g
nT;K
BQC`=
X"6s
8a?3LgG
.;bc
6Hs)
)tm(YZ
U0e]
}mj
rQq
)
j(
WH4?^
RV1{
E+xn
1D`^
M:0j
nZ~m
2?e$
DF9D9BE3F905A6AC0428866DB2196270E2C7E8DD
get_Length
c_:/
]W@"
:=%'pZ
}(yB
DObx
9M|]
mbt\z
=%w>
ct>p
#Zh(
_2y%
p<|-_
)\yfC
1$+/
lc[B
A)dN
MC}0
*}q$
E>KX
:EMm
"7&-}
MU13
$VR3
X&l"
p(`X
};:C
Hr'{5
=My`
n56.
hAm~
3d?iPf
ValueType
!gl5>n
xeW8n
3(U
8ZI7T
GuidAttribute
|ZY
nm9S
vN0#
j~|
q6nG
E=X,
#WZni
%n4{
Y7%o&[
Y`j
Re7!
.kq?
P3_T
T2;nq
dS
"*B.
E`P
UDIt
J'qZq>
03{07
boGq
=9Ge
V|,a
2}r-p
*~]9
M*J
8{qD<
9-Q#
=2b~
kVue
"L5[
cpd~
\mzM
,r<b
1&s9g
^
I.J
m{!
bYe0(
%sY
);ix
A,Fm
x4R`a
2}MQ:c
R)<L'5
K:D+
-5;^\
H$5iO
_tsH
Deg.>
"5(`
8?3
,[&f+
G;a!
>}Eir
n/oNX^P9
!%3
=	c!
d 
a
f]^
25HU
~A=S
_v;.q
2i8~
.888
UInt32
K>&5
PgTqi
Yd
hYBEW3W
m^M
faNK
\~3a_
~N45
uqL5z
pIDAThC
E(\+2
]SaL
tsz1
FB+D
- 2C
^NS:
':nnV;
3&f[
bq)@@+
bKBS
NeG#
@ V=
]WRH
=&j.
o}'z=
fZ*#
Enumerable
uK*m
"7S+v
-""S
$-rbg

