MalScore
100/100
MalFamily
Razy

7c8701febd.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 37/61 Related 2235
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 344.00 KB (352256 bytes)
Compile time: 2017-07-03 12:01:11
MD5: 303140d9dccea718d55b4e767e460e2f
SHA1: 3fd209948fd02ff82804c99395a4f5f7de9a6a38
SHA256: 5e123d4f7b03118196a1f27cfa5a56a3ca8723c3d0e5b02d3719459ab303221b
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2017-07-03 16:21:06
Last submission: 2017-07-03 16:21:06
Filename detected: - 7c8701febd.exe (1)
URL file hosting
hXXp://directlink.cz/download/7c8701febd.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2017-07-03 12:53:58 [37/61] VirusTotal
PE Sections 3 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0x54ac4 347136 f5427ff089c7fb5d2c8c51e416944b01 b43e092013b78bd2ceea32d71aa1cd71ec384c21
.rsrc 0x58000 0x1000 4096 e6634237ee5af99f1185bc43eb539170 0a24067961899e5af88612e025556505fbbd951e
.reloc 0x5a000 0xc 512 1478551ca3a09c6022965658c318a120 9c027751e85088e01fb25f0559ae1921e1b6281e
PE Resources
Name Offset Size Language Sublanguage Data
RT_VERSION 0x58058 628 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright:
Assembly Version: 0.0.0.0
InternalName: Payment.exe
FileVersion: 0.0.0.0
FileDescription: Payment.exe
OriginalFilename: Payment.exe
Translation: 0x0000 0x04b0
Comments:
ProductVersion: 0.0.0.0
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Data
lzma.dat
data.dat
FIle type: Library
mscoree.dll
IP Found
No IP detected
URL(s)
No URL found
VarFileInfo
,Is
Comments
InternalName
lzma.dat
StringFileInfo
ipw~
Translation
Assembly Version
FileVersion
VS_VERSION_INFO
@+D@
000004b0
ProductVersion
FileDescription
0.0.0.0
OriginalFilename
LegalCopyright

