MalScore
100/100

wassus.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 34/67 Related 2367
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 787.95 KB (806856 bytes)
Compile time: 2018-05-08 23:33:30
MD5: 42ee81705a4c1621d9823de7f197d7bc
SHA1: efc6d17b43e8dd9c9945264e06b8d36a94cbaa60
SHA256: 7301bb1a413162282ad8c749912ef0ad7b1a40f5833406e2de1bf518a6aae78d
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 4 import resource relocation security
First submission: 2018-05-10 12:21:12
Last submission: 2018-05-10 12:21:12
Filename detected: - wassus.exe (1)
URL file hosting
hXXp://[www].nutritionandwellnesstoday.com/piss/wassus.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-05-10 09:18:31 [34/67] VirusTotal
PE Sections 2 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0xc2344 795648 4ac1390e60564e0037e08be8fd73350c 6bfc8ef83e533d14c0361bb649296d217b2c6b47
.rsrc 0xc6000 0x80e 2560 4be3c3a8c2f3cd792bfd5e3916e68707 bb916411479491cdbd83474beacd89eb950fefb8
.reloc 0xc8000 0xc 512 3e46d74c5cdb7537e0baccd61f9f3aee 549f20bf48b4509a2cf4bd7f2612fdf514f86238
PE Resources
Name Offset Size Language Sublanguage Data
RT_VERSION 0xc60a0 1412 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_MANIFEST 0xc6624 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: VJNFKPDKABUOOBPPCQKACXQWBJGFYIVVIINYJHMFLEWSZAESHWSRYFUXSRDBJXMSFZGFOQGVEEPXBYWBENYBQ
Assembly Version: 8.8.6.3
InternalName: IRDLEEYBDILYFXUOPMSTOAXXWROODOLNGVTWFGFD.exe
FileVersion: 8.3.5.8
CompanyName: VLPBRKVZBBIKLULCYRRNEUAKX
LegalTrademarks: IRDLEEYBDILYFXUOPMSTOAXXWROODOLNGVTWFGFD
Comments: SOIWFGTOCMDCVAIUGONPKYOXYRKDXIIHP
ProductName: WPQTEVNQFWFFXCUKXNPOFQSVKQQCABLEEDOGIIXMXVPPXTUOTUWMVIIG
ProductVersion: 8.3.5.8
FileDescription: IRDLEEYBDILYFXUOPMSTOAXXWROODOLNGVTWFGFD
Translation: 0x0000 0x04b0
OriginalFilename: IRDLEEYBDILYFXUOPMSTOAXXWROODOLNGVTWFGFD.exe
XOR
No XOR informations found in this file.
Signature
MD5: bcec043a99c66eed4bf979bc7f369195
SHA1: a99c35671970b388749e0e632087814365ce6e99
Block Size: 7624
Virtual Address: 799232
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Library
mscoree.dll
IP Found
8.8.6.3
8.3.5.8
URL(s)
http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
http://ocsp.digicert.com0C
http://crl.thawte.com/ThawteTimestampingCA.crl0
http://ocsp.digicert.com0N
http://crl4.digicert.com/sha2-assured-cs-g1.crl0B
http://crl3.digicert.com/sha2-assured-cs-g1.crl05
http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
http://www.mozilla.com0
http://ocsp.thawte.com0
http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
http://ts-ocsp.ws.symantec.com07
https://www.digicert.com/CPS0
http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<
String too long
VJNFKPDKABUOOBPPCQKACXQWBJGFYIVVIINYJHMFLEWSZAESHWSRYFUXSRDBJXMSFZGFOQGVEEPXBYWBENYBQ
AICEQQTLZZJPQQGIWOAICEQQTLZZJPQQGIWOAICEQQTLZZJPQQGIWOinAICEQQTLZZJPQQGIWOAICEQQTLZZJPQQGIWOvoAICEQQTLZZJPQQGIWOAICEQQTLZZJPQQGIWOkAICEQQTLZZJPQQGIWOeAICEQQTLZZJPQQGIWOAICEQQTLZZJPQQGIWOAICEQQTLZZJPQQGIWOAICEQQTLZZJPQQGIWO
AICEQQTLZZJPQQGIWOEntryAICEQQTLZZJPQQGIWOAICEQQTLZZJPQQGIWOAICEQQTLZZJPQQGIWOAICEQQTLZZJPQQGIWOPoAICEQQTLZZJPQQGIWOAICEQQTLZZJPQQGIWOinAICEQQTLZZJPQQGIWOtAICEQQTLZZJPQQGIWO
LegalTrademarks
VarFileInfo
IJZWZKWTHNJA
Comments
IMCALJZNIUTI
AVKTYUAEDHUWRDTFEBXNGLPH
VJNFKPDKABUOOBPPCQKACXQWBJGFYIVVIINYJHMFLEWSZAESHWSRYFUXSRDBJXMSFZGFOQGVEEPXBYWBENYBQ
AICEQQTLZZJPQQGIWO
InternalName
IRDLEEYBDILYFXUOPMSTOAXXWROODOLNGVTWFGFD
StringFileInfo
Translation
8.8.6.3
Assembly Version
AICEQQTLZZJPQQGIWOAICEQQTLZZJPQQGIWOAICEQQTLZZJPQQGIWOinAICEQQTLZZJPQQGIWOAICEQQTLZZJPQQGIWOvoAICEQQTLZZJPQQGIWOAICEQQTLZZJPQQGIWOkAICEQQTLZZJPQQGIWOeAICEQQTLZZJPQQGIWOAICEQQTLZZJPQQGIWOAICEQQTLZZJPQQGIWOAICEQQTLZZJPQQGIWO
LAGBNLXJGPVPLUHRXD
FileVersion
VS_VERSION_INFO
8.3.5.8
CQJEMZKB
000004b0
CJLIGKXQZHVUDZMMLYYO
SOIWFGTOCMDCVAIUGONPKYOXYRKDXIIHP
FileDescription
PEJCNZJZSYMAONXAHBMFCD
VLPBRKVZBBIKLULCYRRNEUAKX
UVRJJGZHHZXDLUHUEDUUTH
JBRLHYSJUMTG
OriginalFilename
LegalCopyright
ITJ
CompanyName
AICEQQTLZZJPQQGIWOEntryAICEQQTLZZJPQQGIWOAICEQQTLZZJPQQGIWOAICEQQTLZZJPQQGIWOAICEQQTLZZJPQQGIWOPoAICEQQTLZZJPQQGIWOAICEQQTLZZJPQQGIWOinAICEQQTLZZJPQQGIWOtAICEQQTLZZJPQQGIWO
ProductName
WPQTEVNQFWFFXCUKXNPOFQSVKQQCABLEEDOGIIXMXVPPXTUOTUWMVIIG
<<<Obsolete>>
IRDLEEYBDILYFXUOPMSTOAXXWROODOLNGVTWFGFD.exe
ProductVersion
#R9T&B
D_+z
gXH56/q
Iyk)
<T hC
h(=l
sf-^
ZLo;
Jojs
wAU2
lU_za P
if_5#
ZF#?X
?w)=
*AWJ
[_bm
q)`0
IvT
=]
Rvgl2
CNJoR
GrbFI
IZA)
FgT0
\;(3
U@ BB9@
h<A}
(Yun
* 1j
JN0h
s~32H
uedt
Y|6U
13(n
| T
_+l|j
%v9fi
V8TDt%Z4
|**j
zV:2
>,fi
ERG6
mY,%
*]l
\UH-
5cXJ
TD>K
}zUB
a*9
^ou/
bMMMD-
ic\
8iQn
:*QBT"J
1:q?
IG6^
l\vTe
B0yR
) /]
86V&2
<I0f
"\?O
a)^=
h%^$
p[~[Jr
k=0ni
WLKHLLZS
d%b+
D3f'!
tE:?:7
(KxkOd[o
F;PU
bsUM
Sh{
X %AS
&w.;
Zv}%
u&7O
HRe
F1B$
qif@o
|B [
Lo|FP
https://www.digicert.com/CPS0
+a o
#rE :
EM}[}!
o7l-
Fb&W
&)3q
<OA!
q+q9
<8iT
q:%((
&`~
Ld3#
=~tSH
=a$`
d'bSfj;
N/-up
-Oyi
@y}4h
q0yb!
#8VUh
^lMV
*kat?
(G<
B$by
>ZTQH
n Lj
.T 8e5"O[
5d41
}9,-
0Ux'?
P64
L70b
<&'6
H]ca.
Sj T
O(J~)8
SEhh
%.SyM
KJ}$
K3-3yM
%~]V^
DigiCert Assured ID Root CA0
n:6V
P;1W
nAve
o?Lb
iB)B`
GH?P
-Z'y
0VjX
g _^
26Lqc
a=+->z"
p@^E
d)f2
,wL*
j hp
Nuz'SM5
[Iqy
5hPG
D1COa
1| 0
:d b
."/d
OHhy
=L3=
vL +
__StaticArrayInitTypeSize=780338
1 {g
!=Z2
MTE:7
wAm>
iCxH
ynC]
t+>P
FQ)"p >
,2 t
!y K
'rA%.H
bJHm
TJv
F](Y
3j-I)
8PwM
Rbn >
n0S
w1z2|
=Ci}
5Fow
Hu2Gj
##E=
U;nIV>
/mBm|
3ckf
i, 3
#?FO~
(0MvOI
,dCA|
o#JD
v4&k
g:)-|
m/\B C
5h-&x
fcwsr
e[&'
^D_K
ds '
?6ox
JwUS
[v9?
+}vg
j$Oo
E4SK
4e#7
*jvx
c_Z]
(WJ
uG8x
Y`PW
$B$T1 O2
Rgqo)=
'$Q"
v$x9
T7AxH
6N`.
Z"EO
:w4s
-.Ygjq
.$jt6rL
FU+X}N
KsO b
o{Qct
c<O5
Eb]Lx
Z3\
g`d}
!<> [M2"T\'
_Cv- y
Ugf&
W:-_z
MEV'
NOhd
Uz\A
o!,lG
{G:s
6RVDwX
{!Ql
gK\:
o:puC
I 1C
[rE.