&!U
]0RE
A50D
aC758
Z
.
V32Ab5pI
mUn6
Z0W\]'#
nWsT
'-.\
2SR(-
X3H
f
#m%
kU4_
KMdr
ceI0!
6l^}o
G>}<
Z`4s
qLUN
|-N&
ServiceBase
_vu
!l&U
[DUo
^TP=
|hm%w
c2"Y
i,	{
$Eg9X
U
IX
@U&o
!	H!<
3,L{
:sD]N
toCN-
Y[P
F##g
$/	
DG(
t$jS)
+cWo
Cf/Y
B\YK
Z,_.
[-XD
n1W1
P}O+
L;_*.?
&cdH
`1Oz
yc@vt
AssemblyTitleAttribute
Te	O
c.H	J5
(9y8
5S:
8?Pn
k][
s<Rd
McU\&7
Q]8
x7<(
!=@#`
~.+Y$0
n\:"6
Fv3(
{2!
Nv2C
Installer
!yb
~4)$9
|)oP
j9]C&+,
_VfR
%](y
WLa"
ix=Q
6gk#
yP?6
mXwt
GL;
G1K
(u[3
Combine
'f{W
H,d:
v4EH
/9[H
v]HE
}F&{
o@
X
!(<a|
Mx(GiNd
l#{CH
d\o!~J
ES-]
nrko[S
9d9W
:ZxX
R_S7w]q!
o`$
c[%k
"~}c
}[lE
get_CurrentDomain
Data
gBIzB
eO>!
(h
F%s
@h
_
@cbc
[xVD
w#+
>zxb
yNtZ
89Rw
|-c.
z2zcj_dQ
n-D4)
"?sw
j
V4
_ysF
e?=3X
Z:h:
c}9p
t5r;
l)a/
^o)O
zlE
&
566O
i\LB
W7+]
pHYs
.ctor
%DiN
?Rx(
`-]P
bM \
aHLc
eFBU
a=R^
*dT!
Container
/DJr
P!"p
l!@4B
/c%z)
4P){cY
r:dR
15pM
0/Ud
Qs
u18i{
I
hLD
!9]j\
}E
Calb
YVeI
^dPd
!&r//
Invoke
\-r_p
/:]<Is
=X[m
[KU9
M<:
#<
sn]\
i'"JyZ~
:/os
JCSjA
nm53
v=wB
gVxp5
a\ew
y+=O
`{Y!
)e8)
&2f2
<"v]
.7f
F@pG
fybz
j%t$
ki4q
lD|#
Rb?n3
x!
$	}_)
([47
^<Wp
Z9A8
8zXt
OSuD
4ZJ/
y7dp
P/ya
'^	u
R?_
V!"7
Module
w=y
<T<
(P?9
-RN/
u@
Array
wrc
!#P
'+WFY
\&HI=
ZaR\
quLx
/.>[
9H1F
nAZw
tC2G
cT@]bI
a~&wG
vkFv
Z.`
W`pNO^bW
lm
As
Hw7H
Ww1j
N4N~
F%N0g
8A$q
Zk5/
9[]xt
Jj@>J
3|6
}4Yh>
q8XYK`7
.0Bv
sBD
Byte
get_Chars
8p}[
>aCp
NPkH
AS|d
>G8,
(&q8O,
C5S6
hQD1
NJ9
8b'?u
45TY
iGHy
GR4r
,1;I
%`4zIRK
o$,X
8a*
Rek=
`l
dR
YAMn-
&\
3
L` c
N}/6;
qRRQ
y%pm
*.!_
hy$Y+
~3_J{
KD{T
#,<y
PgoU
K`a#
F[`f
{nD
(5Tf
1?(-?zOq
;1/$r5Su
F1}9
M|0J:
rmGiU
DCkT
@/d.V&H
M^
pF#z
6@GQ
!QrI
b5/%
;,^{
!Z>rG
Q~Ov
KYJJ
o'O|
4Y`Q
<z)85,s
?4S/
TEP20
FF>?
Fwww#)
2f"MU
4)~l
D&4S
wN>2
2;DT_
SZR0BK
BdU|l^
`Cd6
P^NJD
{p<C
bP&p>{
J2+g
\-#z
^[4
I_*[
:: Rf4
&of}g
6#	s
,K#V
ad7Dam
yPDd
H/ic
oYkP>
iz:q)
!^7DB
%s'Q
Rqc\O=JH
:]y4
RuntimeCompatibilityAttribute
{U@fw
vc7~{
fC<6
mTb|
b=K+
pgqj\
Assembly
y<p|
MLwN
EFX&
:wdg
tT@>
o#?h
6MGn
q,FG$
2Kqp:
{ov}
.Z7/
^KGSo0
RVlc
?~,-
Rzwqe
NN$>
dR_d
XOR@
gf1/
F
:%
NZ):
Nw*H
:C&@
ftBMP
3[2`
W-AH
V+E-Ek
"I>=rO
}g
F
c	P,
W; t
*6 v_
eoxo
YnaZ
by9$\
7~[W
6*N
"Fp?orK
[!~/;
^C*t
set_AutoScaleMode
yB3]_
Y9855s
lg#
F\g;
rM)c?
~'wx
%TCO
gJ,{C
h+*x
c:N(
oJn@5
]O	/
'QIA
q
mt]
BUy*
:7<Q
bY"(
ytYB4E
T`-)
)N0s
Dl_C
(26BP
j,jUuX
j7oR
BB=3
'Me#
jM@p
9+x&
llL_
IContainer
!>|L
64R~
jdk}|
.V<`
%Kx-
I+!
C9s"
CN-
Nq{Z
m: *
!q,:
%O9f
Ch	Q
K764
YH)v
ga9H>
5oM<
kE|a[/
J|qs
c_89
jH6
U^L>
rUW'
epvY	>
fh]5]
KdiK
cDwA
IASR
[
gP
5JD}Dp
0t">
9sr>
t9g
--T,
e"
Z
p^pea<
sn\4
+Wx6
~/ps
1h4+
QoGP]
bS0l
.6SW
Lk)
T~q
F	S.
qvvj
c
{k.W
!ZyO]
!
If
{Zy LW
__ZwV
e>`.
Fl#
uoP
Lz
\L
Q?m3R;
M'r!!N
;tnb
x=:
o2r.
}D'2
Lj+
?:D{
@
( o
.X~$P
,/uI
Y{*x
yiRk
sHI>
$DqQ
R}:7/G
Ni33
Rhg)
BmZN
KxKX
^N?jsWQ
?qB&
>k|
_L\-
g@1r6;
+zcX
+pK<5