Payment.exe
,is
data.dat
kn-cM
7-z@r
yb8+
r*1'
rW]U
#ep4
snK
0;_iR
Q(Z*
w={\
2"Sq
%H d
0W8>3
^ee
=Sr M
i;0v
U2m9
t/|O
S:3L
\!i=
e`]-(p7q
@>bf
is];5
1n}Xz
B E:
wp j
{C2:
;ite
hEg
3.
$OE@
(,AH
FR7
\"N~
2$jf {
$oTS
^k K
#`\S
$pNE
GetInstance
1HWFX
k3MY
J\.
ResolveEventHandler
wp -:Y!^
&p97
E4Ph
Gyuo
Q<Z2
)FM?
BXfg
N8;y
1W '
a$&?
j`
A+f D}
lVF
>*oa]
HUMh
BI6;
{^(D
_|iTk
FYUk
Kbvb.
qo1|
lh^r
i*x\
|ka
IX y
9n0@
=;vza
Cb0vKF
^*2v7
<PL'
1Mu[
cn"'
? 8
pVso
yk+z
LateCall
hW$
jqC_
l?P
/,=[
JjT QCr
~kV]K
`_r0
SPsyA
QZM;
JKxv2
ayc\
;bA
qw8FJ
Cv7>
T#`V
q7w z9E! T
F(#BC
R4[T
!#K
\d7
6m$q
tGUg
{ZS:
!|B*
7>$.
T f-.
wlBp
>&$_(
d W
@]+r
RA4A
@Sehv
(Tx8
u1=
_CorExeMain
Og5w
FiiC)
Y+n?
n /#
]`l
f[L7
2#vB
4System.Web.Services.Protocols.SoapHttpClientProtocol
D,&2
LZ:78
v Ch
k wW
~9PQu){N
P5Vk+Pv
W.g1j
[(?^
H.a%
wtrn
b vy
#6[8
wuc jK
|)aB
=I}i
{Lp/ro
pEud
xoZ mI
eW6
\I>}
hL,(i
l}C@
Nti#l
x A4
85Z(
d_;*m
x o
ey}h
f3xOQEY
d8G&
fh@@
U;UM-l
t#Opo
\u>J
1orHQ
, ]:
2(6<
fS n-O
26,e
UFn
^#.-
q%0 V
>~&Q9
i|~n
ceBh'
_ JD
G/!4
e\dC
TO^'[
;5'6
c|"R5oiB
Cr9)
Y?aD
Application
%U5~|
$a{j
k7y!k
Y~]Ht
{E&W
D)i(
d) 9[,
:.b)
gDcC E(
Q&nN4
'7MD
/N:U
zI:ZJ
9$j]
M,6
^NX&
[wcz
Bzvd C
r0dQo
|6 +A</
,K:W
],Wn
L`}
0/NR
^.n.Y
6F{
07c|o
K}n G
B`~iD
;&KeN
I~<Z
P88M
e3[C
x;Pa}
v,J7^6p
o9Z&
uaK!;
$3 $
k/j[#
wv&o
.I1MU
_>KI4
*CcE
GcOmY;R
_Z~E
MGG1
ls{]
~u6Q
_"7
Ld)r-
xEx~
=i;o
T87?&
{cz*
)}$j
~I;
`#9Z
GbX<
qL\T
o:`_
5h3*K=jL
_Z6fq
95{|
(E=G
y"G4`
get_Computer
iZhU
t}~q
Cx|i2
z*U(
Rce`
A6Qz
KI>8
(bY0
8?(_
jm@nkV
;P $-
8PyA
2 vP
xn t
:%8;
X[nzPz
/F@a m]
(X:J
/^r$
?5
ONvyj
#zl&J
8%x7
K6w]_
X[)~
)D{>Ba
AppDomain
\y-q%
X6ug
Spg=
JF&1e
<[F0V{
o'o|
GetMethod
3Sx .
v2.0.50727
wLxGv
b6Xg
atV28
K[>p-
get_CurrentDomain
&;J:
M6IH
#Adu
la Wv
FM,=
get_Assembly
eBCF
b2jd2j
DdgbJL
.HZc||
u|m%r_bp
i]?OGh
!84_
z:La
25_&&N
Cg_R
\$V/
E;aI
LGn(
_=~m\
SP]\
]_Yx
N Fh*
B59f
4Y@,
8~zq
TYA{Q
O%lQ
t-F`R
2{&p
l;^XZ
-qGf
T1%
9KKU
<!g"
!4}~
>_c4
'@P
y} r
E(5\y
[ oQIM.
].q>;e
T4['aic
&{ q
y^6vOY{
IZv%h>b
*6.g4
O&2;
eBf`
8U6 \c~
rg Jc
Xcg~J
P 0f
Decompress
#?cm
v;ZfG
'QB|
|&]p
Bw&-
-u h
C #|
4kFS
g9R; 9
2C.3
43*0
FGhC
cBi8
U;\<
-i"5
~H7/k
%9 J
-IG;
34cf
-d#
07*7*
-^(v;
&$lNp
NOhI
v1(.
F#E\
Q0jq
h3ZO
% vr2
o!lj?LuG
V)'&
`~?H
S#'fw
S90(
,rCq
+rUl6
nzV ,]
{a]!Z
s8]|f
.[~V
f"RQV
L9g}
Msgm
, (3
Z?8y
hHG~
[g5 /
Yr8?
m_UserObjectProvider
`AZk
Q;Q[f
mA1j
CompilationRelaxationsAttribute
wgr
:z0[ J`
N}f`
(Op'l
Zrq8)@$
Xi Z
6/FM#
8Z{'7
[_j- N#
_i^t
M8 ,
Type
We*@
S#X1)6
7+P
qK` u
we'U
ppCD%
7z6l
;Ws9A
g!vo(\
Nm<S
x$#G 7?
(1/+
+kcggW
g9DR
i f.
S$^$
^,9)
f`{)
e*mW
)b6k
.K~u
[ n-
;CxURc
&e6wE
p{DR^
EgWF
E .
c8<Fl
eH7 v
]Yf<
)<lSp
nyH(
d380{
xJPB
iAlO;
*}kS
TyyXe6
;lvJV
r]"+
jd pw1iuA
?\+1
|;o/
px;c
Kn @
JytN
1pf]
![PY
epa-8
F!T
/1wS0
fjTl
91_J
81*X
fjHD
q&crt
~B.VK
3L{ *
+o"
&2D OAB
R.dI
?d[$TUY
fMZ}
0Maz"
W Z 3)6
;-&x@
CCuU
> *kU%YKn
9 h^'jw
s;:p3
F_4
v VS
A%ge
1L"X
|*&<?
1~@r
{=yH
ZHJ=
<'$]3m;ar
{^`+
8m<~
%9ZJ K
Dispose__Instance__
uWJS# [L
jPN&
9o[+ -=
L;E
V)Pc
!d5!Xd
4uB[
?aL#a`q
vLre
Y!FT
4!#'
uC\G
#fLX
^--p)u
{l.n
Tw~[
Y<.pcu
z8&
xj{NqM
(~V_UD
nipA69
<Onn
NA!n
r}|8
h-|d5@
=,{+
,F!7
R(V3
{NFbValJK
f\:" D
}=?~
Mx0pW
cao&
f?>v*ET]e
5s1>8
1T\:
TD!=
F={dt
~q<V"
my-'
|!HF
,wk:
:Wr.
(5XpH
&LMF
spx!
fM25cj
/U.u
OoK
qu= s2
I/E6
(.fsr
ef<
iDG4
My.WebServices
>B!
(O{lZ
]YcM[
zRtA
@b-#
* at
2"7M
]yk\wW
?$A/]
%<"K{Pf
HT"U.
u3:S
bIu*
JT2C
';$n
MfDl;
TdJB%j
)eCW
|G m
V^p3
sF+{
g3+1
m_ComputerObjectProvider
& ==i
qh?/k
M6HQ
GetString
lU-p`s
-b ^*
'`j
\amO?
.ERJ
ea)z
zQ l
w>tR
Ij_Z
)8zf
Xx_W
_aZsQ
j8E@
U!# r
Fk50?
Zr%r
7buLt8x
fT3P0
u~oGN
jg7>
<{yN T
=a2 ^(
MyApplication
z&;;
jo~t
^>whqP
y$`:
)=49
4~Lf
kDZf
).L{<
&QBd
(Esj
y<(
Vr\D
`2kR
^ow<
-?k*
+AArNA,
x9'>o
9w3{}
oO5`
Computer
&:m/
jmaM
P!?
q!F
88i6
l0:d9
jA;]T
({Uz
rI=%
Jti~
WERa
\Q$k
nW g
v2*]
GAmH9W
qgDG
/9N>
W.e<
0uhD
:7D?
s)IT
=9Yi-
,-il
z^t
Zlly
T#4[
4aeW
?*nc
R=z|
1.)ojs
M}Li
}{FN
'-bW
%.;%^ Q
;%x:
i5vc
1f;Byh
p9DbST
"sN^X
PpEL
wg~
aJ(G tg
_ZyB
+W"g
N(=+cu1y
hz)?V
qus-
,8wc"7
vPVUv
RuntimeTypeHandle
$smY
&,`
V:yg
JS$w,
G+:P
x| s
p D'6
+//3
R*<%
srCdPy
'd~F%
%p4$
a8 p
5F c
ResolveEventArgs
:Q!4
^z={
>?7
`.rsrc
{2 /
?wvL
nh x
hRLC
F4_j
!1f$DW
5vU4
q zV
RGkQ
89_~
&<(q
Substring
Vo^SuZQ^6mZYwJMI}L
]+, 1x
y c
w?b[n$8
3!~+
)b:
oj%7
fai`
Cscv
sz)\
CJN pQ
[FPT
3?E%cs
mXB $
KDB]
.ctor
instance
o%o"
hy6`\
%9SQ
Wf D
0/u5
D p7
!i}
]H+
I{yUT
s}pUf[
}b'?
5 hj
A>'A
;s?&
@wGx
eF[b+
Sld{Ok
QJk{
<1+h
8~qtC
qD7j{jQ
*?G
BSJB
|;|~
FF%
ov1J
YVR%6
Y;~_
-qA}
o^Si
i MJ
Payment.exe
u3lj
p"OJ <
qst
^P"*
AKe(
XQmzA
mYlqXpc
>k1\
Vzy(
)v27?
t}CH^
=?2
P}cY
7m<Y&
pasS6
^Yo]
>liYa
Yq6"
,i bVld
GYe6
*%Sp
/e< v:XO
]e|D
*8gb
$Y g
yg7n=
7mgG
a9wM7
{?I:Ch
;[$8Q?
8aQd}
96#^
2`|W
e0W
ITzR&'"
Q]4z]
Hd=L
IKOm
V(Y$
>) j5
xQ,
1Kcj
_ h_
P(gS
8MF
HZIRyj
Ip0v
ov,\bC{
|!GO
ddomB,
=je{D
dc(Y`
R^c<
tBm!
mH/)
?|PO
&F(:G
ijn!
-DF]
#5an
AHct
2(&h
_.Sc
Dxln
#e3;[!q].f
q<%y
L u?
K26n
2[4CWe
J>`-I
?z~
C`I_
9"
rxl-H
?|BR
3m2]
*Htut
`5'Y
K {k
ny,L
0o3t
7uw)>
GetBytes
^zS:c
!g;
xYq|[
Byte
V +YtDT^
Jyl+
~D,
O{[d
>t|(R
ptD21
{s^+
\uf8h a
D3#$73
p:kw2
NQv o
74s5
=?*
oKN
JDSf
gk p
KO&)
T6OpjV
ua9Ma'coEU
ZXBG-
WGb5\B
jJf.
H}oA
75{b
J %Y
(^8P
cf.AV
>~jCZ
?xl
~M%}|
? B]=
]1vX
>~ G
Lc}?
IOF-X
*$XNxTzs
0nF&
AUtq
g:##
STAThreadAttribute
iKR/}{
uf*[
BP">
_?Gy
3D9V
FrEUE
!{Ll
{oj|'
kZ r
pF ;p
,hMu
nN< b3@7ft
7Zuf
HC '&
hBy4
MPN3
q*t 1
Q`CP
W\ER
-8Ss
r?[Z
FKd6
z oS
yYSB
\G120
2a%v"
! 'cx
j n?<d
_/ug
* @?
$pYv{.
iJA|
S( +\
]O n
EHwq
Gx ?
_gX3
.KpD
~N(O
Ti6C
%?Zg
OMVC
NHj_dX
' R
k )|
rxXii&8
System.IO
@#(T9
g4]r
8v^%
ns!,<
h<)[
[lw,
6F.c)&
a4ug
*"R"
s.rrV
0m/jg2
\eLa(
cuJ$
?X6'
j=;/
Qf@.|
P:EqJ8
IL:;
neKr&
SE!r7
{*ko
E}/=F
otSk
3hdMw
:yU(bs
N6l`
9zo(|
i~mT!l
.;U
y6}b
|!@s 4
RsJX
m 81
w[!{
(_`-
]}sTK
bI]gw
$"ok
9t'=`,
7jd
vKM
NI<=J
%oSX
zc.eX
7lg% il
r q{(
|w )Y
(M-}
set_Position
i>m+P
j8Zo
hc`U
A#z}
sG)f
>Z 8
$:(p
c\(`)0
w%x!(
#!8|
x;&.
+w?_
`u[8t
|}b/D
2hI?g
3K7GMT
C\/ S5c
_zS0T
9BaY
#1mO
K*\)
J;pB
}l6b\
[ _
HKG_
NqQ
W7D:G
(hul
T6Edpc
&i:Yq
O*th
*/WZ
Qb[5_
PM.?
pD4t
C&AU
,";Y4
bu`7
M_Xm