VPgo
?'/<
y)PK
db[s
u8!Q'
Ub7=/<
E$Nu
`2J[
vouc*
UyJb
(PLZg
hj1
otr<
%"#lYZ #
"@M<>K
61FE
. Cv$
p ]d2w
^eMo:
w~P{
&87;`
}BQR
p+ C Di;
u4@(= 4
,N"!
ah:3
h4>-
8cbf
Q ;&
o60-\
|8;ic
|K5'
B?~D
Z>D^e
cymT
%TN<J
}jp?
/ |%
MW,4V
C@QN
e. bx
>{{{
t&e}
ObS0;p
dGd6T
& V)c
=j_}
e]eK)x
j3V{
VYRJ
y 5=
vty[
\ ._
=OomZ.'
m:DklT
EJz[
::?-
Z!_Rk
2?w#
R4HXe
9ckU
*+{hr
bDsj
BkEP
#d Yf
"UR2
mnV'
MP"
uF;o%
(y_1
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
0hRj#
eet~
##=@
T)-=P `
5Z9H
mJ{c
jPN|
hDN^,
LINOD
}$ly
%V #
#T)T
T6?k
k9_#z
XD|\
98:4*
)c+F
mxil
& Gd
-LNP
'$Lc
.text
9V>
.D}P&,
u &^=
D x\
n5.:
uQ0lz%x
|{4a
& 8R
ANSk
'C[[
o$ , P
F\OS
jVej
2\n(
Ko2Ky
g(q7
#kQC
_To[
YM *,
[m2ot
UfS
7vC*j|
;gH1su
,)]i
SZ]y$
1V>A
)Q )!
g&dh"
c 9D
l e@u
fUEK
5M?;
:TE"
(=C$5q
{ -`
kxj V=g
sRXZ
H9DI
,.{H+
o<KM
5 !x
:#G
<9+k
K90a
Wy;x
)pwL}
=ELh4
c]31
TimeStamp-2048-10
~}!C
^cWl
I<}~
)mI ^
?*n`
-M -%0\>
sr1`x!y
~T#
gZ~8o
"$|9ks
54yn4c
c3} S
3/LK
UP{no\v
[n:IJ\
u?m)
) Bi
\#yp'
9\=\
WSnQ
w;~<
|VET
\44A+
}gcmc
:~Hw
& " 7
E<[f
4Ta,v
" JB*XZ
H6nb
yNO{Yu2
f1Aw|
n8H((
Gx;*_
z'{&
W9{}6
01hoh
z1YHJsagc
CW,-
/:IL
AJr
M7<S
/+^Re
]t5v
7{{
sv/<$
iw_PV
BGXHGSZHPHGQJWHBN
[2#b
201229235959Z0b1 0
,vE=
elW)]
Q4Y}RO
>mbz
jnK2
u f[|
p:l5
bc %y[
gTTh
9tK<u
uDEt
&.H]
<;Ux
`)Oc
[q <0r
- 4D
UASe
)e`t+
_o-r)
XMH5Pf+u
;0 C%
t9%NRI
W%&}
;Y%
g_ff`
X %AVK
Glwc
uF6F
IMf+:r
G4je
}~^X=
m?}E
tL! 8
0* *
1 vBWl
GDf3
rQADf
K H{
OeNbv
2J'H
Bc"L
Sg$nf
#Jqm
P?Q6a
B6"@b
>*$eh
X%SG
S?<mF
yikQy
=dR+y
6>tB
i)_S
=^A-
&P D
$cF,pl
yQ $
d3Jc
5p}p
%C;g
ha,7s9
WQa1
{hz1
HFZc
\_W
C}(5
!: ~A'
\/VB
wbz|
OW77:
-I c
ei*va
GgaI~
pQ \
Y mB
F}+8
WC6z
M~ @
Vrc
cV"G
:/c!
]]#R
-J_
{A|G
V34_
~L;G
l<[3 sy=%
6 T:
|(w[
t"z<
_C~wW
@k d
?i8@
vsH
yZ'U
.IG?
P\/>
q 4>
*#pg
bMHE
t"/[
?Uy%
,V?u
UWe=
.,t#&
npNW
^E|S
>x`,d
h/JW
-_X 7
}tj+F
M6b
@e~"
Q|Up
}|qT
eFLG$!
D_er
mS~&
fd)`
|aE
)5&lz
_gB$
p|.W
+ Q
i ~
rNN
JVFMZ,
WJ.z
!zBb
^M<
?n7oq!XS
<+Rb
l'I>R
Hho'@|
DWm5/K] V
YP,x
wah?
;*>P
C &?&
yk@$@^
F:Q_R\
61L^'
(yB#
P]F
ojNg
: W^
a>Ut
#s=56
,&c3
qhp0#
g1("
Gl'm%7
* Eq
v4.0.30319
5{8k
5R#]
xv:<
H9o9
%8B
7n:N
}wGK!*
E u5Y
p,~+
=%x
1H`;[
U9*h0
;`{0
$fb_
k-&Q
k6%\os5
^&Zv
-{I,
Z^M9
-r tejA
b g|C>
#GzR
l~T
T`/~
K{<_
Noe)
}} '
JLVO
6AzSs
_3"N
x@Lk
DQ >
$d-/
yokG
$kA@
yS]l%
oq|*i
':US
xB=o#a0
D AN{+
0zpf
eu5sn
R*"~N
dNmq27$x
.5o'O*
.U W
kgr2et
>fQ$
*? +
6 {
H3 ,
}pU|
k 8
ND5=yW
ZUy@
5jL@
"~2U
j Zz<
6&=x8n
v /$
OeJ
l;ht
,LL@
.http://crl.thawte.com/ThawteTimestampingCA.crl0
kCM3
b>5n
v2pZ
f^uF%
o[ad
ALhj
mQoa
wHhl
*r0?*
@^ti
W }f
`u'&
9pIa
'j7)
3no>
2H&H
x}.L
m$?A
N &1
g:Qz
I<PUY(
p'57\
J+(`\
KH&Kl4
r5F
/JRs
Z[|,
W{OY|
o)_,m|
/|'!~,
#BcfH-
P=Wc
8dnX
http://ocsp.digicert.com0C
VKF W
) H"-
http://ocsp.digicert.com0N
H* ./
PZ9EM?
cC <g
}j),
)Kux
%]6}
G=w?)
Hi!
dU,T
cvm:@
@^=Tw
i< tr
!o+Px|g
=uBtW
HE! C
B.X$
LA1 t"
@,q_
"$sW
5//;
zVfz
#<lh
e`Vk
,\\g
M[o!N
3V%H<tR
dBPm
D& %w
kwZq1D
f^um
5%-1
b#[nOS
(/Q2I
0D$F
170301203824Z0#
TJD`
-g5b
egl
;sH ?
Bb&>
:i-K
yQ"
"H2C
/h4}
k~nO
LQKQ
AM ,szA
uFJR
9IP&
7`h3
U9IV
\o#6
Td{X
AU` FfT
ruNf
ZC L
[ DT
tpf
v:'Z
lIpN0
tpI6
4IIh
[ 6O
1h:Z,
teqP
jq F6[
,8f2m
4ac^
.M/8[
J?O*
qJEi
^6c,a
xMG
BnZP
#yj~
sh]
2U~ 4
,pr$E
@uY(
F f['4
J$F?
/q&w
$ S_
6$U-)\K
Z4"x
eX]!We
A`cG
q iy
:}t|
,Sh%
o"cf
}<N#
YXg2
@@{
@;9i
58esw
Ea*
BB7lSIt
Ja*y,\v_
<gp]\
q#$D
?B65
`6\K
OE9P
@RM<{
vtGP
Gmk<gCY
#L
=S3VF
>Moy
)OQR
G-9q*
/RFe
QxD_<5
]AuX
rq&?
"X@/
MSO6
@n)vp
1jS(Mp
#;Ik
?}g`#
jEDc*
Zyq'
W^Ht
uNq+
-0No
'8V<
a0QQ
ssm?*
A2|8
|wn%
!ZCV
,[5#k
"q@
Q5w uV
8dHC
fcY4
6>aP
l!(
RgAY>
OO#W
b>EK
kGR-
Q+f%
GXslh}
I$ o
rr9y
i5y6
],S),
5${ a
B" V
L#$ 9Sw
p@^m
V=0t
#ifHt
TBQd
2#t&
N0F
uICm
/^`'
WKHnnV
d6wmb
=? !#F1
vd'!
4 bPP
Thawte1
19oyM*
koni
R.9k,
8PzpY
?Ez}
OX/L
uU*M
.&D\
=29?
q%DCB/
1Ksh
Ho6#
R Z9
O^tG`
T6/&S"2
i(Mp
e%;?"]
Ro#!fo
CrPW
~nF[
]&rjm
T2y&N!
B0Zs
<}_w
0BnOD4
z `+
b Bdt
sF?@p
9WB,
ww|W
LYwW
LV=|
~ ny
201230235959Z0^1 0
5d8B
yMm<
!jt9%
\y:sm
*UFkX
V^p"G
h\8Q
[EL{.
R6wM
4?4c
%6f{
HdA 35
SF*|
vh~NL
CZ\:?
G=y
hK%8
wFwU
(,#CR
wt>s
=9R=
^~[4
|@}{W
'1o)^
h (=
o{p-
cI*
ueEg
^-ys
1MSM%W
0rm
."~?
2Iy&t
^,mem
xZ@~9
:@Y
iHY<
^%$v
jh5s6l
S E0B
v QQ
'hW_R-
{H1
=KH8
;CW1\
ix!Ea
/kK6
${-rgAst
V%&S%
%'@VWB
% b
uqu,Q
{9xO
1C-
](H_7
&qt'
EH]"
ZZ~W
*B9c
`b8~
$/MM
V),
7fii
2 pu'
O_5}(
,bgq}
r+f'C/
${`~
B9h-
pG
c!`4
nd`
o `,
XF j;o)
4/S?