:Sh)
.06>
t"hA
9
KW
7C1985BD674E3887365E65F90C3B83F53C364394
N+]Z>
z?Pl7
8EBt
i3
,
&aX$
CiFwK
ContainerControl
rPO}iS
t?i
-Bd(
U>P>a
%,m|
=LaiVd
0lXa
u\[i
{.6X
+gGy
Jy0?
}v:J
Zfag
A%BU
*B
B
22Ozt
ReadByte
"hfSS
%fpe
a}yJT
`^T7
X7Q!5
d%V
Q"h+
^@=et
H 0J
Fimitota.Resources.resources
aP1YkV
JLDK[
RF6
.N
L
4t0R
B'8{
]Q9=
3"mB
k"T|p
aXx
kC9v]
\=7y
`7<
:)1e|
~,7=
iWKD
,xF`
AssemblyCopyrightAttribute
'A<P
T)+&")u
zqbUh
="pQ
:1|d*
c4;A
gsJZ
b;kB-
|mkg
ckxs
f^ToW
gp4$
sVH(j%L
]Dww
9o	R
Ib19u!.
(9$-
Ky}s
'@S7e
)MG3q
(-K
66p;
QVFC}E
t/*z
zS~m
zab;0
7$5.
E/EgQ
tik"
ir)f
Ss<
cMmhs
B`d:W
~"IX
\z[pq
cqfJ
OvFYp
n[yvu
Q
&j
M0c|
X8Rjq
ldtt
_jaE
kK(6
k7(-
Xj1b
\90j
7 U\
QD
/t
X%Ld$
^p:W
MDn6
d.dF
dqG
pj&gB
YbcQ)
&H3{
p:-mR
0cT1
#HnBZ
ENqhL
;aCU
sO_$
]W_$
U9g$v
`l=}$
^+TG
P#O30
HE]<(
bPON
q3hLh
}kh3
VzL~
BSJB
Kk19=A;
4*VC
/
m
?
kY
U
QZ"P
$L1`F
~#pW
[R-"i
3+gq
Z892
Read
pA.uJ
Eti&
Sk:K
/~.EW
7Dq5"
s]Y/ `J{
/298
&0eU@
h;Xk>
tJeWICTYT
ZooN9M
59[E
IConvertible
FHRn
7GAR4
]|:|y
IyDj
4!4G
JHaZ
_7+5
esCQ
4YP?q
Y'*v<=
h"k =
9B	K
#"CQ:
"w;9)
#tobXI
e,Rp
O>V+
'1(
-yiY
Ui6}
PFG
|LW*tE
#j)~*HD$P
u\=-:
Rq
b
g[*\C
6yYo
y}v-
gAMA
g]4N
uf8=
M)f]G`9
hgL
8ax;p
dfry5
:fag
9c<b
S P^
AutoScaleMode
ZTWA
ko9%wX;
E4#
hYCw
kJR
MarshalByRefObject
L}k<
\[6:
L<SJ
z)S
tB|U
$clYf_lg
.cctor
j+
/@^
f`r
`f
nG~(+
f8f@
9Qh{
L
I|u
mscorlib
v,@s
.It
$o{di
y^OH
\wiv41
.UB{u
(qR![_D
zd-B
tw3q
X0cl
9#)]
REBY
Sp;+
.xl
z{"5p<
1j'3
$.2
^$dK
NwY6aO
9(yC+
:[v
lOx;:#
8S@J
OO,
z>h,
^o_g
m%eU
$kL
*_CC
"TL`
gvKi
YyUa
/X;%
NY51
"7\d!{
J;3e
l ,r
>tZbG
5=;i
d9c/
(*J3
mX8o
If+F
tBv
]XH!
X: 1
&2])
;917r
UJT.L1
Ox,h
n1Y+
c[xW
DcH0#
c(L5
.,atkZb
W++G
f
J
ivg6
yk0w
System.Reflection
5K:6O
Eci^&
CmxS
aN
+5t
T75J
;9\O#
ER@0
GI-]
;%H+
P58T
RuntimeTypeHandle
#e4(  Jw
.mU^
i}Md
a>/R
]Dy$
T/*?
?Wh
iNFI
WDi3
Mw]Uz(
2018
/D3r
P5JX
2X@-
g;%;yS
v+g,
XV4P
\,Ht
f$B}P
Y\&H
'>n
E:sh
~Guh
v9Ik
no.
FSW2
+%lT
j]PE}Q
|_Q
S'NN
lC9A=
CTeF
pgGAL
Append
<'7n
U9i4
Go=,x
$Dw*c;w:
?[mmR
qCy
MNL3
TE\m
System.ServiceProcess
i.\}
r{hZ
e']^
%3{_
{;$F$
t1e8
f*4U=
b(
y
)jKs
?ib=
+b.)Y
}8{F
#GU.	q
SB;`S
*s1(
nfe{b
9;cJ
UbE
L}SZ
I
o~O8
AssemblyDescriptionAttribute
evCg
-7thO
gBO<Y
@4K
9Zr[
\K#>!J
oZn
v*
u
(:N}:
q(j-
f(+3
/C.Q
\4l|
]yX(B
6TKa
Opmx=
2
3U:>
rAR{\
:gpzR
1n1G
9t?|#
(IN*a(
(H)SQ]
r$~BFO
Sy&D
>}Km
j]0q
+KN:~
tP!8X
=3RNB
T
_+
R]X3xu
)QPZO~T>yx{
(W48
K}%Y
JfL'
iyq_UR>
*=ju
6t3Ao
}Y9s
-Z<:
z*(^LH@
xK v^
cv.|7
.z;@
$}-=
!V4a
zD:n
`~D^P
4t})"^
^d-j
/+l0
-_98
a2.&6[
w;]P9
y(?
\FIM#
c/VA
Z@q-
jIT1Y
hCk2
P?D-;
uc	
JsSx
lF.=
nQ@t
System.Configuration.Install
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
^i1]
v_;(
6YiKF
{-4o
J\H"
ocg
0_]^
GoPC
'SO`
:FpXV
Z
?$
N&m;|
'_!V
'ORd*t+
&/|>Z
LRYV
8P;	p
mscoree.dll
!This program cannot be run in DOS mode.