W{sQ!
sZ&2
Hbf
t+i\S
|<+r[
`4TZ"
{}v7
pv'-v
fXx5y
Dt+@
9IA=
{&&
Tw*+
A.Ew@0
#6yqwv
=53(q
M=]i
UE*]
mduH
s=AM?c
EH!C
p zH
k y7b
>yqpO#
kwWy
9kT]
H!SX3
Mhe{
3b'|W
G^Tki
!`>jD
eLHT
g(uof\
29H^eq
{Ma9k
"xIA
3Ft5
b6~P
&Skc
DH%0
=aATS
) ^k
,9+@I
> 6^b
[X(zOy@#CD
U+Ki
l|-ZD>
F| \
CO= ku
9Y^0p
y:,a
6BzG
`Pz*
AssemblyTrademarkAttribute
__tq
Q"n#|J
+yeV
a)O
Ct& `
\'3c
o8 #
?(.d\
O%9z
JgYL
0V!B
l`Ed.O{
mt`N
q s-
hg.Q
?ehy
_pCY
:V~/
nsvy
;?c4
.f`#E
~_H6
=m!f
w[.+
/Y$9
g>`LfAP
ft@PN
fJ0U(
Vk" 9j@j
es<B
~MV]
8aP&
|l\@t
xpIA
|nji
Sn|g
9kF]
Cg)eDF7
"}.
37F
xYH_
^,3/
e<B'
+D%)
2acB
:+oJ
BaMZi~
U7Y^
[r%9
.G#
R5o*
,c;EU
H= g%
#1D=>
Nl,e
@Q;Mf
6R?/
*Vs
+R]C
EZfR#
b4[0=
u'9G)
Pb"
\y*p
xL^'
`8Ai
cF1lz
BL0w
F1OR_
|t$S
h! ^
) #c,
y"7&`
=>[$
V[Ftq]
hcwR!
y3t~A~(
KEw+,
[pVR
dZNJ
S. R
MSqo
Ei/p
+'5~
pk}w
.aep
y# !
`E<</)
1z
wP3i\
|I'+
rFg!
k:Kf<
kkR-=7
VA*I
System.Diagnostics
C 6N
f?ZD
GetType
QK#>k#
\Xg#
DtV,:
YCBz
S7@K
H&+E
0YP1A
uls+Uz}
add_AssemblyResolve
[aF}
wz66
[?x 2
ThreadStaticAttribute
MyGroupCollectionAttribute
s&
Kxv\C
RWn(
V4AWpJe&ZQ
QQ!\
m$Qck
K~yx
- V#
HWjbt
1A3]
6dYr
Activator
RWn9
5m<f
M>r2
a%SY
o|]+
>dbL
??$8
<Module>
5Sc6
Ft|}h
:&S
=-ji
c .d_
_b .S
o2Y*!1
L '
oH+Y
fz^U
>Q ,
*yZQ
/}J|'
& b&uA
!F8z
;y8s
5n'e
f +I
JQ632O
gM>,
<G19
WWu($
y_?}s
jr48
O(v"
$=g]| H
KN!P
9san
Mmh_
|tyu
C4 \+
9:`%+
~f59
nr:m
cMgy-
\R8X
x//I
8rQ<
%B1@
UP~u
sSE|
;?X-
/R*+H
c[|V
f.@U
#`)S$)P
k>0S
G};<
:vU*@
~zR8
*t.`
6,Fv
Wc}~
+a:U
V Kd
6^UX
{! o
Dp{ &
1gb{BG
Rv?z
g{hdn
t$mN
nHgR
FX]
R|hn
Bq:cMeMe
{E!?
^-L1
sq.I
LT\q|
iT9/A
|kqC
s1/W
W1.ArX+
e=5O
1m/nh
Os67C
2a<
PCht
U/ U
w[TT.
p0Bf{_
O Km
O)Fq
x%G8b
~+F-#
I;2t
WoG]
3s/V{o.>
ze`s
`oG>3
'5_8
^y8_
wN<I
ET5w
Ea'6
F" R
%&6Hk
k:L7
:9`-
QD*!
I0X ;_b
U :{
/s->7K@
gYQ
Bkz=
HM8^
9 :4<k+
z8Qs,-8
T^s-
?b$6
.KrR
ovC-o
xTy2
}d}-
B%:\
VB:Q
@t/9
&PX
E1EA"
J=u^T0
-:iK;R3
RuntimeCompatibilityAttribute
Qb6 $
$%ex
V(7T><g
3 rc
:RS@
H=nk
zzh5j
)+OO
o Zf
:axt^
{pgx?m
8(V>".
vj L
jjV6u
M?~&
J1to
VY5>
cUU&
^4X{
!jNk
+g%N
9&08V1
dd91ZLnf(
:YP{;
*[pM
q8Z
<.{B
2a+2
R%H
1[r%
[F( {
u)+/
oyUz
G2r7
4yDb
1s;}
"v9SZ
pQ8n8E
.IQI+
MnrQ
%9my
R:*C
N #v
&Ub2
-;Le
4C?p
%ax}P
x8#"
U^5o?
&6&td
+lZQ
>[p6
0ueJHl
YCo0=
1dzdg
} k*OV
DpB+
{OO
#lvxeA
Wy+M
T3eXP
m"(yES
T~:h
h(ss]{
):oO
P.l:
p;5E
Iu ZbJ4
O.]Wd
CDMj
" /y
|# z
BinaryReader
uWcHLO
8|ud
UWz-
G8`A
yz.b
U~J
mV)9
|I#$$v
7,TW
nXj
~N]rn
y U
4U]-
Zqw'
3\'B
+Z}@
/I[C
91l!
7^%y
v$t8mZ
3<Vi
_0WgIL
ETyu
"WVjK:
G =+n
Lsfc
F!.q
1(,K
9t"j
B y!&
]gel[
Y;x%
DYk<
<oN}?
?;BB|
h3$
P:T15
U0e<
c~m
(lO>
't8s
ssw7
vT4o
V?Cl
MK]:Q
p] i
z.!I
\,m #q_V
hvci
zCpW
l_(f
NxC#
w& F
TN;+
kp|5
PW6@JH
D|'_
j4$]#
---?
w@Xn
('av
<`_j
(^.@1
/=78
gd{+
aaH#
=g'zs"
. ('U
V s(|f0
(<pT
~ns{
.f$K_xr
r %8
!O9&nUx
$^U^Ch1
oJ>H5C
oBa1|R
BO$f
get_Item
get_Chars
9C q
uRB24
wR sGx
w^,/
m&d{
Fp(
kT{%
s0?e
f=(3"
1XHK
RGa{
Mz(-
C3SV}'
S&dE
N'^2 =r
! t/U
q^8P
znBK%E
' a19\kht
#O9e
Vk_b
%Y70
viHZj
5E+f
/5li
>~=O
SGt$=
a&,
RWm{
g=wP
z}XH
vV1'
"DS%^5
D!50S
:&:Im
(IS#
3e>2
Xqz,3
_siA
!^,gqR
System.CodeDom.Compiler
YtUS
@3n,
9 br
J$ )c
FV
e::s
IFJHa
.~brg
jq$2
[o9q
U82L
|&}
fXCF
E6U<W
"dzvB
n[dB
W>by
iZ rd
ZY'G.
Z ED
(9Lb
GK$r
xn ;
C&g4
}[h=
(O)V@
GBr4
U0"~
0.0.0.0
%x4#0
5PF1
rH[
]wn(8X
ThreadSafeObjectProvider`1
|(8h
1{ae
Qv<u
Q:}-6
c=BQ
=&\9j
6Do-
rS
j!W-
o @]i3d
x]_~
eV ^
:]?O
/\5Ij
aW~]
1d=Fn
J0hd
36sy
b'eU8
/I!H
(H/T
eoT
@- >`}"
X|)[Z
Ce*`
-sHEy
\Mop
PEe3
U F6
Gg{]
(5&X
zLH/
5/K7
;u<1
;.8M
a_
[Qi
!^)t
eS=NV
|tk 3
SLmVX
zvCm
4KnZqe
/UbN
&?(EH
!GqZT
]`k:8'
F`Mb>st
I]h-p
H%79
*){5O^
`eF
f]^}
FN:I
uAg8
j8 V
;u.'
jlOTmq
PJ>?
N^JO
B5}T&AP1
>2xo
'GN
#ia!L
W g ov
/zG3
tbAg
#SY
ToString
l-V!b
JI0%=
aymz
3=c"H
@IcI
g=K
DO13
1jF"
&dpq
~P;L.
k_j<
oM;_
AssemblyCompanyAttribute
Aw ,
a N5
!,\'
yU2|xK
!"WJ
7m:o*
ToLower
phc^
_:_
$) 3
k@!"r
'X=W
~O/Hp<
ZqI0A
} ,G
M73
!o@m
AD3p
aEXr
U*`5t
&I =
K7`i3.Gs
R-ME{
I6 oa
0'(,
%,]*
<A+@R
kjH
8P&D
Z}/1
Jclv@A
S9 !
m8ZZg
wo^]N
GZipStream
lt
Vs h
\9Z]@
DebuggerHiddenAttribute
zg?C!
0=Ql
bO.|
_={y
/!
.--=
F*Gw*<'
x <h
)7ZL
/YoU
StringBuilder
|l]K/
z>}Jz
Oi6w7
c0XG
;>YOG
6?0{
\MY'I
Ygys
[q+G
ik${
yf ?
x^Ri(
EdLd
b"7=
o>!'
Y[b>
bo_5c
~Z,[1
&H5D
noJ e
3#nOH=
bH'T
9 [T
=}c\
5P1L
{ v
)yvMw8
#1x,9>
LateGet
AXeH
.G^L
p!k
t1-V
g}Z
_e3~
g|(S
.!X`
d<*:
u8L-ke`
=Ygq
R]rFhm
Mi'V
ldT M
N7 ,
I,7<I
MyWebServices
-J"m
g- *9$
jvo"KHk"V
=Aj\
Create__Instance__
p8,<
.RP
rGx0
-n"J|
m15
gYlpT
zP{CI
-od]Q
@Wx@
oM.M
o,
GS[eo
a<~ s
T2+f
%Dxu
=s`^
ny7 %
vUc7
kkoe\
Om:O
!h5zpG
:UB
Lsy,
]R"Mi
rFW_
hF`"
Sv7y
xL.w
XSvRF
o pqt
Q|:8
DrUAc
<S;U
:<l/F
PQf|0
~k8f
xO`Ko
Adi K
20t3CsGo
+/IJR^
``$x2
?Er;:'
eZ@V
G@Wl
X Ix
,N[
b*;h
-kSr.Jb@
7^s)&Q
2'`d*
p=@;V
\*(z;
>68
<Dx]v
dq3d
#Strings
W=`|
v>mH
TFPzl
;<VKf
wd=
L+Y*
=Vc (
,N|
CreateInstance
r}W:
ph8!
z]"5
f142
mscoree.dll
|(9E
n<Q
{cM~
]TG
p>qe
{ ZT
^i9v
krGtD
G0~Y
p2]"
cvMl
nL}M
m :.
2zB
_iNn
Y7/KU
U Rl
;pit;
`h4[
zilK
$rU/
& R
BA@S
@ 5'
]p Ns
j0DEsw
D9 Q
5G2D
N%kK
`Ht[
)HQn
Bt`P
kc 7
x1<bd
um*J
DE~,w
{dR3%
^Y7k1VAf
[KU+
)j 5W
)g>:
yn;Z
C|91H
wG5:
IF`)
@CCB[
a:Fs
GPLA
B 9<
zhtf
lyL$
7 zW_Xrz
tHl'
0IeZ
5Ms]
3XGP
+-Q0g
nbP
oN|a
|PAzGH
Fl?5p#
GetHashCode
>ONQ
Q#'rH
>Jav
ao%I=+c6 2
Dn^G
cSe,E2
#9={>
3pGrg
GLHJ9e
9g24
);1
f~Eu
^`0
|o)V
tbX]
65G7
V-83~
.lHa
BMr}
~2;r0&
Hj.(
pZRe
,>(A
fYt7
;n"*I
I>9 B
kb/]
fi@{
@.reloc
B* '
:E>i
CpI9{P0
"VCmG
rS|rQc*
T\EbW
Dc+/
cK}7m
pL O
v"~d
^%\8
9|],
P=c65v
iF1t
T"&['\
0S:[
No*L
7VGv
NahqR
(j!_
b#m
Ws*,
zahz
+JCQ
hdzL"
{:+m
:`cg
t0wZ
BKS_S
0iSP
HG~P
^y`d8
xMI2D
UY#3
j[wsB
xO((wL7
tml+z%
~2qBb
n3 p[
=0^F
,&n#"
I)u:
hNV@
-mc9ub
w`ea
NDw9p
mM f
Dc+U
*H1!k
mI+`
@xmc
+ dmj
(4>f
pxS(
Z:W"H41Z
[[UU
j0Z%
k4e@&
%Z F
CJjZ)
}wm;
get_Application
D s&
% k>
<fK
4=wdNj
{AWD
iH=(
j,iO`5 M
`LJ-
~3$}
UJ9<
Q/nc%
zB)J
z{%Z;
'Yd3$
Iy[!
I@'u
I!P
) tWU=
7fti
8L *
t>Cw
MH]n
_P jD
#!9D]\
"~f
^$naU
~pmo
0i%f
xL3k
UYB&
PO:O?
TxJa
(%9v
>HjD
t7g
AKNz
g/Sn
*<^r
;YO!
eJ6\pla &&
'@uy
}jX,
f F2
Ob83
HZdc@
NFe,
Kn,
-=o
_:T
"5LT
q(dH
pqm;
6`_Y
%ty$
/\W1
d huZ_E
s~@PN
gG M
.n\q
"t`&eJ
[z`A
4jt!
N#W
4LUB
ai=,-J
(o61
f=W
vET
2r.m
uw=~
}7C|
7+j{X
]oC
H+tnU(