)H&H
:Mk)
RQwq
F^z'~i
88$l@
4{7/H
<w
j 4C
@,^
K:Ypi{
pf"G
VG1WF
oizA
ghjHO6#
.me8
S2sy
zny[+x
2U_V
FGr2
%bvc
WZVq
#xlQ
o',K
39 Z
U,+)
jp~
pvtt
dc*5
Z8L)
4Q /
-Lw)
.A V
s}+%
Qw3N
1\A}
wRq+B
$ :M
4Ft_"}l}
&fi2
LG c
D k2
^[d,!(
x!_S
7w~@
q3#'
:U*!g
+](B
5y>Iq
Wr)U
x>zti
Tkl*yG
f4t nr7
RwvNV
~ K}
1$`K
v[4/
X~cf
/u$h+
PeA^q
ND(,
H^u>
^BZp-Xx
N"C@
30US
W m1
cp{7
a* lt
kN] !i&6
& +/
p#Q1
q~QQaa
o( NN
4#bk
CPU-
$YiS
oKqZ
2;'^
a<><A
U/pz
A,00
w4 *
"iuJ
]:Dp>
O0V6w51
SoN
I(K_[e
cMeI
917t
Sz95
IPz
QPVH
Bv =
M@,Wd
$]uL
*~c2
s5SAk6
Y+6S0
m5{YX
#Ur:7
n=2G;}
to?f7
GAYd
=$Lx
z3GW$
6~LZ
zPv7
J%bC
sq D
|''<
UKc%
PQe9n
U,2F}wX\
/??kGM
7PG?
x Ee
:_>;
\%=Z
A|Y8
69D@
4B[y
\v>L
* @H
.MYn
N#DR
0/[ U
.Q7Zlo
(0#3EX#
a@ D
!Sh0
_.(I
cEtt
P w`-
Xe@v@
{3*0
`xg9&`
r"/T
p>[I
.d'vR
bcBk
~Qi0
^q~s
u8|
O~.U
cwW6
(\0)(
Cc I
f=Z
0xpJP
X7H2
<+oPx
ynbr
+9{1(
+3vFf
zwBAr
uy?'
KM&_
D$4l\
rLN #
>kKfy
hP? Q
kK9{
;ut;
m_+"
yj^C
RuntimeCompatibilityAttribute
(g!3
bwC
hh[q
NYM"
y7vG;
IoSK
:.;V
]n*#
A#}6
5+hB8
vrs"
?bsUr:
_|Nm
:m#O
5KrY
=9K O
p#|P
'S T
N)jS
ae]1%=2
ixgM
M26 TM}h:
DeG9g
%z1)Y|
#xpA
<<>&
~.Q,cq
W#4D
.x|/o
)BMX4
CC6\
&AzK
>IDur
E's
fI7x
X T}
/K?P
X} E
Y`8
(B-M
=9>Xm
w?(Y
k{pW
2[(f
wC$R
]E_4.!
`[+\
T f
,w'"
UM Fr
L'6<
'V3+
>Rf;5OD
/Pf0
PQxx
K D&{
@cCC
J s`
dq-T
:V56[){
& \jgk
Hkq?
p]wL(j
80E$
/x(/R
r%qv
Bq)+
l0%`
`AD;}
IE.a
UpE6
P,-%
\i7`
/R@8
nq}M
rsB[NAQ
YWvl<
bRnn
}OO$ S
U,a|f
EpKf
%k)
jiog
wYV7>
ZNg8
h` L
;oqK
0O7
/JJ\IK
&nvv
W+A{
"%j]
*.5h Qa
` w>
pd+b
AQ;.3
B@Q"
1~a'$&
VB*Y
LZXRMQZPZHVM
K@Lu
[->d
x?'b
|"XO@
f.."
Ze, n
7ZKX?
09?lr
tT8=
Gf}r
ny t
11iu
Q+xI
{])a
o-EA
%T0+
l%"j
tR d=&
7KEg}_
1 aA
LF {
Rt`E
WZAg
,#>_D
xf]!
> <E~
v1v*
^AB |m
wM'H=
)Ujh
3r9a
~Ed
??nl
M }_
x#4o
!JkZ
>HCc
tkAX]sM
5tgh
hu!6
_G a
)G(g
-.~:
}Mrz
5;5R]Pv
|p_=%
'`0PLC
K(~w8
#B/7
9FunV
}QFe
0 D$
"et5
o)uf
t})c.UU
h8CD
^On}
"_HZ
G9a3
%r?>K
}O cKz
.R~9
G9a
|KL?
3)]
VoC"
$n}[
501_
-O D
]MTo6
/L<@
OAtn
^ jp
O` #
]wQE9
Lyx /
QNAEARNCVWZILVBP
[t |
Kb/}
V|{/ I}
I^~:
h}|
dZt }
5/>`m
<H2<U
ACEN
s-Nl
KjBr
g)
Ou2Va{
~4mz
oz 2
`)Zi
pi+t
2Dwq
_+4C?
{iPS
4yS
?|fo
-1lk
L^7F
|3VG
pUk#
RK|(
-=&yF
hB:(
iiEN
NtT|\
3SG\W
mg d
DX{J
.O1a
jYQ8=y
-J+'e
-MMW
kqBY
L^@<
'sD2
.8y*E
Hi 6
V=B2T
YmOr
,ke
-?'/
k((z
ok>Zn
q $\
fYHT
ENZ
LvQk
'_\?
(L8v
l7o/=
% =sl
>U!"
_6_Q
$xh]
)p9d
50301
G'hU
(m}.
FGpD
^f:A
&2m\%
gBx]i
Cc)2
P7Nb
"mg|
N-M7
`5ix
&WiY
b?X{
NX"_
?KWEF
BNBlj3
5:As|
/S k
4$#2
h8 ?
q&bf
2> q")
jk../
Ix&Q
zyTX
$$(%
Tc9}
ev^ -
&$.y
|tD2
*QBLX
e% ~
]:kA
mp%
n)$)
bYX4_
[@o\
zn1+y
t%g{
@RKpq7
+7Jc
NMlI
)MG
qhZ"
AZ9z
SI{|mx
mscorlib
= lk
CallByName
y+w~|:Qc{
hm_c
Pd\z:
7 I]
<PoHH
D03G
|IA1'
Y83'
]Z
w )R
Ng b
psGr
m0k0$
/.G~
?{D }^
qp]j
& QYT
1#H0
g/va\
owWsst
sO'!
"Ad;
onf+
I']?G
Cp`&J
UjyK
'JqT4
0@Ip6
:)c
_ mY
AreW{w
,b1Hw
*mq>D
|AE !
8;1`
8,Fd
F""F
(E t
)GmZHL?
lU#2
il?b
xzZ
;=Zn5
?yYu
Hi%6
+lz"
p DA>5q
SecurityPermissionAttribute
c_1^P
> |*
^ +i
,1j$\
}1Sm
F{G=p
fqP2
h?h[q
Nn=&
Yno0
#T#F
lA n*Fa
Microsoft.VisualBasic
tZ6Vl^4
^FM3
D\+D!v
VA('w
Ry0,
i*T|_
vO &
- *!
U)D70
MMw0~d
_YiI
"pGo
Uw3J"
sT
:=2
`$E5
9~4,mp
V'0|W
C.p8
8!"0!
u. `
lu*p
BYRVDCIOWQXYUCAIU
4=;s
6H8V
,pa0
V[ 0'9
a Cj
R]-
)!Yop
B>v|9
nD?#
a<9r
a VJ6l8G
T3<+
C{'I
O'Ay6
z+6
QS#!
H({+
h v
<_9]fY
t F=
d{KY
'QLk_
hv
{ Wm
0pfR
AZq'
N9'!Gk
l'y+>X
,-]!
C!'C
k6E' RV
.RSu
P p,
e3A.Q
RQ2z
o ]]-&
< (J1
OyOn
zI2Zg
46sS
V2 DSR
/\%Go(
JJQI
IJrI
k,;=
AY4o?%+'
'SbSw
Z-)Y
02c)W
b%3
>ti(
PJ~3f
vO=M
!This program cannot be run in DOS mode. $
N,?
pENf~
Gcn%1
x x:
S(FE?8<
8cGH
q6#_
ADr0_v
xDS@
eV3
Dispose
CW&=
Qw]y
{f;uz
:KUG`
4XAzP1
jE?
09Wg
pdL]
=R|
2:)p
$gI{z
@1]g
m[FI
Cccf
8`4S@
)5 X
?Li?>
x:f}
R4oEvh
6P].
kMdH
7$N}GP
PP"z
;G-;
1AKve
Uj\:
V{<*,
A$?A
VMfF(
M`aL[Z
q'(F
MvX=n
'Gy)
hCH1 P
{\P
M=ec
3?VM
w sF
fKq8_A
990$
ohgX6
nP1M
Y>,'
_R>@
Cf]t
"SEK
{$uqc
VYZc
OoTs
x4wg
8{/K
@DM g
|Em}
@t~7
<8#e
7]S9B
Mft
u [K
Bx Gp
nG
]<d^
`8+T
[-8Z
S W/
&/+3
d2Js
~$Z(
v { 1E ;
O T[D
Ggi7
\\1.
b_NH
qQ]0s
L]|N}
85FmE
eTJ*
TA?=
8;{ I
CCA(J$IR.
; }<`
T(s
]z _
=,6/p
QKTY|
go_"
|KNY
<!(D
<8yJ[c
] U
"l{Ol
~[3?
DIn2
#C7H
Kbi],
1qu\
I 60
Nb"FB"u/7
WC8T
b:XsPI
ULG/
g="Y
._/
RfYF
i,{gn
vF C8vW]
zB9iXKli
p \
+http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<
:-15
+,Ie3N
s4Sm
Rls$
?(]{
/?m.
M P<t
b#hHDA
zK\0X
#`
q/X
#W6893
@t@go
l#r%
N?0M
P_O=
9/._
bY3r4=
`B/
ja[1+
$Pi[
^| ;
~@"/
tJa<
P)q #
(Oj|
Wp+Fr%
& F9
~Ksse
8n-
=U;O
{^ m/
xM6y?\
pg$=vA
D:R=
%P ;
b,3s
g8yy$
^F*
wUYf
X#PF`
MHvcH
V?Z}
FKKRJPNYKNDZLWZQZ
U6z_:
m<el)
(H^&
.Hk
e_zu
rKYZm
w+ j
!Pxw
sMsR)&
%/f7
`F cy I
Wb;J
-f3Y
nlu>
@b"8
&F1+0
+uiPja
NU5/
`OtV
<uc_
]Xjfw
-(i~
oiv
z :A
w~k"
{_i$
? ~p
/RWo>/
9w$
;+vt
}#BN
7p79O'JE
hu:'3
;f1?