$
1fHv
qjd
jbW=1
U)f;
W@Mu
g	b<
G
ll
Jh%-
SQ{p
]C%Z
QV	7
6z(Wb
_85
1di)
>HDe
Dispose
b |({^
]{||
}w4/?e
U3\rY
Z*
;m>H(!wx
gpcz
^W/\TW
@smB0
K7SG
N5X{RJ
{Lo$
|e`E
\g9H
CG*v
ua|&
z]'M
Z1Q6
.(2=
hC&P[-
EcgKd
c+k
JPj:Gv
vC\[
0j{4
gwLnE
V@8+O
_k2oPeU
?-<	T
XED[pn
[_z/
UZU
/l=v
qsqWj0
q(;?
rIDAThC
b^r"
bO<x
KdgV
|59G
iS7Y
!ps4
L.4H
+=QX
q{2yd
Ic2q
>W0o
%o!
4@xM_
m>E
[\N7
QWEv
Nv+.
Hb;w
&`h6Z
VKFB
_Y#-9
Ul2&
TfIE
2]MV
Ws{V
lAs)
nnL3b0~
{`RWv
.Fks
[A:S<
`N
5
lj(,x
&w&[
<=p
9~yo|xj
(>)D=
Oq}F[
TB[H
~"+J>s
O7CR
{ HF
~"F#a
L=
Nd
DAnh
PG#n
Ie#=\
4Qs
t7g8mj
lIDAThC
_i&EG
'*u
W
`PJK
)6M2
|U.*
GZ!l
Xn^
D0K4
zla!
uif
8`=)=
r_[R
1D!BB$
|l=;0
IntPtr
8u`}_	e
oIDAThC
y+k|
13yW/
+)Wc
Pq:)qN
xrNk
6# HpBD
3c8b7281-68c3-98.Resources.resources
e{Q?X
.dt,d
8#w9M
,mEX!
)P:
\3u%+^o>
1IN{
6Jr.,
@@B
peM
+TJW
4R)Izr
<O6@
@O[>
24Bl
p%6%
+TxJ
-^OU
LqtD
^St<u
\O.k/
e.pZcd
System.Linq
+!+q
F.[}
5B/n
%/=4F"
]
4m3
vdaJc
nIDAThC
mL')
3Hn-j
"CwI
r("D
!0.T
ceMH
}@tz
0sWq
6>YxH
9#Cv
rP
nI
zCV
YfJ:
`$@TI
x}+k7
2nxj
y7]?
>9al
jU1v
Y.rw
(AmC
itZ-L
~xUo
Oiz
i$gFP
*6A(r
K/X"
!"<BI
Jt`(
tp~zqY
["/(Ic\
-[Kb
(>ciBtk
(8/oY
<00~$
BlockCopy
Q}z6
,}wH,?H>a0
t=<9?
E0G!
A>b!
HVW>
ZNk7>
qbpDP
ioD4
I?&L
Ag	>
25~X
pTA:
(	Jq6
sV.m
r"[ai
>	W
c'@^
OB`r
fn`r
`Z6M!
OOdl
T
J_q"
Oxb
hcF0
98
yV
1+D5
(Wxm
S?
j*
qP[]|
U]S"
Mxq<
qu"
jIDAThC
#&G8
IM\;
A(":K
3ccn
GXlu
;%e]
p.e:
!rpY
};DMW
1|aeB
-_Y)Q
vc0B
&VR
,(6Qv
pqr_
Kjg*
.
6.
J}fD
+a6hY"2!
Gt5i
Sc)@
rd+
2	
VJ
S@^fY
D.Hd
fwkV
5X|/"#
|TL.
i>T>
l0AK
4'o_
FGux?
OK(F
sD8D3
?{^"
z!x*
!.ct~
&m*\
g$b!
KJi$
MethodInfo
rxe
u/a5
<B6T
3-qe
v!Z,
^8
'32L
CompilationRelaxationsAttribute
O#-~
8}5/r&x
s;ic|
PX?M;
C-eh
ykyV
IB:+
SYnS
tScm
MemoryStream
1)d\
EeAq
"ftZ]
9`|_
||6_
w&5"
XdPk
`-O5v
"fH
;H%6
yC`A
Tfj6
Ax	s
e3'[fF
cIKU
V5g'?,T
@"l?
bytes
w]PA
VJ7f
r^5:
j,lCRk
GVR&
!s2s,
VYg_
NT<)
B_"C
"@s8
Z[MaD%
9^dt
3B:@
`2%G@n
P<}o
bn>t
B`nj0
O	xTlj
?cQ&
bak}
~!/h
(gr(7
vJ\-
]eOo
iLcf
?8|4Y
]c"
&CQ%
i^Z2
)SU)
rB>lv,
1i[4
s
_t58Yf
NCGA
|-g4
g"jvFYNS
"B0'
H`qU
IEND
e!u'
C{\,k =
hmn >
f}\T
}3#+q
^!By,
qwcc
OcPT`
1Syb
3eeb
"kYl
G(&
{/k
@kL8
A0y8
ao:~^s
#BL|
*alx
Sbb<
@v*x
?YR[
FEV/
J~rU
_`hs
O*Uh
GK{5
6PZO
G:?C}]'
gy8*
Zq5P:U
P
LS,6
W<G9
k.`<
+ (
$3022264f-521e-431a-975c-0fa2faabc8f5
RG98
p%'/
5B
O
mJC.
Jr[^
eIjE
84Q6$
D0YN
JM\
.x(A{