HFv7+
K"Whgm
52\*
NZ[RL
;cv:
q?p
Vm{f
n2o<|
R4v. F4
9A+\i
B8G{
k(L
|"Z\MU[qWZ7:
b$CfZ@
*<>A0
$ZB
)eG
!qsY
uQ'6
?u6E?
61r}
>;}'
FCQWJ
i0^$
08NVE4
JWh*>
Assembly
Av=
8nXB7
#E;
y(|q
%|R
x8sT
*ZOJU'S
(D5%JA
O= MD
}Sb0U
a k
h/-K
V>}%
X/+o `
:/H%t
>o7"
XB7@
a?2Z9
&Ikc
GjaV
/,9aO
4kS/
8u"Q
& G
`A s
XHm{
3H4t
|m
Bmv;
56~|`yj
}_ik
-|N$
8, ^
MO[2
[q3 y
&-QDxk
%K7}
*!]Ec
e29"
hSwt
]!?:mV
O~gn
= dk
MMaD|
^;;?
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
X^qRQ
h>I"
SBBIT`I
/?vB"&(3
|x;c
/PkVp?
Sr_3^u
K_ w
YS)GN*b
_K4k
ow.L)w
dbsc
%h+)
'T7:
cI!wx2L
0a>.
u eA
8VQki
x("a
Gfj0%
T5Y N
LC>4U.
T%e%P
A1FBW
(3ZaU
j:h6
p-CuB
KJzcsLm
+jTh&
Du<f
A~AN
.;o
B,|zKc6
4I72
Ejr deB
YZk~
-'Z\`
}P
e;Hh6q
#c;u;
sq\
m Q
0n}l
.Y9_
" D;
0TG%
;?qny
rDp~E
Xd"s
K;&z
s\|Z
I2;qa
NS"RP
[7QE#
8']3}
P:_d
^U)!l
wvvq
$q"FU
q M{
6.@Ag{=||
9Y9GX`4
qO1PK5"
Fa /e
6cDW
=M<V
D~ 3
TUl&
~Ejh
:LQK
{"c9
8xm}
}#jiw
~sZ2
i~CV
U0gb
rkA
SevenZipHelper
45cBY,
Y;z{
^p(A/I
N@LWx
aiZ/S)
QQ>O
rc !
-@ 0B8
5}
q&Tlo
-tb\$}
};M 2
mSy'
7:Q7
$gv5q)@
s 19{[
Oz_V
lliS?
x\=8
4#c$O
m Hb
EC_V
HuGl<J
;e>%
Har5,l
3:=~*
AKM#;
i jt%
e1B lt
S=$L
# Q{
<? /
=nH
yN:
\<{E{c
Ie.<j
"Oq`
uop_
u^!&y
.RQE
tYT+
^ntlBA7
&>A{r
vd3$
,Q# 1(
Q<lt&
Ho3t h
Ydln
I %M
_t;KW14#
<">
0.'A
}C4_
ZM^F
>d.M
/@a@
b^h=
vM+o
m~&M!
@EdV:
}z_2
k(A4
Wk/O'1
'GIz
Fp,s&
ResourceManager
l*wb
m_MyWebServicesObjectProvider
]6{|A~
YMd'
GetExecutingAssembly
3fQ{*
2$`d2aa)Q
p4DJ
^P,*
Cx'B
7">>
f\}^
Jf06j
WKOj
8M/r
,oH,
uP l
L }!z
~[q=
`2TyS
n =
- w
dSf[
:fD_
'b'3
MtLX
]Sms
E=Ie;
iwp
RE'Cv
`AA{
}C`*
Kwn[
Jj4a
fC{*5_[
7$wG
U Oo
|h|qN<
?2a3vD
58K
TF=*"1
=sdM
Y%)E
^[*#
mIL\
(C[E3
Q1S&
J<gM^
System
3;b~
GBE11~7
E$x?
2%#V
%XC|
Zm35
4~gQs764yS
.|bE
$ @Sp
NfI@
fE:>i
c&UB
VyP.
i:592d
<N92l
zy~z
DsfD
AssemblyProductAttribute
8;
w4 QPl
W([ +
Z01/@^?
0Z}G
QBf~:
X9(5T
.Cmt
qu.0
pQAR
C\"p
R7PY
lMFB
!#53
6y7z4
v>V(
i.$~
:-3Y2
|Tp)`
p36$
h"< ,=K
AssemblyCopyrightAttribute
>ZUl
T@c9
6Xr,
.3A;WzR=p
4hw:
-kTu
,% ~
DI)5
;xm
!Lmu.r
){Va%
T.6N
p0jQ
1v Yr0p
Df:s*N
rE!!
@[^y!
p4 b
vcM:
ae4==
8$N,
%q&(
`4m.
j]W|L
|8I4R
HV2S
F$uP
,KH}
T5p3(g
kpu$K
$VOA
MyComputer
bk.@
&BKn
e@1a!QV8x)
9 }e
qp7/
{(mnW=
"rpTj[
*xK\4
kclo
rq%&
tno=p
n|A'd5
{XYX
r00
>;+=v
Vr&\:;
H]5*
M5D2
<nf~
74Np
.,Y W
:EI?Q,
aE-v0v/
xul\K
;D@R
1!j|
YWd[
5T3 K
!%xk
}u6KNSH]gZ
s]Xk
@d>
gD{rN
>S w
NZK6_
ZUi ;
&8x/
toV Z?
NlcK
e}<:bd0
K[sM
r2cv
&Kv0^
W$k~
]lMT
*^GW
fL?m
'G) O
vGF?/
sIG
I=a
wWi;:
aB3Z
801O}Z
`^DI0M
m]YU
epN
g`pX
BEOo
#VeYK+1
Bz
YAj'
k1Q
Q V;)
^\uH
hq!~q
=K
>oos
GZQx
D F]
0vHf
\zji
%,S$V
M /ILq:
RaAZ
F~ Z4
A#u,
MMc"
s~r9V
Eqg*
?_GMlO0
E't;
X {0
r[fZ
p9X
e "67
^GaV
Cuy#k
U9BP
bks<
1`ASY
*2?$
3Az:
_4q0
vszt
A pb
}S:&[
B iorl
wN9d
*cmY
QiUa
ZwD?>
3iu;O
Khsu
!R;G
I,^V
P@U2M
+|^~
i3F
,`;, 70
ey*$
QM!t
i-oK
}`Qq
\w(M
??Jk
P't#w
3:9%
/r,oB
J# j
[RRL
K<bu`
=T,57
!5y2
!2hs|
[y0=
P VW
P}#m
cU=8
"X^(a
J A
FG >
\3X1J
3ZGA
{H<9s-_
>MJZ
jo ^
B(mD
&W,6N
)$gC
"O)J
|/ci
sEd~
au= ^r
@)Q
p\@%
\f [
UN+0QdAA
-O7[
9e8!
#*d
dc) 5>
/S6D
%'D
SpmI
) cI
VrGFV
/ #Pp
%XXP q
N>&p9/
^P(LT
.cctor
[yz z8
PW[z
7g5u
\F.%
u6%Y
2Q%8
ZbC|
-yl2;
FWpH
%%w))i
Z!M7
A \-K
*7-1
&h'(Gu
%xU! ^ZpE2g
)?VB[A
F*i|
isEZ{dQ7
<5lSU
G}">M.
KQOY
zq YN
j;wn
jS:4O
V@Hk
#SU=
Rw '
G4+YK
O$wu[
TnD .R
0smG
\&ih
(&J
GetObjectValue
ND||W(E
DY,f
E8 l
@SXs*
nMg\9
xR>W
#4{)}y
%8*
c=3C
:6Wr
\(gQ
get_UTF8
_h@S9P<
=MmtB
wd2&
nOJRf
2%le
W.* #
QT$L
f[-mu
{iE
EJ?e
h-5>[Yppq
Jwc
s[TY
:4^/W\
-j9
'? &Z0
mW 8
OY2B
GetManifestResourceStream
!!5Sv
gSU!
'jD>}/
gH@r
n. yi%wHU
7Z,,
+f4Vd
6`|b~
{>=1&
mLwln
\LH_:
Fg[+
Sjp;
System.Reflection
]N? *pP
d5-
xe *
AVA=:
woe2
SgN"3
I"_5
l=cl
=N*7
#'l%
-AnD
2m=
^Vn#
s{7 :HL
98cc+RC0
dw4W
~-h
K<~A2l
gT8PG
Nc@cX 0:
,#tD
?/IL&hg
,{<s_l
X{-|Wt}
q9,8
K|'.3P
{O)=
o\y
@* O
BV:I
inwH
a {J
pfbI.a+
lhs+
F"Sy
#IOzy
~8jd
}L2
M:Rq
<D,.
c6F_
=Iz%
R;\gd
3k;v
mRe=;
/Y '
)^S[
cEU5I:
{!4f
!oH}
x |
] ;H
.J NO
)=zJ
Microsoft.VisualBasic
p nj"
*&{f
N.Wi
Append
>SX-
RY-%
%`JF^
rP |~(
3IWw
w(^0U
Wm?gZ
wP q
~ =<
BwfW
<d-^
de]Y
WCeBZY
!j5y`T
2"QDx
XQ#)
9O-
w4y
&w%cJ
#d t
ut !W w
a7h$
0~
,;G
y4YM
V8C"
!Id)
0e\P b
FGbc
t )V
P"?xK
mUuJgDz
"-Zx7
z7@k
%|g5
m&V5
!AT}
p~O;
$js!X[w
t%Dx
Rt;J
NDJnQm
xe6
y7~qM
'4NB
Qo S
h1TC(Pd
4dzp
J$BxQ@
[hj~7
CveK
#_I
HqdMy@
TJHw
Jx[p
= Q'
bV:n
bA_C$
Rjbq
q29[
[ X[[ X
wy S
n/d_
C~(=
,IFK()
(eo F
s[o[
!Wrk
GV(A
eI/4
?2 n
U!S4
Wua{
a9;K+
jzR]>
y"h-
@{NQ
"Ef]
< ?w
>86
A0,_t
:-ZQ.UU$I
\~E_
.M-8K
g .Z9
d] lp
7d;If
>}W@
v)S#
ylF[
tfLi
#xFIL
h$6*
U^K9
DC]4
mE}e <\o.6
`>jV
JSdC
PdD%-
MA$W
Lw.S
2x[a
kO7J
R)1Z
5)o
aY6Pv
l)bK
hc:$
u$A)$ht1+
`oQ(2
BtVa
GF}4lXe
?Ox 3Y
g^g
Jd~^
.Zr,P
D=d(
hK6;J
X6rs
/QG
UOc*"E
L3O.
-6kr
"Z4M
{UcruF
)f-
y #3
rn%yZG
# ?{
yX17
T=81
1bio
slIA
t+(lV
_ ~:
+z:v
Gn[w
hG?(@
.Kn|d
(.<o
"0~^)
3B}Hu
s d<
jOs~?Ib
9!$0
K2LF O
!.K\
5X\uQ
xLI(St
@W)[#
aX0!
Cy`E]
OSkgQ
YO(M
xIL.
!This program cannot be run in DOS mode. $
?M |}
M8q=
System.IO.Compression
N0 }
IBPc
o<M)
&VF9l6
Qy;{0_O
ue@t
."&e
&H]b
pM\
U 8!<Q
Z2e5
a4=:
@>n(3
|F(fjM}|
Dispose
(E|3~
ts]$
R|3@
Wn`9>B
W#}<
n9M?G)/N+
4l3z
i[r*
;v lt
<"u{
m#By
OrFFa&E
e`xf
)ff
Ba<!:X
:T3I_
pX$|x
vq}/
C ]qk
~R+Pi^E1
(M?9-yJ
=/Tl@
'_Tgv^
\F/{
/"N8
rz6%
^:9x
#'rE S
PvC
o+b8b
*hS5
JK[+
4 a}
jf*%
_^k*
:0Nly
0P I*Y
&O >
5 G
jC?N
get_Name
Rj5?
xWF,
Read Me
EBh&
x57x
88sP
!RR
p |zo
')-L
t0[}
oJf{
z`{Q
get_GetInstance
EutN
Payment.exe
-~,z
TNLf
Ukj
BitConverter
zS)#
C BbO,M
/,>
tjx
.t#q
O->H
!b4M_H
]~+I
p@4v
c=Zc
P9(,
z CI
f${l
)DSJ
.wBj)#
26km
:3Dr
x"#8
SZb Z
Y]Ih
i o&
/C 6
lHqgc
48|"
,7I#
UgyGa
Y#]
,s^/
"tY
.xJM
4:-G
`9,.
7mW-u
uIG)
[X:M
$9| n
zO tH
G[</
wMK6d
_x>Z
YwNf
qx8@
@hWY
dAFDC7
4ky$
Q_ a
AJUT
b&.0
FxUwf
w-z._Q
4axb
|4%\
xk0Y
zb \?7
GAT;
$x:4%c
BG{GD
> iM
<D,GUDi
E RV
3aS6
QYdp|rv
&ESt
)c1<
.+Rt%
+'U'
*QVL
g[rm
xH I 7
dJ>A
ARf;k
+xS O
[c/
pK]G}
9~9?j
^[gA
RUfY2
9r%28
k]'0
\XPj ZJ
d-aEC
-_w9S%
yv#:$l
rOWvp
;NNTixO#
SZ"`/`]
k<0I
h}XcR?!
grbZH!
4NhXy:x
y`(
=ebx
F=&G
26-Fb
I*lq
q!/4]tR
VUR
._\
c6|(
>1PG
mF1>l
AxS0
"F+1
B1X
MhUt
nbws
*G]
pTm{
EGS$
2?h#
b,%j
a BO
tX,E
pHnE
z0HU
@gjq
^_`|?
2(NC_k
%0-e
w`H`
5eBp
bq*8
rjO+;*
i Qy