CompilationRelaxationsAttribute
oO z Y
sTwG
K7`U
a3>"
|r{my
wv hc
`owJ
Oa=En
Ds+E
I,f
MemoryStream
F~Gl
<U?6(
PL~hk
e,2 e
"WPRE(
g~.}
aY?xy@
qm,P
\d'hy
SU]>
#?E:2
R.<zRb'
J<)x
Jx`-|
R d]1
qe{z
Thx4
jkEn@
Ok>?
89z\
B0(^
^ vN
-n.s
t@h:
<\e^
sN<!
nK+3
xaVu*B
4g`#
as=v
F a#
ll|_v>i
_MoB
H+%*
! ?DR
hRJxDW
R~wwG
=<W )Sz
nikd2M
i&xt
Iv2`
>"}f
kn 6
;A V
>kc7
~::.
uoCyVh|
W?Q?
E87w:ZX
ADv#
*dHG
[Cs^
xa]*:
a,Igu
(jF=
BJLJN#
:C^!
>+~ s
8"V(
<Q%$
:Z3
U rp
<4%.
{&Q~
.#,V
k>tl}L
/z@.R
C1 5T
M 6
OQR^
,tB)
Vv%0
,S."
TYw&
KNpsf
4!,S2
JGGS48fn
C~S/>7
*=JW"
ME'^
aQ F
yOE7
n%4%
J!X
,H!]?
~{ =
\(h(b
L:*}(EK
mQ@DY
8gU0
+%5R
8@C3\
pVxY
#.M(
{| 9
o;T,bw
[aP.
cC u
Ze|A
9n'O
i y+
8;Ejc
31Wc
1|Z~
. TU
~!3&
9gw;
(XtaQ:x
K<;
c ?t
O B
="{G
\Og+M
LqZo
%9yo
`MM#;
P~ <
(gvT!v
{X:+
W^ .
Q=E,ap
MdXp=
qPH3
\v2&
qcA`D
M0lD
NO8@
]ou%
cj|>=X
y>|
s k68
fXui
hW:.j
nmJFf
JrA{
r*>'
"U1c
uz4
u#hz
nL<
83M}
:7xi
B8~&'Ao
|>M
h] P
%(Nk
Y_w&
-c9Vx
Jt&b3k
Z*$jD}
V0o
KS|j
Tq=PU9
: `:
ar,u]
Wady=
j+mS@
( (v
Z`d<
>(n$7
bY`jE
|L9th
xZC{
:D0l
ps &
l /O
,`Oo
d'sz
+http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Oi[SM
f 3^
c^h.
G9H.
5WvXa
Qa:7
RLo^
Qs{(
q yf]8CNT
,Ix>
xIWuS
wiNpV)>
@ d}
B a%
e{|<
vdiw,
,` v0
\saeO
y;Yq
ll`'
:>y
pUDb
0<(
i7; ;
@>oc
H&yX
+?j
5r t
vem7
BiL7
sf'It
_CorExeMain
>Mu[
3Bc~c
Jt&;
[t"[
uP
qww'x
4JxW
CbDi|
Evmt
_-4 8
[ZBg6
WN,l
~}j}
# -X
MLm#
H'3SD
ewP"
=yod
'k#co
2P/@
,6)
F*&B=
p:;2
Y&] my
P0i?
:%z.\&
m 6E
bVvq
V8I1
>jb!
-Q &
5RHX
w0b
6i Y
YxRy
|hD)
%9jCq
6OIqkK
1!|76
`(M>o
-5~{
,Rt[\
Kq6_
qYA
V(Qt
V?1-
!gte
2BUz
l3V>y
z Bb
{c1QD
5@7RU
@5P
x[6Q
,~6V
H:UF
35kJ
1"5)
][6&4i
\D#Y
aMb-
~fD$
,R4J
r^9~?
IY~B
HDI.
`]^J.
+vUn
KRASSRWCEDCFVMIABO
au]*zKW4
=OR
jx%*
%O c
/F#%}
=rN$?K
0uU?
HFXgq
9\ O
`WFq
pxv yG
I]7J
Cgaa
NNE,%
g28]m
ts]Bt
R']g
UEO
T~UC/
cpC]
bxwB'
R8l$
N,?7
.ug?
Tl
nv`9
~rsM
q5}93
:C9s
Nxgy
O))0
^s;aq
!.hiS
zj Y
vSUI<
aHc&s=
uEz;
rv<\
fq{ oQ
r( b
oh6&
cn L2B
s3}!
hp8I
VY3R
zT&n
K +3
+4S-j
su4}
$)a5
%*[8
~O;-
nDg
~`c1o
'v .
O|'3
G48YP
PQ_`
8hP7
S`~yc
gnC9
SecurityAction
/#nm
Kv7 r
"[ |O
W$&P
,@Ti
>|h
zr~R
R0!4
M2b$[
W o(
=W i7|
)CvDSd
[=]l
W CI7
)|,gj
g77MR
Ovl"
qg<C
Wol
jgi9
3$ c
t"<]
1+|K0
:e-WY"
LQ,z
f `N
@>j|>[*
[Pp,
V"E3^/&
hhwB
BB/X
(85`
2q\B
$fdfc
wk?:
}&eE
)%^FS
Ptv3$$]a
bf]P}
M,5kC
V0!4#
"u`f 5
%~<H(c
:5UW
"dBh
oKv03
UA/x3
['+
c]$1
O"RI
"Fhlh
$&,:s
j6:m
d,^*
Mh}
v!zlE4* |
w E]
o2C}
iD}fA
Ao@E
c</Rl
a(G*_R
yan<
vRRf
Qyt-X9
`5e)
Stream
tQq,
Dco
~ !e%p
Q-~8*
FDx_
< iN
l9QR&
24pN
150709000000Z
'B'{5&l
S,>
XnO<
FH\!
77\n
\7IIh
|R W?
saN@
Ze+d
9_GXA
Rm?.
]`<R,
Me@1
^Q0v`
Qvn:
yUi
4<Mt
&tQkZI
T3Pt
()P
&NRlY
dNNn@
o?5\N}
2Q!T
:RpF
?N/4
&"s*4
9 k 5
"=Pa
rBoa
tjC:
Dra
P9P3
e!9V`
5@/{
W.CO5
(COR
{a]EfK
2#thO
h ]z
XS|6
BpR"
zVZF
W#v2
6uOa
[q(]
][jl
k_8a
'^T=
7g/7
/6%A;VH E
g_ox
L<BboG
haw!
Glb
J&g",~e
B !Hhku
:$S8
ib
g_iv6i
2jkK"l8
V,DK
4Lj
J\F\BbN
UC5#
I* *
[' C
xEHwr
V(q>^
OvT
z{,?w+
p.l
:?}f
{![L
C0Z[ b
j&-ysE7&/
UL16=
I2X$w
T9 !
UXsL
n]-'
P$ :
dENNW4
D]A>X
#wt>8
ucHr1
w}UWy
,weW
\ 8
N= n
KMW
CML}
*"+ tu}
b5 {V
4G:}q
C7|V
6zFh
v-M#
Qc}k
Ym{S
CBaI
{%!K
A@\.
P1RTf
MY w9
nR2M4
qu!g
a!AO
#ZM[
uPfGm}
7MHq
h"<lw|
0'1J
t~d1
wo2iv
%V=m}
Ps"/8
M~ 1
RoTc
`]ss
xa)8q
*\2'kj
^Iw*
SKyaG
KyI|
<wbH
qG'dB@
if8e(
cU"[x5ds
W6'[
f_gD
*S#3~
< L<
b w.
zyw!
J&;n4
9)Ni
&Zho.
4"GD
'.G=LX
NH`o
Q
d%&4
l}H'
4http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
h YH
J g)hD
ui\-
&rqy
N755
KRJ&
X>-!/:
\>bf
ox'
H(T*
NwhLk
&mn7
yqmX}
cD|X
?8|D`
AD8p
Nv^/
`HSq
8zb[ #p
dp9
\#)GZ!
yY A
6vh{
C^E@
e8NgYm
h:)
$]57/Bo
0j-\
Nf,kB)~\1Y
m>#}y
)/}Q
RmZp
bxUr
wey3
XL"Y!
6<;9
,.$_
A< 1
~L9|
o "E
!jEn
3ON@>D
Mozilla Corporation0
Mozilla Corporation1
n`jQy
_-)Q
:;ZQw!U
^\uws *q
.X^S$`
q $7
?(?2p:
BO]fzd
/*R&
.Osi
[7c 7
x*6(2mD25]x
@5va
S9fSRw
[_`]
]/[-
L^,/
d\IL>
r%wz
=p-2
@S!2
VVX*
;MPa
MC~oB
(;dS
4QpH7
b, c
>{I;
qNSj
%%ln
,7K.'
f0wg
5>m?":
omFQh
Symantec Corporation100.
b0k6
]C5+8
{,J5
&z3K
@ Ww
QzT
e'`5
ykr[9
*?0}t
+-}#|
~q7#
;WKz8Ti
"&.d
_jC]
F$Ks/
W+[Y
@"h
aHU
U&hY
-ICI
:w^Zarv
a[Ns;
>2N_,v
kkj0
W1>o
XuiS
oimW
25 3
%YjN
&FC
7http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
'_us
lO~`
4O~iP2
N(ser
X(lV
}F3?
Mountain View1
, DN
xG
~3k3
2z&O
MEy)
2UHs
;h '
g+n/
E+u&;
<!$U
;CfZ<lS-
s:m@
\}*<
RJxl
+r{m
H=If
%a?8
*>V`{
Y sB
(xFJ
Dgt$)
r.BfS
JRKKTCJIMLKDIIE
a.pG
K8z1
CTe
3 N>
ZFzP4o
<}yM*
#x:8C
b<BTe
Os^][
2V;R[
N"^-
/W69
kxW2
)Wd25
!&_x
TaD$D
\vnO^
$0?%
T?VUe@C
1W[uVE
").O|
mjmU
DQKa
tq_ucb|;!
k J
v,<~
+%y;
PEyw
bQM?
[ m3U
J)*o
U@J&
w<*,
mJl*
PRoG
t/ |
A8Yi
zB"n
Vm;?