/&5
?j\iMU
q]Fb
j:pt
[bTx
TbIXzQ
v&PN
5\V
\-Y:!
/Q6.-
(+;!
RA/|
.90X
-|H
)E,-
l/Gd
A1
hH
{+~Zn%
E/?c
0m:_
Concat
t|tz
%PL
?i[
.>g3G
hq5
XF\`
1Ib8
StringBuilder
i*?r
U&>V
rfto0=
tLPv
Q7r&B
>rPg~Du
.#Jcl2M
d:<"
:KArV]
a.)M
S.P^
kWR
]8
8Fpb<tDs
2y*
L:)`
.xKc
li_"
o]2:
*5,
B'4dZ
H99
K	o~
E:SF#
W
<)
YvR)
HplxmN
S!Z/)d
]/|!
CiB+
Zr-E
4p@'/
J
,z
vv4
1?bR[c
|0&]u
y{*^o
IGK\
"bUm
Iyw)n
^sN%B
;}Lwo
4^'K
UiD	y
),%=gCv
"Af~I;~
:S"Yu.8
N*["
q98n
<bfr#
fM\Y
iM:
l%<
AssemblyFileVersionAttribute
fgF^_
)Ok53
bbQ-!T+
=Mn
7Z8Z
*:Q 9
rRl=.N
[2Ne
_N
H
4RD*
M	.4
N;}^8xe
P".]G1
V.@(
oi8Y
@;-2
oINM^c~
aZyV
GetString
|>Y!?
%
L+
A)'M~
?-&l
-{]X
1m$B!
2^Z
CC{D
Afw<
Wjd_[
&fSiZ
Y(q
A]
o/
)Q~
*8BI
4Z>
|aJ\L
7?kj
gt?r
{]3:3
w.$]
)<#a
GetElementType
O|[,
XJ>iVh
0bqu
L~.7
jM]\
QwPN|>
0C^6Gz
2DDK
hR~_
6@p
d(
?"F5
mM yn
&
j%
5V>C
)~4_
{7y4
")DM
(FVu
az s
!"f?
*'g8
AQ
u+z
n~Ao
?
av
/8#Y@
3_6+
"/2
FIIHwww
%k=P
VD5]5
K2UI
!J\}
NN|V
P|&S
p@_%
><i&-TW
8L#?
i]o*
clg*
?6RG
i	(
YF 
@A
&~
~l
[>y=
F.dmC
Ku]O
DH_Z
2ml?
3bgD
jbG86
,gAq6
V-+E
;Hcd
(;xBDY
QC!k
nl
.
b-r,?LqN^
ZA{/
wld?
H!u_
q<d7
+zUb
b
%9\
WZ
$HE
%'
mk=?
t{
=
b2z
B/]rQU/
$#?SJ9
4y^
4.c	[
z&eHY
D0BO
^f4Ch
String
qmAS
$N`g
/G#[
~J/!
_CorExeMain
6.dh
]3jyi
IVu]j
c_00SWK
o]/m
V
o&ZI
!Pc]
,>>HU
$!Uk
GT9f`
&Qf[X
tb
f
*1}?
g*2O
V:cb
NS&k
~Zu2
gZt#
$@^t&
F$9-
!U7o
.z~w
InitializeArray
9#aG]
dD\u4
sgc_
E_
=o
3x^W
5rAoW
mq/K
[bZh
Hh}h
a't_
znmeW
t<1kd
ajej
k1b)
|g0Q%
Lq1s
ToArray
JmvK
yz]k
03&o
Vp!/,q{
PG!^
89s&z
FVu@=<
MR^*
h'"i
IEnumerable`1
Trw
v/}
( mq
]4cd
?H>{
#4A#j
|Gw.
NAgY/o
<
b{
0mrZ
F?
y>Q!
qYA)
I81U#
}rZMK#
8e
I
cIfV}
Uy
S
Ku0]
z
r_
SVzb
z<$B]
gQR{
O13
j']y8e
5l,_
";L,?
88N,
K`68
65Wr
sl
J~
Load
mIDAThC
P>i+
m."g
s
&
n)+.
.=rl
t04i
X>J"br
-{35
B{yJP
XY9-HRS
<4&
GK2~
>6uN#<
U3HI
X(0~
/O?c
xF?
4
d#
zi1lQ
UiE
\-L+
k!,o[6
Q:lI
fV%t
qu8
=p-
FdEF
58U^
s'|m
<?%IpF
q%g
_U`P[
"F
$p29-.
+-"$8Gs
IR8|
^t'Q
~6]+
;t8/!d
'	V~
GB7 9
vVG
RuntimeHelpers
$~we
|0g>
F`:e
5Ca*
@f2
6
1c3]
UserControl
wQGo
W{$!
LQ\gs
x_f
O{#&
uyhC
X@uK
7E M
Y#.L
<W;%
!2fw
9"lpn7
t
Hw
ctptV
gI~kO
afS
e82x
)|v2
0_#2v1I=
$%]H
<;fc
+IEc
%~7+
(N"T
s38+
]Ty
Object
u\Ap
0C4M
S#	L
_WH6
z>U(b
f@Nz
=39V)
)c|`
NzN
J5>D
L<R1F
e7
B
ComVisibleAttribute
@@,D
B(BKy
sBD[.
ujc~S
5
'~
&eFF
`Ij;Z0h
u|z2
:JMxD
j=@
ZsR8
0W*,
0F"3
_8Y~
J"C;
*V#=+fZ
7DZdJ4\
}beT*
{3P9-C
7{#H42
FZ3#
7%(j]/
wI\=p
6G>\
)At*E
ah[G
dtwW
3OZr[
p1L8
d	_}1
i2Xx
i?qjj
?(w&
I:\D
6;O7
Lt,S
g]2'*
YvI1
Vtd"
K.Cx8F
q6K$
tR$
AssemblyConfigurationAttribute
x^%]n)7
vfhZHj
lg5M
G=kj
9x7v
cm]dMo;
-iJX
<n+P
zjJ
AkR!
gm:I2
|pTv
#GH
1.0.0.0
\=&Q
/;eb
G@4S
%
sQ5L
W7v_
>mS
#5_bs
twMOL
obD^
}VVIX
"]<h
3y:Om
W{c9
egkU
Sp5m:
ea[B
/vTv]
dA5B
<VYA
*of)
tw77m
s27ywl
r_Mb
cU>$(O
l7j!
3lkx
0xIl
bU/eo*
Stream
MIS^
PQ:e
1p\p
6Pe
ANHy
y(cR
IFH}KT
7")H
ZwZk
W%R/
kIDAThC
wc
by
:^B
sco?a}
xFLQ
}^>bU
wTx
@GVO
b8%.
I9@Ae#
'b?"s
2tn
q;kLi1
$M@e6
LCPo
s}xd
[lAw
G
cbrb
aeK
}/3DF.+c
/0bE7
HBxU
c[{;4-
m35qv
8Ck2
;'z]
tuFb^
.e_F
$ZAp\
s2.
%xX*
6Kn
J{XC
W
tK
(1eN
2	R
]G`3
duc4
(kexH
^5y;z
Rzih
'~s>
P8>T
^'L:
D(MF"Y
+3]H(
:|g"
\i{7
AQrZ^
g!	G
ErBK$
p	cBJ
xVQg
q<Q6
`l8YA
\hG4
dl^4
&jHhZ
^4Yo3'
@vOv
@=u4
e>U*J
T>![v
{Kqy}O
]%608!
j6(EF
e<?|
~d&Gd
8DYnK$
g,-2
Q,3
lBXR
FCunz
*p4S
set_ServiceName
bvFXx
<@@0>
xLK2H
2.zO*
PXbda
/+L`
_dt8
Y)OY
@'/,
)LXB
3R*k
9eEPx
jqr+
0x[CU
twOO
i:{_
'"A}o
7j@y
M}x[
;L
s
KBI%
MpT
"$uzo
2@hi-{
gB8
6|c0
?Zl
#zjJ
6=Rf
#fT~
M@0yB5
-o#Oo
w~6*
-Z^C
>+(~(
\[=P
^}?c>x
{0
xZ4;:
8e,
s*1W
[U}{
Sa&I}
&50Y
eKB}
l)9J
VX#4
Ku-f
gF,`
C@pp<
/lic
ebt	"
~|D/Ov`c1L)^
%D)y
g*e+
d;3
"F*VV
bN
N?
f}zl
KH.*
aAi%I
n+mw
gVzmN
;inl
yf?AE
IDP~
Kht8
GetHINSTANCE
BT\)e}
57fotMCVFc
{a0u
Buffer
]6A
~B!X
&QN]
bMEf
BQ3{
*QO2
8L?"lE
(:KW
<!"9t
?P,\n
=g[8
BD,D
vNpg
zcd
eW(G
_k
9
bV&z
SW%Z*~Y
&M'B
?g
Hb8<GhW
0Xo<
$^wv+
F_Y]
Z}Rq
*3>Y
cXn$
H\>pn
fFvy.~q
/Y7}
$}~=
&S;,
T");
:zV8b
w
iUJ4
_E<+
93./#
Jk.`
t~uO_
r~[[
R9*e&
Xz#Im6XM
+`t@
l'4P
WqQ%
7A6B7E26ACDB06972F3F85278171214EC85FA2E0
g'H)
v"K46
!Ox=
S@k6
{d#_
&?Yoja
n+{P~6
|		NM
r0<N
Fi"Eg
$@@Q
)	%O^
V61b
{
zm?z
[/'Z>P
Cnb
]0Zv
=_eb
0w~@
!.)!K(uD
~f#f
0!jp%
{OGE
6FOT
FyK
w]!\
C]W9
Copyright
s,`)
ArgumentNullException
8"y
k-CE
E)3.*
-+yAp
G]8r(
qq9G
^By,1A`E
j}%b
9 uj"
(6