EVAC
_7T0}{
dUV
!%hQ
,\o1
't [
*&nt
a<8(
ha,YG
)VM5
l2)m
KT}u',(1
^CS1
.sAq
+dKe
G<o6
vYcC
fQ#b
L cz
A|kU
oY[f
Yg:F
ZH7w)
s-J
qVU
:Gkj
JA u
:%1x
sX&IQ
Aew0
=aJQ@3
Ut!j
IHs<
98zj
CYpW
R
e[=
bsJt
F&\6W
;9\z
0l<*
"Y :
'S%n}
pF,
v>P6
-r/T
]\oRl
Zrv?l
u JX
8_dt"Fz
Cit9_ 2DwwUV
"HN
EditorBrowsableState
AGp#
A{[M
eK4r
vP+1M
_ )S
Z%s
(!
M.3
|Z'^
,bs`s
Pm&w
acw:
iC7_
6KN|
1fpa
@/@
W%i
Ei+eAIP
.6Y_
gQS=l
&%7`
`,P$<N
R _g
t@X
,'\6A
||1
]G$m`>
lxu9
'v43
RHLF
I{F:V
i"`3
&]i/
D~'JG
HrzQ:d]_
?s$b
}E~1
@a@#
ZifOh
3en)`
I29S
\o#I
=XqL;
`8q8
wyp#T5
!I!V&
pytn
vKLre
;r!;
-MFA`V
c2%:
h-x5
C@.=
WM*H|
&=.QIz Z
kGo!
wGWxj
Rh>,t
qNJa
t]y^?X
!u@6
jB M2x
Uo$y<
3Xqe
TCe4
.OM
13Ynz
(:NM
t/w
|0E=8AY
(Z&@
Qg 0K!
" RH
3`sE
H|\+#
h2eyQ
s x
6.i2
`H !0
o9s
G(BO
@TRY
MethodInfo
RJd L|
C,L4s
f-Ja
F.qj
L0C[
%3HUb
b_PIk
p\5^
_uAB9
(;P\~'i
$~!3
|YA8
"6`i
get_WebServices
_YT=
%0 1T
uk
H-J
.3YN
N1@eS-
$L2GqY
, 60
ReadUInt16
Cfv
E~ 8
$ b\
MemoryStream
;n%$g
|S`7
v@DYK-&
@67v
Il_%
k<XA k
Z%qG
jm F
VSg-
ma8qP
y\Me
}VyU
( PP
]^u^pB
^e3L
y-YF
pi_|
[t={G
@S,]
qYV
;lN0
LfK!
%vh_
q?_&
PADPADP@
W.*,
.SR;B49
dwmI
[o
,gix
ZzT89
BJf<
6iwy
<<hT
WebServices
Qr4d
VP w
k Ye+
)(^;
SHeE7I=
53 P
:~fE]
CR.7
3B-*N
yn%h
[w 1
R$ym(j
y<ZL
&5Oi
3K=u}
26zP
! yr
X_hY
\6Bw
~/v?
9!4G
ji(!
iKA,
E8cl[
Nj[s
K2*!
'v i]
HideModuleNameAttribute
s<-/
Close
HOCg
ASf
H,JX
! aI
#DHIpH
_73eRC
#KDK
8<,&g
YK3.'
oxc]u
;5bkP)
IJHr
(ehL
DV,o
2DJ~
P Jq
GetObject
kP {n
o K
}!;=Vo
ac'7
d"AR
9 d 4c
`fz'
xIH^
8|'5
O"qKjA
,PN@yT
zrmf
V<&5
% ?l
b2JX N?
{.Ee
K!_6
_=/;
B$kO
pbA,
m?/;!
^@!;+
vT1
n.nRj
>RV8
taj:
sy7y
-Ppa
!eL#
Equals
r!/7SA
G 2C"F
Y@~~!
3@.=5
#i2S
&2<qB
4`> "y6
e-REO$
Yd{{ R
@;Z_1
e*CcA7p
g4I =
PM17s
9:ly(P
u\f\m3
Xk 5S
rK!;
MmFiX
:8]FK
hJ<\bh
{a5/
5o8&:
Ur>)
}y}yM
v/3FB
k#VW
w!_G|
(aPx
!X&Rz
cW>
,n]e
^,net
5E }
<(97
WQ+" N
%;O+
?qz\"W
>;T9
>`;a
G(Ia
h` 5
WS[l
rc(q/
KuA3
SIk4
My.User
ch!C
r}B-
r;hB
eQue
z74+
a>rd
RT@&
K ?\c
88Mg
M5
veNC
+n I
#x=p
n Ip
5Q{|I
O7azOC
Stream
tMUC>
&BtfIj
/G0d
[/Vl["
bq^y
;Msk
9h7h
!_E*s{
@c ]
'uM0q9_\D
x$%M
*^M?
7m3
O\XIB
CompilerGeneratedAttribute
*q 1ul
{jGA
t,a_
d ;UJ
?_drm!_
=+_5
>{ e%
System.Runtime.InteropServices
Zc)hQ0
y;{Yx
/u @
%SjG
AV+5D
<y<z
Z Xo
ED/|jE.
;[F
5KRn
HL5}
*yRr
Nk$U
&<Ac
X@b
,I~|I
F2xz.t ~
AvxZ
<AQ43
_y,i
'jbvQ
Gap1
*,Eo
.text
(5!
Qx'
$73p,x
k[Ivx#L
eWk
6Wup
yEew
%l@^
AssemblyFileVersionAttribute
qX:V
g027
%/L&
System.Text
aChW
Sba}
hYkp
vAB}
ReadInt32
Dl$_)
@]Qrt
K}]yz
i-7:1
s\1b
QX
System.Resources
W[_l
Sr8_
tVzJ
=Ni
|m
> +7
s 98
Ao[q
}>FQ>
zjv/I
y64F
I|=0
`'M!
CN_5
f~'/o`
M}y1S
3 su%
get_User
F4;!
WXbA)
oB]4
qza9
(r<4
RG7b &QXH
CD9D*^
l03
^a+x+
(g z
m05ON
gx-K
z(\<
YyE~
/ L4
V=nvF
`ToJ
uI 4
cy i
n|4V&
@'SF
q?[Aw
dfE=
vB7 SN
H }_bm
A +z
4ZKR
b8S7@>
QnOSR:
<3DO
CG|w
S|-%Z
Sxf*
T\Ae
is,c{
|%R#
WrapNonExceptionThrows
78 s1Y
DjM6
0s|+
; ag
D/Gm
oMP|*n%g
"``e
moG\0
Mk<[
Njr3`CU
SevenZip.Compression.LZMA
sBoy
N2'(7
:*?=
e1so
oPc6^v'
+in"
S0U3f
')(
Encoding
.[O)>
}U4\
tyu{
Dl6k`e
^:b8
x %/
9XgW
YYgO
&-vQ
,EWtg
5XC=
qM3C
~`Mx3X
GS<VQ
00\J
rF9]
c(mM
_W^m?
2MRWY
PU6N
|S V
=S<6
tzPh!
/wKd
6O#Z5
bS@qv
fH%\uG;U$w|
0X[X
|GzG5!
G: Hhg
NR!A
H 3_
YWUG(
%Ob(l
String
)Xx{;
\x!=?l
blcp
5l 3
}K0d
(w$
v- ,
&_^ZL>p=
30Mr:
)Y v
\q_
YWC4
McT
KhE)
m`rlV
SZv.
F Qq
H)dT
S@/6
Q=!%
UJ <
Wb-C&
}R[]
jA9N
ee@Y
!eVyR
[?"p
b8v&#~
f~nV
>|B'*
K1=Q_
B!-aon
Au[!
;B80
5J+Q
:|ZZ
LF"
>i<n#V[
Fk~
@LPU?
$WX\
Kqo}
&pMRy
O*La]
>vo?x
_(voQ
*\5-P
l"RN
FvWR
vdWv
HM!Lw
#uX&k
6|in
Y24RRO
HY=BUgf4- ]
!MkWpD5`
G%(m7V
GXrQ6
K OS(
R +7
~(n xd
40 i
c7Jr
I"URi2
JiF%
A]4"
[2vN
EditorBrowsableAttribute
].R-
U8.%
2Up
y;I
81SB6)
"0DN
}Z?5
wI'W/c
IqFw
System.ComponentModel.Design
{*`_
Fh$9&a
z@<#
Y U\|
9qd_
7 ?Hq
c!.N
a-DR
%U5
?uTN
\U/JQ*
'CsDQ
+ a5n
User
8gZ26>
a7:
42f&
}{Pq-B
lSQ'
d 63
Payment.Resources.resources
%[=X
YH =T
]XB
a #
]@DDV
iyz7
SGh{
;s()a
D)jF
xK]d
'\KF
s((a
J5vv
GcVl^H
d'\(
4Db"|#
\A{
yC1=
NF)&
Kb"~gR
2 Z)
ieKA{
b@]5
$u]m
qIhl8
kkG
l29%
VXg0Z3p
ZZ$`O
bGgd
nt?>b
G0Q
~=P
Wj !
qt'f
W6;:
H 0K|
T2D
(vKb
cZ!(C
Q[i>
C jW
2*K5
Z&XAI
:>w=m
E#f:
(*GE
Dictionary`2
@E+>
% V%
+!8T
1 6Hx
?g(p_
{)`a
4Fg$F
U2xDl
?6W;U
q^^
-Vy!^
uJh0
~.#zPu
XZk9
qgPg
i[)1^KO
Ktxc
p* TD
u{ BQ
o(%i
dzex
K.m1
eBqo
liJZ
Ald
_A!
z ]0`
ER:?l
[9n^S
:udQj
_oCJ\
<AeK
9KjP
$cd(
K /}
3:EMs
XD~-:
zv(|
8!Oc
JUWz
3kYTq
RuntimeHelpers
37\%
<&#En03
cum7t
LoU@w
d.@/c
)v3oT
@EO 6
9G0K
s'|.
Microsoft.VisualBasic.CompilerServices
=5TM
/+ON
Lzma
j sc,W+
#f@(
Q?!bE
bxTf
g o
#;{)
Hw.f
ZxkS
Z</a
U)nC5|[L8?lG?~KP/tM
0`[t
[9h'
A.H?i5]2
gKJ
0,fj
'.UL
5@A
81V1
D4{u?
=g~N
0[ 6$8
Fb"M
> <j
+Hve
_g)*
5~kv
Object
:jt4}
tfck
~]6^
;u])y
l.O#
@7[I
-^B+
:w x
"fC'
m!Ck
"t_B
w57E
`)^
Fejb*Sk
ComVisibleAttribute
bL]~Ii
/8b4
#kv
veRWTU .
}Pk>d
Bmo}n
b(n
3}~e
lms
w`%o
o3-b&
6!+7!
ug_9
tj!?>
%a,
jr)<?W1D0
DJ/5|
Wi 6
X}:K
c$#i
O:y[*
N*1t
*(QL~
P%N~Yy
Tu P
Vdvt
# 2p
ZGNL!
[h^*
tL?c]
Q"y,M,!E/
HelpKeywordAttribute
ei d
\(*)
fh)I
P4I2
,7 ki
^QRa
0=v{z~
,PPn2
_Lz
o}LP
9(PN
<LG@
18`p
< {]gh+
G~iab
A )\
gj1J|
FL3k
l/ r
pP\`J]
qhL)
(E1M
)}ce/
stds
;$zN
O zj
>V+E|
a N8|
WuA g
WcL
WfJJ
>L$~
sI[Y
get_Length
6`U e
T%"d*
IRG+
{vHQ
kDMy
-R8M
=:'x
[U8pAF%yv4
A#t|
f&+D
0MpZ
^~M
DyQpp4
a,wF
G"gH
*rx[
]z-w
bCn
<,'D
-VyK
OP$`]
gF:[$G
JE/
Zbco
dAMJf
BGrw
( G\
p:ID
^ W
IZw1
Pj;w
,T]-
Ik J{
Wm~v[
RGI ;
g1E*
<z ,
Zv&
ReadBytes
a~p
8.0.0.0
\D? /\
|agL
CN#An
<K'I
Co'7)oK&0 u
czo
gOR{
aPD=K
I~ z
O0}*hl
"9%A
C=]4
~ROb
RP?C
T }
Jv{
XZz4
1:nf
ApplicationBase
g\ d
8$y
@g;VZ
loH5/
RA`l
db9OO
i()Gkf
cl"+-
i*Hz[
'`$$t
=rxN
b`1^
.fau
(39
yoYn'B
<Kt*l
,gz"
']f"
Ztt@
)uT|
Contains
n=?{yr;n
^9y1
7@:=
c&k+qi
f|0C
M6{<
0S\it*
M<79
DP7U
j>g#
wC3!ix
m_AppObjectProvider
w{)
upay
L-I6Q,
1dWs
c|'Ey
A{X
7p~6
P.]t
1p@
L K"
q6g:
F]HL
<{-m
w}##I
IUm:
Erdi
X\C
|3g<
Irp
obTB
sda
3S~P
5i`7
G4g1
{>d`
EP1_q+
Ci*p
dO8"
E%,6
*jzB7
Z|{(
,7lvR
7YNc
XXnnXp9
d1Y1vG
jk\T}
kzg`3
Rd'f
d/6BC]q
)x %
^&5HppZg
U+i#
Vhz%e
:~yB
UB>
aV H\
vnh,
[IFVU
om&ktu9
(1 :
9j^9&
qaN[+
7H^vu
I]&w
44 P?'
.%Fe8
|dj*\
Q=x]
?j+9
]&:_IQ
3[%a@:
\=*M
;G{r
My.Application
fF.0w
hGk~
zC@&^
\##