Qi!F~
*7rz]
{-D*
B-E)K
Zi_\
kyh-
N 3h
t^^D
51:`
CI, $
81 <
SPR~
{sMMC
1;V
G<u qG
Q Nt
eJ1
ONNg
;a}t
$=/*
Z,)v
IDisposable
mMfN
@n ]$
nUW>
P\|J
\>DC
bAlc
gFEd{
vKZN
J9m@e
}aWF
]]Yn
DPQK
*'"C)
f=a&
\gN*
%(W
`#IS
-+mfM\
_\x`
BBSwl
DubF
OQW7
rhrA
11TL
g-@Y
da_O
FeEA
.M%>
543?
f Bi
HJR_
rtKei~L^
q0S;{~
;eFV
Yo;|
Zh)
?Eqy
vfI\t
%\j*
LZv,
bkRK
_v|j@
,491H
XK:3n
fjlO;
OV0
Cn*9
@5H?
< }Y
ZN >
w~oX
tast~
;[w>T
b*V+
*" b
3dJQ
3.)P3
6 lF
f+T^
6=p
s(4F
sbER
D}=+h
FRa(6
IdU2- 8
M>7&
([FAx
u?2{ad
G.@u
tm%8(
\+[R
KZD=
36Q:
cDR1D
km[Dy
4rS7
XV777
!$*L
igA;
?Nzo
r.@:
i?=_
3E4x>
`k`
h)#
3q"t)~
mJ4%
@1127{
:m|y;m{
p1 e
f^7~
J8*(
vM6\
HOy)>
Rryv
|@>8q
oWd>j
+!ey
K^,Tc
eb`d#
Wp(9&
,EYdB
hZ5(
k&nU
JDTH
T7 F*Kf
cRm\
*/ _(
"PlB
<+kl
[5L)
mn9>b
8y i
~8,'
3#$D
LgDB
nvbeR
pq]DhS
U% /
:D*U8*
/ypf
46f)
QvyL
u ~i
(Ym
b9"PJ
7vlI
eS+tK
:AD$
F"w<0:
}/CP
3;he
`*Uo
-jRL
Un{p
Rd@5
v> 8=
BfGk
3t`M0
wm.S7
vy_$.(
cc#t
&UIa+5v
ycnOVV
vY>]!
@XQ]9
UlYZ
$p X
R|5{(
Ea5X
!;eJ
;s7[
Il|((+.H
, +L
S*`Gs
##X
+Oa3
mp|n=
4w~J:
[= X^
,,rj
C Lg
X+*k
uGlROk2
7dG#
PRmT
XR<4
!?v
J' Ec
a9S
V!)F
;{p
-p}:
#Q6}6
https://www.digicert.com/CPS0
Rf h
[jQ
P!a"
>{'K
+b=
x$6$
ToArray
5"Wy
-- H 0
`|v@
#0\'
hc.^
erDR
}I1xf
tDxf
'XD~
M-/"
A;/'
6Vi#
h@{8z
=eo2
phG
MkG[t`
E!3i
}W7/y_
LRZIMZQAEZQPGGMW
uUR1
;C+a
[th1}
~ gj
e]pc,
\) \
o)Qm
?[+P
v'juk
_oWWq
Mvrr=Wv
~yBCD
cJ@U
LH\'
%(3s
E.qC
iOuL
SiX#c
BE ez
%?m/G
+ux+[
owJVg
uJ7/7
uGgQ
Pjmt
FW!}m"Lp
#ZOb
o / !
4@1X
:O:xP
cP9p
Af:8
%,
6yPA
% $T
-)PPU
j9&."
`Oo2
Hdw}H
a0KA
]hpv
=HG|a.b[7
v~48
4@g=t
KKxw
kEoZYd
wYvA3
Rq_H#
?6 o'
mHN D
k,$G
,4Go
345o@7
tE(]h
n4yu
06x
}K<`
2a/'
v(lg
8U8)
;:s5N
{fbK9
qH>A
S3$f
RPI;
oSaSs
]>{U
%n*c
yk~a
_]_]jdh
[qrP
U"bx
\%Es>
_q>C
KA9<
{Y~q
@.n#D
VA|
v;$&3
WG")
Xvf,
-/1
9Xw F
Arf0
"$AV
pLN. 5
ts'(x^^
E =R
.uXi
c+O'd
v9K3)
tnfJ
tq67
fmAr
y 1R
h5o;
fog<
Jmjw
x QL9
)4A6=
d32v)
;&/8
sXzk
TTR?
7d5
\%?
VVs97
FK?I
.bxxx
|Xg:
@-Of
1t &P
D$ek8G
Mr2
\ef|
j2'i
,{f"
_D {
>d:f
QJRLFJWRYTLYPX
qBPe
]i*>
* u*
q Nf
h8ss'
gn#/M
hTB0
mTp6
Q1n3N
AsHg
ga3E
,Vxm=
pHGF
yD ^"
{uU>
JVYNQ
(3>-
&bF79!
k[?n
<N9z
7 (T&
(gs#-f|8
che5
"gGM
-5|Bw
6 p!
pz^*
J0pz
uEv=
irn(Cz
I,$^
PRJ1Mr
a$0v
0VP\U
BGtD
kA#
&*Pg
Yl"@f
m c
s7S;&
B{o;
,H2R
ZX L{N
K31 v9
SKlU
.qV6KD
*UBH
o,?W
a57ir{
9<Vs
Ie'\
hah8
(SQmD
n&K~
WZe^=
mLt"
~gl5
3BJw
~& :
TXva
UfoAq
gq3M
M<YML
{Ei2
||k)
Y ]R
K]k]
8g!e
C q{N
sJk#
.kaH &
)7eQ
5|@D
3)Vq
!X 3
hHc7
j3/
/yMF
@?:#
e EJ
]] >
qDg;~|-N0
*I}L
NS9s
C@0mj
TElxm[Ub
ZgcK
Wc0J
dvoj
N7=t
ARJFWIIFNC
33aO
s?#Vy
Xf#d
r8wz%]
y=7GJ
s= -G
I8HM
b1j"
yPS
33$T
+1G7
1ebs
pw OS
t&?
sXB8
I2N
*zcwhV
&*(#
2 ];`
AppDomain
p-mG
KSOB
U.hD
F[YQ
.Mf b
' ~
'%[\
je6+
g91A
qA l
oT[U
6Pxm
;J-t
u+A6
1-~o
E ]A
-$Z6
\U"H
1O&#
%?}Z
`8y#
JeIY
b] DfEK[w
3~.b
~ 7
/_"m
fj4{^`/
=tp8
iaeI
5)@s
nh4a
Fcub
!=Gw2$
h8h$
u9=0
B%:
d>E{8
8'N1
\b5`
o]9&t
Ibh?
gAW
4 ]Av/N
&c?S
bF +gw
/+{
d(6k
hw7-
klOoUR
kSJu
t/CTD
+AL0
dn9j
-V~ ]P
>}h:>
]+Y&o|
niPp
WGB7s!
)W@l
a85,m
)/l{
=:be
%M+
=0K
8X Al
D4_4!H
jRQJ3QL(
0"pM
*Owsf
67@ub
4tLX
4 Qf
W3 un
rIV^]KQ|
/=mTz6
W`q
r|>K
.]Z
UX*O
s" IRLR/]
.7um
}1p8
^=j6g*
JJvq8
Yk)=
9kD`
f#?|
PMZh
j/s)
@I0*
"':v
$=G
-YzS
PQkf
%7%?
{Ol{
$.oCS
2K.4\
?H9s
$h'gH`
*Uqh
XC@,
0 vTh
Sy<"
f_ )8
Ve-x
qoLp
0BUM
z\Wd
t";
Tk_wH
uF%'
D%lk
SSQz
yTn )
\6z&
zAcv
JMO8Y_s
180m@
;Gm*
+CX
JI6V
ZDc}
>D5<
:`aa
Z/?J
j-<2 *
@01-SjY
/("IQ
k L[
HvJb
nH[t
n[u=
pJ#/
B2;H_
f^/L*
;iUA/s
qKc0
="u`
z_2KF
f3P]
lCI.[9
6P879
I>:2
,0=>]
UIPC
@fM+
K+.@
XT43
>D5q
n))IIRq
=*!7i_
T ,
i!K<8
H(mO
^malS5
:z*m
#fL
?zX70y$XfG.
7~8J
AS`Z
xh;t0
Yg5]w*
;il$!
XvxVt
+}j1/
3adj
l8bH
`aGX
vWf {1o
RxB*
Q1pQ1
3[BV
~Rih
|Z>0
g5hU
e(h -
\eYt
'm,yTp
\d#&
q:*911
]!p7{
o*g6
bfnII
'2,i
i@;
C$V8
k:8O
~wGp
bj W
8/cG}e
jVSS
{B<d
`s9X
1kaA
`h]*
!_##
t0q1
ZKgW
e0@}
'Gi!~E
SkipVerification
N*E?
X+s|
FIt ms
&FN=_
e`_*L
}V9OXV
>C'&
Bf&]
FX}a
sXr%(
;_,q
vek)
re&6}
&sqPx
TD<rq
^ED@;
/|p
TF(
7Daf
UAMD
?hpN
D[B9
&c^#
9ny
ras
p-B4
W!'6v
Oks!8
+ <
nV]=v
}/?e
&"[ZzA
_BHs
D-/*
i>%4
] #RY`
hEc-
s jYc"
1a[{
(tf"
Qqk"
!<rj
*E^u
`.rsrc
nEZ
Pp<y!?/
{8 M
2vWYd
R[o|
i* p
JZf
P]b$
P9Pe]
2\a},F
TQ! n
z|Kv
gh/\
4TE7
l.B6
HH"Y/F
K8+C
iK$%r
DJBX
Zl>K)f{
D11'
rszd
]uex
$! i
RXA3G
\B >O9yVP
hO]
Wv:,
<k,T
^]ON
WCOPGSDKWN.exe
j*joJ
x12#"d
{oY@
1[BY
X1`,!A
G[:"
j:ly
Y\3*C
q"k
vU/:
I=1bGQlD
#9N>,
~ji&
\'x#n
3&UR
]`B@
JBqX
Hqek
]?=<
]0Cek
3 2l
L0`W
y}Q5
*|RU
i!>IfP
DK@i
uvn ,{
TN<o
g=uZ
}{b
DhM;
%&$'
,y[l_
E;!(
o+)U8=
4GLI7
Thawte Timestamping CA0
dY*@2
/555
\YilEo
Q\][
k i%
{ nP
dUwN4
[#BX
\C%cO
W.r+
CCdl
1QXY
B'r?