$
. "w
N10oH
VHW3
?N!L;
K_d0kV
\`ILST,
^I%CY
+
Iza]#
v2.0.50727
0O3=Z
JCsT
'gm6N
D|K*
ST-x
?vVb
EE=j
N"v'G
A-`1
kmC]
B2=i
$"IETYs
@q_2
z,eX
f~p5J
1zB&u
G
"
#6sR
^)/{
gY8k]
VK
)6?.
)
k/V
0.q
4LEbZ
'4W	q
1xwD),@
g
y&
V&f/
{
|U
EI/
IB-
>pGVN3
8 nS
]$tB
bZyWQ
xvc
XX"VT\
9ynm
b8K>
D:'.\9
Xyjb
T_T|
F^z
0
(#
tw3]
*vdUz
6qC7
Bs9h
554{
cr
3
C
[9{?
Msd)
viOf
G0[v
]4Ar|
V_`S5
[^X5
SSq9I
D,Uj
GetTypeFromHandle
~,$Fc
[Yl#
~eY4
E.a?
7.bW_
|4,C
Qth6
xzI?
2%KlJM
wIo$#
:%L
<;K{
s:{}
C\8De
D+^{
5,#
L2>p}
#E;]=
6dEWIs6
Xc?
TUt4
9IGcZ
WS51/
?{FZ
#; a
N;]R
{C.+
School Project.exe
E$*5
+%ca
88>,%
u(T>
dlxKX
w(
s
$mtK
um~<
!O1!
}=l
h
Yc4lW
p<*	If
5]z5
{]7Z
.sx
rHb%(
5;)sGh
5~<T
~Ff?
r>];
9I=mc
'.zq]B
t!FY
a!b?
=8
?
A\s &
#6,&{
p.~::(
IM
d7
S'}[
H#`zR
Tc|
,t8
X?LP
K5N"
dj0S
e7*Y-%K
Qh$8#
9B l
{3![5
P?)Eue6
}m}`
System.Collections.Generic
)mA
#Hy
qE	`
=#~p16
System.Runtime.InteropServices
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
7l8z
F0r :
qC
,W
8X~rNa
`JON
bY#j50
3}Nx
LpU}#z
2))
Math
#Vwj
-Az
+4Z:
J|0!
=h^EK
l
kk
M$~Q
K,4
LY*a
M/\{
er`k
b2h
3Bd#
=L_F!g
)yF>
C;s:|
C;S6
OnStop
1;K5Oe
]_T
d4^v]
[(L7
IComponent
+9@w2l
System.Runtime.CompilerServices
V1 `
n^{99
*y.4)
SuppressIldasmAttribute
G2F>k
t[|b
lbpg
8`m+
_rs_
?[8z{
"ZY
-uvB
-I,q
~ruk
!S=?
7+[
DK!5
jv+s
GE(1
0JybCp
=JI.c
ovO(
^`eHE
OJi8Bi
* &3
h)8+Q.
N0=[
-.VJ
\KVr
y@VM
13Ft
w?vz}
v<<d
L-02
i6K	;
)"p/
ki7,
Ya-!
\L/@
(\ C
L*vt
Ed&w
\!#X
^wo)
jgI
a<C
3db
Ms??
B)vrJ6(
D
F<
Z`{n
9Q/zS
17VT
]-PK
15#7
)CX?
P0aa
bPt6
%Ot=#c ynx
~$JT)B
[(m|C
\3
a
j	y?V
Zg_<
H4U"
>qhI
y{A6
w,Sx}
/.7E
CKLK.(
tl85|
^=8<
IDisposable
D*/q
U__Z
fN%Q
!_tx
X[FR
`qQ'
_OfSQ
>[e1
27/S
-Jr/XX@`|
plkp
^[zFz
EiD2
]Ee.~
w%tf
Q4Z' |
]$xf
?c*\
ThcrD
Bd>?+
g$m"Mf
e,?'tg
3~8lv
Ey/~:j?
7o1_
yJLQ
`">6
}}M'
88nRX
(Y]N
#W{jXM
AssemblyProductAttribute
pea8
ufi&
~2cu
D'p=
I(0d
hyt
7vS/>
>lfv
0LO"
X]bh
|^i
?`-k
iHb~
N5&("q
Hl	M
hqF@
vdDg
;m6o
-*:=
Yw*S
/
~V
FeE0
agS
tpR^
CSN[M
Dp(
nsLl
42_iY
z1~
(pA-
}ULS
6y {
]~/
N ;QZT
C=Fep
[eY.S
B~f(m
cS
U
b =4
EU^t
,y.
4bXf
@kBe
N}x"
n"ja
\/@Hi{
\]1d<
fj
S
%,yP
fb8A
e:#O
iR|MA=
a S+
System.Drawing.Bitmap
?
fF71
@Y Z-@sm
;aHF
3Uwqq
:4V
m
@HR?{
x5eg'
p?*yW
EL.M
{0/4o
>}Vk(ND;{
#GUID
VR[
?~qpO
T$qd
"a7f
dS(yR
)CE?+
BMp=
MB9 (
)}<l
`:;IH
X$1Zsg
x5UT
+rf.
l~5an8Y
R?ED
Hu!
qIDAThC
!k'f
2&kT
gW,!
ZpVd
yIDAThC
%Cq4
#2MEF
&p\y
Bw5nO"
C5e~U
ToString
.]%y
S4ai
060C
uDRO
1sI
RJl=Q
x-ET
g'z0
i}wz
t|x^
%[8)
VY4~
siVO
mXK^
z=;T#
P[<)
=B=
eJpi
%fJD},
:W[*(q
5u:<r
O\dv
,{g%
,p13
XdK:r
@ZD/uG
By}w
d;7/ue
qLM
"qF\
3u&.%|e
-2O0
8<I]
"Wcc
Mxb1
#*2<|^
&cOz
--0b
QM`NV}
7Z<>EC
r.M}'
}0(f
?xL.6LQ
w<#N}
z)@`
k [0
,<TNv
]I5W
6W~3H4
8VLG
p/X
Encoding
'L_0
%~
Z
z/Hj
W-
y
+K;pv)
tnqvsG
Jy46
ZX
o
uI>D
}5}'
R[mg:
"-}j
<5S
Iwn
|Ct"
:8&(
LAHg8Q7
g6\9
ug _
Xcu|\4
\9b
ke,yDAn
?;q"
3Eoe
get_Module
/b,
q?xe
Wz[Ev
dXb&H
OPnW
f=D&
`;NC
9H;/
"XjmW
,2:NRf
%dW59P
g.o~
W!&L<|
psw;
0^}	)
fl/R
:'[Hf6
#Nn,Y
c'!
,P<i
c 008
dfsl
+?oy'
2i^^
i7.*uAd/
8	Q&yn
hI
REcL&:
BSj
|>{m
#Zzz;
|")
Q>IC
Cy1,c<
sWBr8
3FA.~
,vTeoC
IFB"
k{0E
7@qB
4B7
X|.5
xmU"
`&[v
FM+af
r) f{
X<]h
0$(h
H:P
System.ComponentModel
O6
k
E:IA)O`y
(ev|o
{KU*(
;}b`
9tw:
F