tBr=L
$BTr
!LLd8
E GQ
T sc
<zJ5
\TL:*la
<V(z
A&u_
\b|3
8T<i
v )'
` uF
48 U
U4>z0+
yn#d
@L"
";_{
MBD,
&q;8
n.p{
^tA
f]eR
h(:u
ppu<*]
U'd}]
j.+a
AssemblyTitleAttribute
sO+F
2C)|%a
L+sc
wPwfP'
)8S
s0Cn
XTjl
84eR
E r^
l>_IC~
X tZ
=I.L
9FjJo
[S]E
m@^|
wOvs
#I f
+apx@
cu= G6
5M'3 y
G&rg
!Q|Y
Yvc>
C"Pj$z
_y.k
>.@[
G Kj
X]_y
Mj9n
:|!8B
v .]OO
ck 3n
.xUy
[ `y
=>c
XDHNb
*`&J
d/?u<
{OEs
Im2Gp>
G[%bh
>"L
2 4
AG'e$Z
:YMy
2 2l
qj`o
-aO?
0b Cw
NewLateBinding
ZxgF
4~-?N
2dsy
L 5Vg
zf$e
$QNdQ
4WEp
~3[K
h9N=
8@N9
EAfY-P<
9qSq
#Wus<
$zQ~gFoe|QK
S [v
%4qL
F},
xwnO
Y!V.
@X/(
W ,9
o-jT+
2f{4
D\ U|
}R)3 -6r
w `<B
iA+U
njXU
*!^}d
<<-N
lKaJWEq
0~X3
:2~&
{5io
H(24
8YX07
\t6N
1 =V%
2:;s
O?:,
h`[\g
r4m>)w
<z3^
L1Vm
A!Y6qQ0
j S#\US?
HF|a
?wa V
h U
7e2Dh
g'm>
;i3+
,ym;XxeFv
1{ES
P3,
*W`v
JT$
^?HV
Ub_4
gp={
Wp2v<
f+JO&
=TlCM
i P9
nu(
Y l2
OSeK
n *^jn
iVpp
F#$
vPPk
) `X
d|TVj
{KH
:)&^
m@IT
+Zx8
z<>&7
'gHu
;%rc
RO b%
8j/.
fLFb
!8Cqkr
Yp '
lZ+n
f<\$z
b\kLA0#
D\o#"
@]9k\+Z
+eH
}/V<
gs$@
j)Q/tI
sTAGs
My.Computer
re1R
|Lq
zGNk
+.`"
ln<6
IRHC
f|~N
m)G
6A1t
n~xK
.>36p~
$dds,
Mm>Y
C87V
ep Gj
A# ;
ULO(s
;Yk~
RwO$
nH9;R
bGm(
.u(|
cgtPKd%
(g9 `
<{I$
;xm[
.yL+
|nz
hdxS
>Uux
j)4B
f1A
g^ AC
3JeM
m/h*
>~X=
5ga.{
Zup\
EUe!
`l$8E
XUW|X
sz#q
X m3jII
w.nT_
xh _K
i`",/
5Xh-$KM H9q
AJp
7|aBv
&Jcz
=si+
z*D]
<j-J
Q+^)
KoF8w
L7X/
V} _
)>! =s1
-vd5;
O1(?
cfZv/
43A.
DX|}
P',$
get_ASCII
!p%&
8^ \[
igWTkE4
D H2
Ys%Od1
Cz&
X')lC)
FZkp
GfE^4
1Li)
f6D.
A6Xm^
v Je
q|<&o
"0dL
0/vWP
rMA$
Y.$\
! Rc
N ]d
,C*CB
r[m=R
BzU{X
UKO=
1<12
kc\i
?c6'h
MT#,
%oM:U
DlZ9
) jnVe
"v ;PE
`G:zO
uWcd
T) `;
eyPoX
?;l)
'E{]
'5'+
a|{bXe
=*jo
_[9X
vBV9
f9??
+*C3
( f
(7)M_6
elq-^P
)?%
/L uX^
zS6
1wAl
nrVO
cD3j
24no
c,Gh
w0 n
*K O
AMd6Jd
.h,oO=L
ozxh
7?3O
K&cf
f_zq
_ 1G
Y4o4
>d `
Z&j
+r7ek&
z<aR
`3tJ
l3S1
Fw}V
b "$
"uj!
D]s~
rI~
<oLwE
MyProject
8oy@mew
Aoz]
/%9[)
k.B8
wVAd
!;a
;<He
6 rg
5`5Q.
r+b_
T.mf
Ls h
WCP<
v ybH0
k/f9
3t3glk
(,g
System.Collections.Generic
DC#n
52*[P
g] /2ei
K}fy
)W~.
s{-2j
w|%H
p7 K 4S
3n^"2
7g+.S
GjB)
% 6D
_6fT0
$T$O
OjEl
jA N
tmt:s
++o+
8Q2;O
lt
G_ 2@
E3 Y7R
>aZA
r0Y"
o7nl
9fDq
ezNP
RUf*
^,(7
MmPJ
^mqJ
Q C2E3
C pL
Payment
wW.[
x1 o
U`)b
- /0
<M)6*
VoS.4+L
>5D~
uK"Z
_A@~
9(n1
2 +c
_ArA
AssemblyDescriptionAttribute
System.Runtime.CompilerServices
Aw|Ee
R-<~`^j
p p5
S{#8
>hc$v+
U@ C
A(|Jyt
yud'
9O9a
GdG$
>cZ*
PEQM/
"*Jn
GW'w
H A
lA}u
t<*"Y
]yP`
=eLAYQ
`Des
Ik g
N=0 cPe
mqGD
m7I#
7^%
*_jm
s]zR
nz#(
Yc l
K:z}
w&R+eS+
8Z;'Z
k\]g
,|,6
SP>t
pDUFr
[j2FWi
=vYI
n|)Y(
}j^{()
'>z;s
\ xP'\
Lye(OU
PBOB
Em*
ZLlJD
F+F MQ
xp~H
>3vT
; E .1
6y.#
f, X
hXP
y)o`
<CGeRL
}X`+
d8)g
@mM1b
[xn|
gq1_
[kp1
i+}\[N
h\]#
d$N0
/chV
2w 9=-
Gf_I
l L[
X{XhDas
^qJZ}"
xt}~
6~WO
a ]o9G
`nem[H^S
T4EV
>Ar
9?pg
, <
{2O\
#V&`a
G[ZX
v I5
i:hJ
Db1R|
& R&0
t0uGm
~D)/R
4I5L
7H9&
oE lFPL
?0W
HP`
IDisposable
>2Bi
,#J]
A* B*}
>O8d\
X])(
!nt
H${@
Ir>}
k|[.
X V[
,~ ,
y9gV
0G#J
I=:!
Q OM
H"@^,
StandardModuleAttribute
++Bt
L#X$
DcxR
l>eo
vLa<
QS*6p
6S'8
n-Ih
k2 WQ$
lwqo
CompressionMode
w/S
{E6"
~fm3Myz\1
&zwse
[ntD
}Da6E
mscorlib
i=+0
%J%z
S+q:Z"
Z&k_
.r>*
/iS @pb
D;!
WTl/:
\t)t
?@#Bq_;:O
_^|u
v^6_
Ed8\
+5qjMF
hG9>
\67 *t
#Blob
7R!v
J[a1
!%pa
!X]6?:>;
p@'D
RS=t
K]e
([BM
RCvv
@' &
}O ,
leVGA
YinQ
BLDE
g>tX
*{(^e>
c[XQ!
lT2Vb8{
}YYeh
;Bd:}
h~|ad
r@]2+
{|di
fD7^
Zp@B
H !
57L3
C6 4
>g{ B
Mp3U"|
<?<"
6>'h}>
_bX8
# Xc
|Ub[}'
%R_U
G/''
6Q/i
Mw1}
e( db
6o@v3
z%vA
,ad"`|
~x?m
ifxRvD
2\82
VPEK
~8HSe~ >+
D6\H_e
yc,O
w-g7
'cM&
?wIQ
,=P:5
D$zP
_AmUw2
qu m
s>mb
|v ^
4n <
TD8CV
4cl-
Q A2
p9k}}.
rdzg
GY "
!r{~a
55kI
`<U%@
>u(y
"d r2
$`Vd
PcB@a
bv# d
b/T ky^E
jNmg
Tl#7
nv/)i;
/;<^
)o\&
e P*
Y\@M
FUj>
:N34
)`-;
*B CxSw
q^J70sP~
rJq`4aUO"N#["
I09K`?9
W`} m
C%@_+
5rryS
CQ[f
{\?p
* },
ZB k
w0Qn
v!UvB
6q!/
c'xV
MYTi
v(B6
c!ju
4\_
i4;*
q24Q
he ">
Read
[3iz
ll_6H4T
B4>D
s"d^
{C #
n#:|
~@Wz
0OF++
h j[
m2`,
H>'5X
JMjy
olpz
'?f4
KC@6
7[BKT
SMoQ
&k#O,zi
x2`A
o?q`
Write
geruO
Cb`s
0a}`
gS_T
7kdv
(ykf
+aDG
WXuJT(
DQ@
pauW
3 B\
%4]}*
'/RJQa
\$l.-
DFIp
sO"A
CRf
zq1*"
ds q j
`rry\
}K0]
2"AVN6
c<mA
tz)a
})pO
mL88
vfHp
n$KgS
qmq:
1iE;
Cd\j
::D.
4z'8
TX>D
L`S<
0=pCDkV5^
~)|C
~/;jf4^
f{
Gb5=,
97eMN
Microsoft.VisualBasic.Devices
3!Q
MyTemplate
JxO*
hG5 :
xm,}
w"1|v
%DO:
bj>P~
+8jc
q S
#_9@
H^C&N`
4FfG_
p7I\
eMPK
[Z 8>
cy v
T|mk
B&U[;
pS-R{6
ODfZ10
Please contact abuse@imminentmethods.net with the hardware id: 8c75ed54f59d43cc581c5897fe54b2d0 and company name: oylaultd if this assembly was found being used maliciously. And the offenders license will be banned. This file was built using Invisible Mode
tM7XgQ](
4Agl
t9n9
,u<6
Q+bTy
; 9[9
=[ K5
pOw<
+[Eb
(8Us
6<TXZ
(DX
<Q[:{
{T`sR
4RYS
mr28m-_
`K4K
5oaHE
h\-1A
Na,0
6B l
^\F
:8VX0
]^tR
`K4G
4y/Mx
zFqA
f%Ba
bAoh
u#mxx
b@ J
nwO
Microsoft.VisualBasic.ApplicationServices
>KZ6
(z pe
o|q
RF |
s=tc
0pH
Mb)Se
]0E
n/zG
hp~:`
GetTypeFromHandle
b|o"\
Rr12
"Ok/]\
aU5h
GRCMl
$`KaX$
t-OZ
*;XsP
# CK9
$ !eC
i[dj0P
wAb=
^PVH
Q^Tj
+s
94.n|
S {?
pj7Q
:Hvm
;BY>_
\aGn
1#:0
9g&f
*i8KT
G&t%
mLAC
SZ:=
!&)_
]K
_Ecb
Z Zl"
$vgvD
S`Td
System.ComponentModel
y{l#
ShpO#
%ahw
m_ThreadStaticValue
@&?J
QTX:
t<>#
S#q6
~.\
|B."
8(O
m^
}@]r
@ku9+
W q}I
EIj&
g=V#
U6{vj
p"CO6
}SVK8
_*4d
"!k:S
~EP[
8@0uJ:
Ol:5
_oc@
>t}
lB N
^2<m
%g6R
B U}
V$y
WD4
/y^l
gWiF
}/2b
Y `V
r9 ,
_d'W
BN^Ne
0"nf
_G),
)H]ye
$zLn
02B)
|SRR
xX$'0
eIE8O
;LwC
Wtk{
N#MR
ETq $
3|'<`l
4[w/
a|0g
Q@p
SF9]
ToArray
Z7 }
v08s|y
r)t=+
:q.x
N8b[
8=7
c`#ZSo
UYVte
N -#
/yrJ
oFZSEU~D
:g;
%x<t%6r
Z&>Tc
2VVx
<3v[
dt|/
<6Zh
inUIE
&Eg(u
Qd.y
a'|iP
*2Z`r
^V8fS
hsj
GRSP
*-IPD
|4r
M4l
6[3G
wtn^
QNwJ
L i~'
^C"k
.mJ[pJ,
J(\'
Af:!
z#G?
';~e
ggwvlXA
URC8
h+ l
oplq
)xE]
`,p^
MOMK^
D ($
c]*
kERs
y+b
Ak9dguK!
Os_:
Hq<e
#GUID
p-i:JN
B-%!
!;Ku
33`'
r-{a
[<wh
GeneratedCodeAttribute
ALs!
X]^> TYv%?
\^:c
;'6_
MMi
tg q%q
|'u$ ?
fqQ0c
,6n:"
w_Gi
d0M`
q23n
(eQk3u
86Y.
K>[ b^
JZL-
A|Qd.FUl
g?X]i'
OnHz
3wbM
nS,b
:-:h
_=h*
&LQ,
yjpm$]
#}Bj
e4?2
\ h
3'!+
PXDV\
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven04_64 Seven04_64 VirtualBox 2017-07-03 16:17:41 2017-07-03 16:20:31 170