8-vu{o
0ApB
H>cg
r.g;
o $u
~/ N
tc!LT
)U`&
g =B
wG6P
0&iW
1QjB
(atDC
{[^e{
SLPP
#g=;
u*@
_4@t7
X6e[
j m|
,$G4
s(4,F
N(H%
}nu|
znl.
g0K^
JbC9H
|4+a>
(KQqs$,
u M6
._4t^
CZ(R
"J:JSi
aF^0
uZY,
ews[
i.(1
kb\n
.&7_0W
>&:&x
u BO
(QP:
.^Dg
( ?|J
%|<le
sd=8
+]%)2dN
`W <M
_A^G
p"35
VAJXi
Uwfn
:e)qla
6tn;
~ L5
t7BJwz`
w1>mltt
JPsh
GUWu
.]M.Q
j_sC
061110000000Z
B:(E
gvSJ
LacJl
|~fJd
6]QK
Mj _
&;T&
V:H7
Jcls7
qSR&
94K"$
+`1%`
!goGRS
p?qn
'2*<
Uf@E
`F/7
P\kU
RX8T9\N
Ia+a(^PE%
4*\R
=!arI
{b544:
(?; a
0'XA
t8|sz
8eoA6I
YP][A
Z 7O
k3:C
33_"
vW-/`
nl&
"e|
F|}s
c.W{
owgN*a
2"}eK
jOFm,
YQW~
,0R
d] =
CuF{
P3b
|g e
))1!
6Pfg
1r=)
[)=C
7Di-"
i(8-
O {?o
VD^$
Vv*O`5
gJ&hvqu7
(cw%
Xw'se
=NJ
Nk$dg
f aD
u<:h
QDDQPHRHWXOINPINDAKDZULUH
UMQK
kk}C2+}{S
FUOg
*Co/R
s( }6m
nu4T}eU
~Gv*_;m
NM@
2qFH{&
k(&
fxI;
#~vB
iuG?
l{Pu):
iXD7c\
3E~iO-S
GMKE@
e<`bcF
~-t6!
a/}A
mUl
u3sp
311110000000Z0e1 0
w $UR
m L
BY{n
Abv !V
FRIKTZBDFCPGFGCBZ
#Strings
E_HWY
/./*
l~j{d+
(WC}
;=yg
SPI;
FH 5
lS.D
Lq]d
TCnZ%
##-W
)D;{
93Q_
a"KH
[]u!
:7-o
bShI[
hBy
GJq
XN6
>EEH
}"(G
x<09|
:_*@
pw4w
s }1
_R-r
DXRy
C0`^
B'"e$z
f<.p1
xtWF
B`:j
B5 q
Kr$X
K`t`D
System
,31(
4Jg:
{~ / ]
B>8{<
q'=~
kf\1A
S*^dh
L %#
>_:Z
%=#\S
d/#Y
1%>~]
Y|>9
)r]~QxV
T,=P'
vvc.
wrwj
?,?(K
9[Bp
;dAU
-ewId_
pfWh(
rHUAB
ati-
f2/]
e3q9J
XJTLRCVNBMY
$~zqF] "uw
kaI_
$D.v
8\PW
j[jo
*2b3
sUu(r
(Mq a
|bl-v/\
r#Knh.
wE)g
nkJNa
nV&$o
Gj.@
z<c #
V 2I-G4
]A?z
gOHg
kiia
wW1K
SuZc
? 0y 6
h=H3
f=@'
9`[1>
$MKr0
c99r
u)\
R/80L
fb@l
i)972
\\Y=
_ Nx6\
150W1
yW)Q
jJB!;
%c@k@
{6I\3U
JG}u
w"qq
^<<t
O{Q
oeo^
+nn|J8
& SO
]E.`
]2C-
4 ZCq
RORg
aCb6
^,ji
4(&+s
=vRL
O9]$
}Q<j
/8u~
}'J}6
eFW
5 HZ
oe:S
C$u=
N-0%
nij[
(Qk#
g ZV
2O#g
\{my
$9x
{vDf*
v9*\
C""@cd
PC%\QR
(T Z
AW9}
bAeM
||.R\Z
+ w6
2'2g
>OsE
XtQj
QZ~Gt
. e
=)by
c Kb
BY_LM&
RQS.
y<s|
)Qj
+ .u
x8^(
|:"{
/O=i
5>~9
ftvD
,g9[
cLv~
"K+F
7p!j
,xe5k
&ir}
Pg;|
298_
gUk"
uuq&,
$W]DX9
"O4'
Gl4}j
>}+/+
{;nw
J59x
b{y[
3w_(
P;{S
+0i1
o(0 ?6
~t96
System.Security.Permissions
O$=R
!)wsx
>FY%
YOe.]
GBIH
ubpOb
bsy9
L^&m
`kAp
z IC,
tdX/
* ,8FU
YSc:
vAf/
x@_9
BBM*
a}tr~
c*?H{'
y'_/
7`{M*
!}dbP
/B{Qb
6F |pJ
~+m=
vf[g
~ST:Q
_D ?
GNO`'v
X Fh
*Slh
\n;\]
"i,5
}\=
[_20JZ
`e|&
}YYA
kG1P
X 6P
NJn,(
uMKt2u
GNh,
3H$b;Sh
U.$
xFGo
HF?&
V_@hM
4VU1
Xa*b
.:&a\
"<\
0S +3&
G72)_
-#sC7
^7za
I`j!
zH3cP
j\DK
,&=_f-Wg
&|7DE
q 5:
$kR,
ygf|
KT8p
TEL(Ym
YcZ-
RSmG
mL1=
AsLZ
_^,f
Me)g
bTL]
)1GW
&':.|
TF-1gp
,7U=
?>Ru
BtTD%
5U/Eo
6h=G
1lj@
Un;,
:`Y
l4%.
W K]l
`E_)
Oz
_'(
CkUnd
d-Mg
Eh>h
k488m
. a
[S 0
&LX,BG
!pn&:
,IT\s
@<|^
%-me
3MH9
xW*g
b|-|
4<;7_
TVd#
3x%|
)8E#
bSI{
>6FP
}`8~M
1{au
;Us
AKM}
65~4
\Sco
4wo_
6J1M
xTfj
&}m#8
8e^7
ug%?
' zq
iU3O
#GRsth
?{A>
pp7'
Eui^I
IPZEw
2B^Y@pZ
v9*Z>
Q?`u
qfA!
'1VK
o9DO
t .
# s
4FrfB]bF
E]WF
?EHm
?EHh
ak }
0;k+
,C&
>|'v2
V{N3
q/wV
aK lB
|-Z"S
7CDD
-X4Aut
I(l?
-.H;
}jK9
7 ^A
Fj7Kl
CbK6
><"
v gH
oL $$A,
Krn7
AC;A
( $kVhXaj
A7x>2
Y8b.,.47q
f8#v
_cW<x
6^/E
i7;N
hXGh
wY\f
r"]Y
?min
[Y>U
yVeW
` .o
5"EN
68:s
$l6+F=
=SK,
n.[K<
X8 o
tyVF4
l`b7:|
*'7N
u Dl.
z6ha
[6JzZ!
args
Rg<<MZk
7kT3
VOU 2
(y%`
[T\%
B8`ddd#
U@"\M
WG"
<\8
Jm4zdU
*Kox
Yy}k
XXS9D
l>zk
$&M
=.sL
T{GE
<*K
v;?$
"/q
JWWVWTAB
N$;|)
28Q8Be
.dj]x
A<&D
\JvdeA>
Xz+^j
chtN
wcN2+
rinb
PgR Z
2|/
tS2z
N2pF
}-i6
mkU[
\?nd
8\/yg3(
^$P
C I <
)$X8
BH\}
uaOB%O
MyBt1
{&>~
$6lf
L-4b
cxdF
7n I
`isr
EZ=Q
TFA.
T#e@J
cpu'
*ZU4
C NG
iBLQ
.,9 M
g&~s
*h.A/
`].^\
@uD1Bq
I *&V
K {]
$6lL
.ctor
5Ff
_hc1?
%+x.
N+kD
Idm
9OHc{8
,S8
U?Rr
sz#[^
pVu}-\
:22=
\ /(^
lPX
N7y
(UK\x
JEV
Main
:5W.^e
w~\n"
,tLq
D^)_
H?q[-
,X`u
a0?&
Jnc/+h
s700j/
yXD+jc
!L!B
* L*CN
6woB,b
/xvkn+
f 6{
i2'iQw
'nflT
qz6sq
e(Y
{ Z3
h^oz
_#jO
dj (
p,f}$
bjxR
/Jl#^
5CT
d&IF
usbw
r{Sre
d,M!
@.reloc
"$r4m
jh N
i5yo
6^W9
]7oM0G7
U)yb
5//!
+Sy
/?ja,c
]"7b
IRe@.
CAm{
O(tT
b>q}=^
EN!F
w_j.
=> w
[qVE1`
q3 ?
Fq kn
s\2xD
6rbu
}^f@Yj;~
4<x[
PGPf
$@[g
)YFV5+
mA3kZ
(U%k
z!H !
!r}#
In)6
+2UE 2ks2k'{2c
dsSM
v>36Ew
ZgB8
r|-O9HT
M-)>
+Y2
d$sg
jN]_H
LL03b
AANHJKLF
-Fpf
w?|a2j
Go O@
6fB\
2= 5
TG:U
Lwu-(
n[yb
eMHt
V X<p^FVt
|<)8
Ylq#
#V!T
"!QN
t(}+
`mhHg
_i4r
R gr
(Taz
Mp :
"p$#
j;.q
,':f0Y
cj ww
#D ~
G m^3
dh>H
C{i0=
Yra\#I
|LIF
N9x#
!Z5T
lDXIZ0G
?!Ty4
h{qF
GCFPQTJAYMODEPW
'{_OC
iGVH\r
x87
1yA@
F?PS|
]GHF1J
0JK~
6sDW
e8|&
D.l-
I@'*
0C`;'u9
9N+Z
t P.
i0tiQ
H{`H
Z } l
-]'#
u&v6
lJ=TV
SDD{
t1~f
iX2'N
8%?a
v "wX
Bmc 5
$1?_
o4yN
P dI
2"<k6=
a4Q&4
9(]y
K1}(
k/W253
;3'?
eC lm&(
1t4d
&>{=
7qcp
W:XA
3T1x
R"2w|+
@( i
y b~
~Ua_
>_p!