=.kg
8'S;
<wF(
mFs\
$K#M|b~
<G`$
nXR$
$M#V
IyiG
Kv]*AaSEB
m2XE
{VhD)
7Nct
"
e]l\
WtqUE
\[*l+\
i@+-]F
OyNH
Ao+
{={
I8ixU
rI^4!"
c/kI |
X96hz
T,OW
t=lXk
=\go&
zj
2
0T
^J_s
=u 6
)r:
YxO+UO
%anF8gg
oLg/
MA6i"
iV)B
?9X4W
yV1]
FQ
a
3Zl
l%Kkh_{aW|[
KL`"
(V|
X?0b
#v5f
dyPU
~tQ/:
H	'X2~
vti'
_=!$
K""2a
LzZ,xc
Bh~;1"
{p"M
Ta]1
rl_g
System.Windows.Forms
7x2kA
~;n{
&d6$
6!yC)
3@Q
i
E\c
V=H$
6x*}r
m5-X8
#hx=
KSq]
<rYeK
.~d"
ewTB
+iPh&
N[^
MR
?
e?
j(
3L{",
`:~~j
qA;*
,jnk{
`29
.@Zvv
VVH(
5
\H
t6(C&R%K
LDqK:S
LT3mp
disposing
D	x
VS]
+1!tQ)
L"dMM
jJm:uj
@b_N
nH
M	'U)'}
QbR(
tKvl
X^up
SGyp;
Ow-Is
>j([
5N|d
Oq)*
School_Project.Properties
&OOw
cMw(2
+blV
G3$(
:
F%x3FX
8il/
~L}}h
F=H;~
u"~2
gNh}
0=D9
Ed,
u]8,
-*l@p
YCt?
Q5Qq
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven03b_64 Seven03b_64 VirtualBox 2018-01-24 14:05:39 2018-01-24 14:08:32 173