6 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven04_64 Seven04_64 VirtualBox 2017-07-03 16:17:41 2017-07-03 16:20:31 170

9 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\7c8701febd.exe.config
C:\Users\Seven01\AppData\Local\Temp\7c8701febd.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\7c8701febd.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Users\Seven01\AppData\Local\Temp\7c8701febd.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\Globalization\it-it.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\assembly\pubpol21.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Users\Seven01\AppData\Local\Temp\it-IT\Payment.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Payment.resources\Payment.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Payment.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\Payment.resources\Payment.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it.nlp
C:\Users\Seven01\AppData\Local\Temp\it\Payment.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Payment.resources\Payment.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Payment.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\Payment.resources\Payment.resources.exe
C:\Users\Seven01\AppData\Local\Temp\Lzma.dll
C:\Users\Seven01\AppData\Local\Temp\Lzma\Lzma.dll
C:\Users\Seven01\AppData\Local\Temp\Lzma.exe
C:\Users\Seven01\AppData\Local\Temp\Lzma\Lzma.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.INI
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Users\Seven01\AppData\Local\Temp\7c8701febd.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Imminent\Logs\
C:\Users\Seven01\AppData\Roaming\Imminent\Logs
C:\Users\Seven01\AppData\Roaming\Imminent
C:\Users\Seven01\AppData\Roaming
C:\Windows\System32\tzres.dll
C:\Users\Seven01\AppData\Roaming\Imminent\Logs\03-07-2017
C:\Windows\assembly\GAC_32\AForge.Video.DirectShow\2.2.5.0__61ea4348d43881b7
C:\Windows\assembly\GAC_MSIL\AForge.Video.DirectShow\2.2.5.0__61ea4348d43881b7
C:\Windows\assembly\GAC\AForge.Video.DirectShow\2.2.5.0__61ea4348d43881b7
C:\Users\Seven01\AppData\Local\Temp\AForge.Video.DirectShow.dll
C:\Users\Seven01\AppData\Local\Temp\AForge.Video.DirectShow\AForge.Video.DirectShow.dll
C:\Users\Seven01\AppData\Local\Temp\AForge.Video.DirectShow.exe
C:\Users\Seven01\AppData\Local\Temp\AForge.Video.DirectShow\AForge.Video.DirectShow.exe
C:\Users\Seven01\AppData\Local\Temp\rxPAgofrriwpJMgbMkWUsjPfQqI.dll
C:\Users\Seven01\AppData\Local\Temp\rxPAgofrriwpJMgbMkWUsjPfQqI\rxPAgofrriwpJMgbMkWUsjPfQqI.dll
C:\Users\Seven01\AppData\Local\Temp\rxPAgofrriwpJMgbMkWUsjPfQqI.exe
C:\Users\Seven01\AppData\Local\Temp\rxPAgofrriwpJMgbMkWUsjPfQqI\rxPAgofrriwpJMgbMkWUsjPfQqI.exe
C:\Windows\assembly
C:\Windows\assembly\Desktop.ini
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\System.Configuration.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\461d3b6b3f43e6fbe6c897d5936e17e4\System.Xml.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll
C:\Windows\Globalization\en.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.pdb
C:\Windows\symbols\dll\System.pdb
C:\Windows\dll\System.pdb
C:\Windows\System.pdb