8>ms
=""N
`tb`
zKT
YwAM
ECAI
iCy
USn(
a3"Udr
cc<Y-
H.m_3En$
Jz}*
}PJH:
U%&X
zI'Z
jxl[UQ
aZkq
~i?!
s'"pT
5]M^
ML [
Z%)
T/KD
`X39:
4=(RP
bb#J
A}-T
g,6%
AQVHb
)rir
.Y[Wg
7`~d3
Wv'I
! u
.s
/\.k
JH#
hnzP
'Y{9
Dic"
/O Y
TjX_1
/{Y|
Oi#F
x@Qo
TW1?D\^Q
dzy
^Y1T$
py7{
$~2W
aP]n
M|zyleW
Tp~<`
eitB
4F )
z\%Fb
$<y
D7Bb
P"U
d__B3
E)8]
~B Z8
`"A1d
C-F5^4
9fXh
,zEG8
kRw7
a!KV,#
lMh a
j 1f=
: 1*
%W9*
W6 ]B
xc|3
IEDYKKFUUUHXX
-'b"
+%jxS
> >es
; y
3e7;~
Lk(9
_ ZN
VvOH
&9 %~r
o]OB
Xr O
r~=-\
MT?5
=:eK$
4;g~*
Kbg-
8`$%
(0Jd
"gIC
gDr|
-sH'
Y"fq
4FRu
?(&e
up MI
_z<1
?wX )^s
h~hPxx
[-,q
p&[z
Su)whO-`
q90.
K<F2
MD TWa
]CDk
`*(/
TcADI)
aC6-N}
V_:w
Dw .W
QR%E
y{2b|
O$k
xc!}
bQUJ
C9U+
46=(
:j^>P@g
_UW,dlg
Aw0fJ/
E-V+Z
b Kir
q/q<
<gD
~A<#0
URiu
5tx1^
gE4+
\V?i
6q):2J
{Hi7_
LP2;^+
.fhK
\9GH
FdX$
h+^b
n~=~
e_(}u
xoX>
D&Eg:U
.|7_
KTM
3z`x
i8O=/
1R-e&
(z<Y
FlqS
yhY]
S Vzy
)TWjU
~S]Y3o
I. %O4?KA
lZ'1
IG[B
A5y_
@q'a s
3yU7-
ITkE
65Nm"B
U GW
~yw"
d?i^R
t^;_b
Y9*J
HgnY
)|yF
~EnC/o
<e[.42B.
bytesToDecompress
R4^y
Rv jY
;&x\Bx
5mba
\ Co,<
:7C
aBFW
"W8;
Fz-q
n;z1
g1<C,
loYY'
Qe|jp!7
7lwX
v S;L
-Mt/,
{ a"d
6tMv
:11C)"
%ESd
G-E
l ]
kPN]
e3.4$
c/hw?
3%US
e:c8w
/psq
gnD@
82Vmhm
e4e4}
aQ2l
z{iz(
%34'V
1 ]N
n7Iw
D8DF
{BU;J
>>H]
k)q:|
ymw
eQM
+J[c
UM']
CV"
pDf1
)*JS
N?-
!cfk.
? >s,
|xC7
YR2#
v*r7
8JA!
y&mK
qc.,
[[ n
m|aBK
\`-J
UHLv!7
!HWa
&Lql$h
7lV|
+n"{
,aA J(
9k!u;
QMEjk7
sp:{
8R`22
odo
DmzK
8&QLs)o
~Coh&
cKKR
V4bV
:z>,-
]/{e
LXNSk
49F#.
fu'6
$=3!
?yoE
m_c)
ixO$
r,j/$p,
"RZy
tw1d
VE>V3
%Z/#
F5A
BW/)
|X:)G
D[5+
[3k3a
An@(7
CompressionMode
nWU#
0Di7
2@d{
A9gW3
{xG_eBO
j ?a
4K"Y*T
Z4x]
)}kV.
9#[!`
W753
>_ko
-tTk `
MOp0
/9G7lk:
# \{
SE
7 H }
5wFI
F^9L@
So #
:$I?
4NYH
WAdE0
UPz%
um&S
}M1M)xb+
hkhKy
k0uc
A"wc
= q>\
27[I
vF;
Ar9H
~Z7,yw
\M0/e
BC@W
[$cO
0 `6h
`HEZ
Gs)P
S=&,5
gSb<f
!mW;
8CU]m
%V#O
uO``
n om
x% ^
c1GEb
A!<rtf
=1/U
>nq
J^)T
5/;x
a</=
^^|`
#4eBN
R;J,<
zpg
s~hh
"z0U
CJk#
}&Xn
),"4
e8~}
}c;_P
>oLq
;dpz
$uuf
{%g .e|
7}9
4EQk
z=G&=W
aW3n
DUYCP^HW
KC>u=w
LZK'
>'Ql(N\
D2si
Wx:!,
qToW
cz[\
* _I
r%G$|
f][@
QNsy
W+jr{r
88]W
a}7f'LP
dK|LFU
&m`h
S@ZV!P
GL4R
t~=-PF :
3!bi .
'<M
^.(^R
f#m}Y
1lmX
N. l
%!8A
c3EQ
G@aU
jmtT
Q{5dms
_Izl@
IBr@5R,
-lUK
<y6z
g))}
2 U%
H%C.B
iWAD6
i~0/
s`1+r
3* f\qO
W +h
1!yh
yyt)
'P">
Brud38
N7ro61rK9+
>Go7
aW!SV
V.0Z
!l4u<
t#/>k
[+ J
p`qE
M|/0
d78a:C
UZ.T
>@+_
>C*N4
s<2K
,^]hl
r 2z2
% X~
akV
d[&(
mscoree.dll
:]}+#
/WWz
"as@d
dqb%
Ri0<
92ty
Q0UQ
Ql sK
LbyS
ExA{A
]V_|
*h6R
l mH
Nd}LJ
Go[y
,ubs
Y<"hC
>=2Y
&!5
^|j"
J1-M5[O
,#eD
uJ> xkU
-vE#
Nnb
`nN%
<hK=
FL<j
jns(Mh~
1>]i
Sv_;
`Fi8
#GUID
aEgT4
s8Td[v
w+BF
_.C(
j=ADo
8Dde
I#%:9
8S (
?>V^
?9:U
nz[5
%Cm>\
ne46
R _(g>$
M^R
f'@y,
?u@+
eJFj
&"$&
q+G;
>Mbe
&cDX
MGd
gzus
y| }B
o*,66
yBg)u
~9 u
[1UP
D}]b
@$P"
[H+{IX
OqI*
T 7t
Z?lv;
.c+1d
QeXn
Y}]\
EB&!
<`|
_Xp3H
%k{
]yd8&8
T0
XN&wqb
G m]Q
'N0|H2c\
w[*
Vw#K
?6g{
n$Ve)
4[n5
4[cK?
3UN{
#hH
O^2B
|Ck
,{tT:~&
z pG-
Ve%D|LU
w9n.
lGoY
b4Nq
hd*
<gA i
7%H>
t@f+8
5<S E
?G~_
*H$:
=K _
SgFwX
~P^Q
!4P
t9< !
("Q
Q$F2
G(}Z
6_e fh
u/]k*
Z (*
CP&D
=8\X
wojH
0e\ob
+Wb<
uK&S
(:^,
tEA'L
v=B|
3Z\g$
vbKJ
B,{DU
_/$*!oDf
6:1<
N4[3b
(D$
*9Z<b
UQW8
D~Dr
,= |S
r"YM
fk"I
xj<#
$_^[
K+nY
HLa]
|xVJ
ir/M
$00kG
\a7dH
99@/_5
K0BK
8 Y{
'mgm;
qr`o
_#Yu4
u\@h,
Cw^Y
X=^u
cWLU
@| OQ
Vz*{
i(}=
HZJ"
T&Z;
pX_U
~P ]
HOXr
5{;-t
D/q+&
Md0"
a;IW
cil 0m
Ii9}
6he~Y
/2>k?
F$^gb
j CDH
wN n8
W y'p opf
]m&p
C--U
~7k3.
hll. bA
2.0;
$X2u
$qU2%
4"gi0t?a
7lup
93LXF
PbX4z
d0?R
f D-+
1}j+
@c0[Rq
dB,
@mRc
2t/M
cQS
pW :
,-bk
3 F?
<pS5
?'9T
o9F%\
g@\W$@
K2d.
bZ{)
:]S_&
4}_s
mp@/
u\h
wsqZ
A)E?
H~Yk
$<V{
T$ `y
)Zjd.
%:r;
&1 R
fJF
KO j
1p9]
MW? f2
V> M
V> K
?jM
~}
'{AB
t]iq
lS4[
{a#2
8,lW2
xO~<
:A^'
VwfVxZ9
S&M +
Kl\E
4Re<-
L:'Z
fBP.
>$c=*
z,t;=]
@ch1
n*?
!Up
*?p!
/1Nk
E8M9
)iCG
J5w3~
MnI;
[$hYxh
q 1iv
i) Yf
2dALL
]c}6xG
)AG01
Q|D=
iJy
FZz}
$lS
Uo$~?ow_
.['WVF;6
gdRK
(/Ae
-M54
5AMx
lNT!
RSZ}]
sp Z!
j`PX
`8ID
;LSWr
` l8
%pa;
-&t
9EfN
p`5(
Ncv5f
}0/ v
y**d
6MDw]
{vQw
5m(
fs;3
:fmyoJs
zFkY
Os !@
iN/x
^##NF?
]I12
,yk(
9)/D
b'S"
K@GW
(_ ;
I#I3 ,]
BU%/
XpETjr
>:e&R S
EAc<&1
!_5|Fa
1' a
2^#;F
9o(
,Y!U[
%zWX
N;7n
Rz !
)]}8tDC
0gtkk+c5&WdJ
`3.0
| 8
[#@;
hE@4
d7 H
<&=s
y p4a
75b9
-7s
0I
k X
(*W>
JV!2>
%e3!