6 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven03b_64 Seven03b_64 VirtualBox 2018-01-24 14:05:39 2018-01-24 14:08:32 173

8 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\chrome.exe.config
C:\Users\Seven01\AppData\Local\Temp\chrome.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\chrome.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Users\Seven01\AppData\Local\Temp\chrome.config
C:\Users\Seven01\AppData\Local\Temp\chrome.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\f02737c83305687a68c088927a6c5a98\System.Configuration.Install.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.INI
C:\Users\Seven01\AppData\Local\Temp\chrome.exe:Zone.Identifier
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Windows\Globalization\it-it.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Users\Seven01\AppData\Local\Temp\it-IT\School Project.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\School Project.resources\School Project.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\School Project.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\School Project.resources\School Project.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it.nlp
C:\Users\Seven01\AppData\Local\Temp\it\School Project.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\School Project.resources\School Project.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\School Project.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\School Project.resources\School Project.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2500.28840265
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2500.28840265
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2500.28840296

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\chrome.exe.config
C:\Users\Seven01\AppData\Local\Temp\chrome.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\f02737c83305687a68c088927a6c5a98\System.Configuration.Install.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll

Write Files

Nothing to display

Delete Files

C:\Users\Seven01\AppData\Local\Temp\chrome.exe:Zone.Identifier
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2500.28840265
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2500.28840265
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2500.28840296

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\2952dc8d\cda344c
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration.Install__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.ServiceProcess__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.5.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\4adb7724\5b6fbccb
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|chrome.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|chrome.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|chrome.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\4adb7724\3e1eb9ae
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Namespaces
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Classes\AppID\chrome.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE\AppCompat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\DefaultAccessPermission
HKEY_CURRENT_USER\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledProcesses\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\53F8FC76
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledSessions\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\DefaultAccessPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\53F8FC76
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Write Keys

Nothing to display

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
uxtheme.dll.ThemeInitApiHook
user32.dll.IsProcessDPIAware
kernel32.dll.QueryActCtxW
ole32.dll.CoGetContextToken
kernel32.dll.GetFullPathNameW
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.VirtualProtect
kernel32.dll.GlobalMemoryStatusEx
kernel32.dll.DeleteFileW
kernel32.dll.CloseHandle
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
kernel32.dll.GetCurrentProcess
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
kernel32.dll.GetUserDefaultUILanguage
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
kernel32.dll.WerRegisterMemoryBlock
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipGetImageEncodersSize
kernel32.dll.LocalAlloc
gdiplus.dll.GdipGetImageEncoders
kernel32.dll.RtlMoveMemory
kernel32.dll.LocalFree
gdiplus.dll.GdipSaveImageToStream
oleaut32.dll.#8
oleaut32.dll.#9
oleaut32.dll.#10
gdiplus.dll.GdipCreateBitmapFromStream
gdiplus.dll.GdipBitmapLockBits
gdiplus.dll.GdipBitmapUnlockBits
kernel32.dll.GetProcAddress
kernel32.dll.CreateProcessW
ntdll.dll.NtAlertResumeThread
ntdll.dll.NtGetContextThread
ntdll.dll.NtReadVirtualMemory
ntdll.dll.NtSetContextThread
ntdll.dll.NtWriteVirtualMemory
kernel32.dll.SwitchToThread
gdiplus.dll.GdipDisposeImage
kernel32.dll.VirtualAllocEx
kernel32.dll.VirtualFreeEx
kernel32.dll.VirtualProtectEx
kernel32.dll.Wow64GetThreadContext
kernel32.dll.Wow64SetThreadContext
ntdll.dll.ZwUnmapViewOfSection
ole32.dll.CoWaitForMultipleHandles
kernel32.dll.DeleteAtom
sechost.dll.LookupAccountNameLocalW
advapi32.dll.LookupAccountSidW
sechost.dll.LookupAccountSidLocalW
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptGenRandom
ole32.dll.NdrOleInitializeExtension
ole32.dll.CoGetClassObject
ole32.dll.CoGetMarshalSizeMax
ole32.dll.CoMarshalInterface
ole32.dll.CoUnmarshalInterface
ole32.dll.StringFromIID
ole32.dll.CoGetPSClsid
ole32.dll.CoTaskMemAlloc
ole32.dll.CoTaskMemFree
ole32.dll.CoCreateInstance
ole32.dll.CoReleaseMarshalData
ole32.dll.DcomChannelSetHResult
rpcrtremote.dll.I_RpcExtInitializeExtensionPoint
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
cryptsp.dll.CryptReleaseContext
advapi32.dll.EventUnregister

Execute Commands

"C:\Users\Seven01\AppData\Local\Temp\chrome.exe"

Started Services

Nothing to display

Created Services

Nothing to display

#infosec #automation

TheSystem Itself @ 2018-01-24 14:06:07

Detected family: #Malicious

TheSystem Itself @ 2018-01-24 14:14:02