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\7c8701febd.exe.config
C:\Users\Seven01\AppData\Local\Temp\7c8701febd.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\assembly\pubpol21.dat
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\System32\tzres.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\System.Configuration.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\461d3b6b3f43e6fbe6c897d5936e17e4\System.Xml.ni.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.pdb
C:\Windows\symbols\dll\System.pdb
C:\Windows\dll\System.pdb
C:\Windows\System.pdb
C:\Users\Seven01\AppData\Roaming\Imminent\Logs\03-07-2017

Write Files

C:\Users\Seven01\AppData\Roaming\Imminent\Logs\03-07-2017

Delete Files

C:\Users\Seven01\AppData\Local\Temp\7c8701febd.exe:Zone.Identifier

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\7c8701febd.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\35e33386\5036a786
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index21
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\f14af9d\4a351090
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|7c8701febd.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|7c8701febd.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|7c8701febd.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\f14af9d\7dae5169
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5d608f43\663c74a9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.8.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Web__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Classes\AppID\7c8701febd.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE\AppCompat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\DefaultAccessPermission
HKEY_CURRENT_USER\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledProcesses\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\1D28D171
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledSessions\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_CURRENT_USER\Control Panel\International
HKEY_CURRENT_USER\Control Panel\International\sYearMonth
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.2.AForge.Video.DirectShow__61ea4348d43881b7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7454be22\631aafc0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\4142eb48\6ad09d48
HKEY_CLASSES_ROOT\CLSID\{62BE5D10-60EB-11D0-BD3B-00A0C911CE86}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62BE5D10-60EB-11D0-BD3B-00A0C911CE86}\InprocServer32\Class
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\AccessProviders
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension
HKEY_CURRENT_USER\Software\Microsoft\ActiveMovie\devenum
HKEY_CURRENT_USER\Software\Microsoft\ActiveMovie\devenum\Version
HKEY_CURRENT_USER\Software\Microsoft\ActiveMovie\devenum\{860BB310-5D01-11D0-BD3B-00A0C911CE86}
HKEY_CLASSES_ROOT\CLSID
HKEY_CURRENT_USER\Software\Classes\Wow6432Node\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\Instance
HKEY_CLASSES_ROOT\DirectShow\MediaObjects
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\DirectShow\MediaObjects\Categories\860bb310-5d01-11d0-bd3b-00a0c911ce86
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\msvideo
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo2
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo3
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo4
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo5
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo6
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo7
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo8
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9
HKEY_CURRENT_USER\SOFTWARE\Classes\mscfile\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Data.SqlXml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Data.SqlXml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\InstallationType
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\Library
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\IsMultiInstance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\First Counter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\CategoryOptions
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\FileMappingSize
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\Counter Names
HKEY_CLASSES_ROOT\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32\(Default)
HKEY_CLASSES_ROOT\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server\(Default)

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index21
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\DefaultAccessPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\1D28D171
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_CURRENT_USER\Control Panel\International\sYearMonth
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62BE5D10-60EB-11D0-BD3B-00A0C911CE86}\InprocServer32\Class
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo2
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo3
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo4
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo5
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo6
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo7
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo8
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Data.SqlXml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\InstallationType
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\Library
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\IsMultiInstance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\First Counter
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\CategoryOptions
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\FileMappingSize
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\Counter Names
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server\(Default)

Write Keys

HKEY_CURRENT_USER\Software\Microsoft\ActiveMovie\devenum
HKEY_CURRENT_USER\Software\Microsoft\ActiveMovie\devenum\Version
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\msvideo

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX
832c2b66-63aa-471d-8385-c02524b0701d
eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-1822907384-1282624486-319450072-1000
Global\.net clr networking

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
uxtheme.dll.ThemeInitApiHook
user32.dll.IsProcessDPIAware
kernel32.dll.QueryActCtxW
ole32.dll.CoGetContextToken
kernel32.dll.GetVersionExW
kernel32.dll.GetFullPathNameW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.GetUserDefaultUILanguage
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.GlobalMemoryStatusEx
kernel32.dll.VirtualProtect
kernel32.dll.GetEnvironmentVariableW
kernel32.dll.SwitchToThread
kernel32.dll.GetCurrentProcess
kernel32.dll.GetCurrentThread
kernel32.dll.DuplicateHandle
kernel32.dll.GetCurrentThreadId
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
kernel32.dll.DeleteFileA
kernel32.dll.ReleaseMutex
kernel32.dll.CreateMutexW
kernel32.dll.CloseHandle
ole32.dll.CoWaitForMultipleHandles
sechost.dll.LookupAccountNameLocalW
advapi32.dll.LookupAccountSidW
sechost.dll.LookupAccountSidLocalW
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptGenRandom
ole32.dll.NdrOleInitializeExtension
ole32.dll.CoGetClassObject
ole32.dll.CoGetMarshalSizeMax
ole32.dll.CoMarshalInterface
ole32.dll.CoUnmarshalInterface
ole32.dll.StringFromIID
ole32.dll.CoGetPSClsid
ole32.dll.CoTaskMemAlloc
ole32.dll.CoTaskMemFree
ole32.dll.CoCreateInstance
ole32.dll.CoReleaseMarshalData
ole32.dll.DcomChannelSetHResult
rpcrtremote.dll.I_RpcExtInitializeExtensionPoint
kernel32.dll.QueryPerformanceFrequency
shfolder.dll.SHGetFolderPathW
kernel32.dll.GetModuleHandleW
user32.dll.SetWindowsHookExA
kernel32.dll.CreateDirectoryW
kernel32.dll.CreateFileW
kernel32.dll.GetFileType
kernel32.dll.WriteFile
cryptsp.dll.CryptAcquireContextA
cryptsp.dll.CryptImportKey
cryptsp.dll.CryptExportKey
cryptsp.dll.CryptCreateHash
cryptsp.dll.CryptHashData
cryptsp.dll.CryptGetHashParam
cryptsp.dll.CryptDestroyHash
cryptsp.dll.CryptDestroyKey
sxs.dll.SxsLookupClrGuid
kernel32.dll.ReleaseActCtx
setupapi.dll.SetupDiGetClassDevsW
setupapi.dll.SetupDiDestroyDeviceInfoList
setupapi.dll.SetupDiEnumDeviceInterfaces
setupapi.dll.SetupDiOpenDeviceInterfaceRegKey
setupapi.dll.SetupDiCreateDeviceInterfaceRegKeyW
setupapi.dll.SetupDiGetDeviceInterfaceDetailW
setupapi.dll.SetupDiCreateDeviceInfoList
setupapi.dll.SetupDiOpenDeviceInterfaceW
setupapi.dll.SetupDiGetDeviceInterfaceAlias
ntmarta.dll.GetMartaExtensionInterface
ole32.dll.CoGetObjectContext
ole32.dll.IIDFromString
wintrust.dll.WinVerifyTrust
msdmo.dll.DMOEnum
msdmo.dll.DMOGetTypes
msdmo.dll.DMOGetName
avicap32.dll.capGetDriverDescriptionW
user32.dll.RegisterWindowMessageW
user32.dll.GetSystemMetrics
user32.dll.AdjustWindowRectEx
kernel32.dll.GetProcAddress
user32.dll.DefWindowProcW
gdi32.dll.GetStockObject
user32.dll.RegisterClassW
user32.dll.CreateWindowExW
user32.dll.SetWindowLongW
user32.dll.GetWindowLongW
user32.dll.CallWindowProcW
user32.dll.GetClientRect
user32.dll.GetWindowRect
user32.dll.GetParent
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
advapi32.dll.AdjustTokenPrivileges
user32.dll.GetForegroundWindow
kernel32.dll.OpenProcess
user32.dll.GetWindowTextA
kernel32.dll.GetExitCodeProcess
kernel32.dll.SetProcessWorkingSetSize
kernel32.dll.GetFileSize
kernel32.dll.ReadFile
mscoree.dll.ND_RI2
mscoreei.dll.ND_RI2
ws2_32.dll.WSAStartup
ws2_32.dll.WSASocketW
ws2_32.dll.setsockopt
ws2_32.dll.WSAEventSelect
ws2_32.dll.ioctlsocket
ws2_32.dll.closesocket
kernel32.dll.GetComputerNameW
advapi32.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW
kernel32.dll.LocalFree
kernel32.dll.CreateFileMappingW
kernel32.dll.MapViewOfFile
kernel32.dll.UnmapViewOfFile
kernel32.dll.VirtualQuery
advapi32.dll.CreateWellKnownSid
kernel32.dll.WaitForSingleObject
kernel32.dll.OpenMutexW
kernel32.dll.GetProcessTimes
kernel32.dll.GetSystemInfo
kernel32.dll.CreateIoCompletionPort
kernel32.dll.PostQueuedCompletionStatus
ntdll.dll.NtQueryInformationThread
ntdll.dll.NtQuerySystemInformation
ntdll.dll.NtGetCurrentProcessorNumber
ws2_32.dll.getaddrinfo
ws2_32.dll.freeaddrinfo
kernel32.dll.CreateEventW
ws2_32.dll.bind
ws2_32.dll.WSAIoctl
ws2_32.dll.WSAGetOverlappedResult
kernel32.dll.FormatMessageW
kernel32.dll.SetEvent
mscoree.dll.DllGetClassObject
mscoreei.dll.DllGetClassObject
diasymreader.dll.DllGetClassObjectInternal
ole32.dll.CoUninitialize
oleaut32.dll.#500

Execute Commands

Nothing to display

Started Services

Nothing to display

Created Services

Nothing to display

Detected family: #Razy

TheSystem Itself @ 2017-07-03 16:26:02