}ZJC
"W*o
/dn4N
!{"ff
m 7.
yT74
%2,h
}f YU
bfOSC U
@uE~
x.YS
P63P
Jad`=
1dO;
7};T
Ufe\
M(C+u
&5 UD
;yB,`7
/VG >
PK`)
\Cj,
[E;7
.,%?$?
%.n*
A-*K{B
M=T+s<
Q^HX
XYA}0
hR Wj
5MB"
R;MQs
(.7|7#
,XTD
K^I[
BX8+
Z~-#
9#uT
Y~W`i
>QrMH j D
n#?nD}
C @Q/
r]yS
rtNX
9ZN;
Xc!c
J\_&.
<|1R
uU55
KUx^
b4kk
Kryx
R@\>
pb &
?{gq!F
p,Z)n
a %
^REG<
x)5h
;UU
h0rTi{
ZeRo
&~cE
)7 Y
B"1cX
<TB%78K0
`Zh0
W//-~
|I>Hep
?c!Q
#yk7YSW
, +
W z
GZipStream
XI^
yHfE`;
-y^R
7K;,
o] I
!)2j
+o6N
r4}
Gm#'
!;X>+
fi'0mc
ZNye
*}XmQ
?YSi
b}=5-
J :#,
nYuO
da@m
)fEi8 J9
# th
f]63
l8 1
9!0d
c4c'
]V?_
5EjY
` U~A
:7)
K5B>
KiwIH
krvJ
,+wb
_izhE
X5T}
s[{
JzGyx
M"KV
4hXi
Y{YIU
a)F*
GVH}1%l
,!I\
utxA
c(m>
BcbQ
G8l|
)S!w
sfNf
8K"[
v15!
urt<)
*k,h3
,p60
F<^hyF
Tja=
tK7@tv
#wC\
g3|S[
q)sK
e|k(F
e^$:
[-)L v
f]WW~
_jW#
h/`R
Z#aGa
k-th
q,OZ
?HVy
J?kR
#Z),
5$:X
lPje
UV$
$vN<d
"7 6
EU\R2
0^Rq
\1N8M6
_/u*)
.Y ~
:Z'Te
d% ]
C{=pn1~
F6U0
6u}?p
WfC Y
=j;lH
{|jJ
g #.
|wvy
"r4?2
'.aP
4kM [
DXeI
9A `|
X}^
O! R
UoL!
D;?
Qs&#
9lV;mn
P[HD
08r^e
eZ#
&2_1&
vXQ
LZ
$[[05
5=SnHRz
N`i`
}v>1
Reverse
b~t:
>e64!7
'Wa
M].
}b"%:b]U
::[#
@eH(
t1l +
g!6:
mme&;>
VbOj
eBUW
3t|lLs 7
(I0`U"m
`?Ch
k8~J-
?t/"
e*tw,
_Z)ET
A@^j
]Q'$z
cN]6
X&HI
#{J!v
)I K
[%B@\
5fRt
A 8$
9eCao
c6Zt
Uss\
E&R
bZ=Cb
H4H6
x?yr
8T{*
&&C,~
y NJ
0 ]U
W[U4
==]n
)Y\
@ZE7`
Vs=e
>yV5
7aW!
\m Q
RDc\u
z0x0:
c {
`}AN
C @?
qby* R
8\ ~
NLVg
'+,w
@Yp!;r
^ U >
nK`4
P$i8
i-as
YuKg
na H,
n2F)
d%OJ^
aC"n
gu9_
3V.?
R3 q
$-=) w
7Wm
{( Ql
DNAx}/
~3Nv
GF&K
E4Ky
y6Qk<\;N
!^RTM
5O]^
O(6q
n9je_&
yD`$
TW%O
| S
C\ea
M_t&
u t%
e 6l)
%xCYY
fO <
[H7@re
U}Rn
o7[7
[0:D
$yTI
pH~+
tw5J
|agY
{Dl
\gav
7i/x
.2n1s
' (p
/RI\
`t{x
RU[Pa4
qs(2
HX*J
eBhx
$.:Q
GM{'
Q QA
$4bY
@jV)
c O"
#:*6y}
'&M:}
]vY" \
:0ySJ;
>:ZD
nI-t
zIe*
2En
0zZJ
0"X5?
R8Eu
QgW/
>*8w
w;.4
AhkT
u\3DT
Hg2<
}Jig
?mM[!BA
*p4V
O1tkn
dGgoW.
u.S/D
]w9B
>I5,r
i&t1]
nnnab
N.u,
y^sA_
dc;
Dwe)m
.5:
4vT#
,MYX
Replace
K oip
9@G
lS%gN
i2>n
T`Brt
S!b^
V7B4
B.E/
eMR2
!><
=Io\C((
6\oJ
Rt[a
`Dz=
^ib}
70{bv> |
gVwO
lga
eKL>
"q;b
V,VO
))ht/
5%ji
,YhVf
4Og7
`8I>Y
EnAgD?
^5]Y
[Z[^\P
g~FM
shgY
( B_
sMVkdUP[
X+M"
i<k6p
l rU
q{5t
h'SI6
>y">
_2oHo
F^yj:
tpgH
X> x
96 c
i}G
lN~
*(cR
w> A
Ctz6!"B
~Ca2A
YbDr
IhGP
4]0G
'^Tb_tR&
./&|
Guj-C
r "Pv
%[[Q
Wex(
y.=fp
s/n
=4Jf
d]P`
Mh5#
~GH
G:f
5!_?
^5vP\
:Kpb
PCM?3
-98C
tu'#%
$+X$
I<U+
jdU@)^d
}ol Mo
"FJjpw
v*])
w2~-
kTW=U
2'.p
lwi0"~|J
1t2u
@ms>
)|"F
3:N:@
http://www.mozilla.com0
{E5P
u=wF
U7Ea
9RC{?
U.$\
2 1H
JhNOR
$X-q[
XFO:G
CE]Jg
}H/q
8A2[
?s)
?}hj4
aAy)S
Eakj
n8[wL
(2bd
VeW288 m
46^gj=
Q(/{Z
|, fw
!AN_
i3*6
3>g*4
{c]2{
-*uPP)
'Tnxu
Wo?i
s+K<
q7Vy6
$"dU
1 rFF
#KplM
N]0?
;\snU
u%wl:
TimeStamp-2048-20
ANsw
z:mc
cM7'p
P\1z2
A8h-
HGX_
>q &
(k,l@F1
*z$^]
FxTV
&7hc@z
VQ]u~
#Z3K
I;]E
DJL>!~
3v ,
HWm1
zrkviV<k
>Cg(
j%k#
SX!u
`!&%
r3v_
kx'/?
?[~ X
WY\F
$<?t
G?pJ
=VB
?D{^
[$W7
fN!eA
|wo]94
RZis
:8z]
Z9W{
MALW9
/y!dGA
bL3
`VSSWA
. v<l
pXmFD
@YP2
N!]}
X"<L
ip{/w
|(2e
BYwI7
y(=@
JdR]'
TV\x
a{wb
hAer
`3ulz~
op|:
*OK
~f7*.
]}9
Wowq
dzuN4
xA]~
BAId
KKJgO
I<n`h
r1/J
D}As
G)}]
&cH1
hu=
>6FYr
fjL
{<s
yHmp
>@=I
Af:$O
CG"CI
WL~K
|_ =
up_6&
:(zX
QYNQITDSMJXSLNTLH
Wp[a
v^gV
o;.DH
XIPI$
a26?
tNk%
x_26
9/8
o{j[
l/R@
0xe-
^VeE
1D6&
'EWP
G|9O
( o]
SVPB
6:sf
S2^ q
>'(X0
<@;m
Hak&
e Yp
. w
Q=/>1L
XDJfr
yL.vzi~
kDax
s4<
ugh=
%iy(B
;vE)-I
?*%f
|oi)
yZ+M
}(HM]/
;Inr,
4 Zg
M$~/
< u
!kn
,eWM
@MdiK96+
o;n:
%?9P
Hpwy
B-UIqh
72Y6
c' 2
_P&l
]c9%w
"\-)H
V01
"[Ce_
%G `
&=1Y:"
Q]y)
KJ@r
"4>5
%:6c
y;#IO
!/-!
v"k:
[*K+
BM]\
K.q
UERK5
&P)&
s~.D
L:c9
,\<1a
wl o
DU<Sz
IvH`=
"GKM3
5w
o )RQ!0&P
n<&f
4http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
X6fc
C\8d
5R`h
0-41
u% 2r
<D4
%OGc&I/
,t S
vA6^
yNzR
f\8ly
r6aI
<hM"$
:) `
!7_9"_X
_/lM
\OD:a
usS [
4iw4
ywhY
MRrz
;EUL;
+9MHq80
_r$y
]ky*
%6@.
.:E1#
)HC5
ckE
O5@\OV
kvC-
GA|\
v2H ~
sh5KJ
#{kcs
=;NW
/dCI@Z
]fz5\<$
S^fG
&:j)
#W=8O#
YK}Gk
Tp=O
wwK1
|/Ue4o
`?ylxh
a[S|
q_\f
,[8&
$UH:,
8l3((
.7\4^S
f E
IKa(
R l
dvcj
8,1YRwQ
L=Ms
(PBr|
=!:SF[BP
[ YF
BJz
(DigiCert SHA2 Assured ID Code Signing CA0
mJQg
Z>E\n
/:1;
+orj
7HXp
;wYI
=sj:
Winhj
V.vE
;ru)
YIv H
JA3/7
T>.2-cK@l6
"c!e:_H
2GR /
BXxw
" HKy
.I'&
[di:
Ah0u]
tEn@
"'0s
Jd))K
,NU1I
{C4c
[f72
:ba&9
'N=MQ5
7.X~
v*hA
bu~I
w@h _}
5\b"tN$~L
Oa&"
m~+h
Z< t
"7kc
^E wo]
0 Y)@
g' G
Lj<>
Y@P.
MJJ"
8{4f
]0O+
F&&B:bffd#
~>(8
{%k_$-
#J|l
H0F08
n$IWA
SmL5
;e'gZHM,
(L7t
$EoR
a|Z=
lu-T"
}#=h
V;&A=Z
z*T\g
,nv.^
Dv/@v
L_~T
%O477F
W0tl [1
oIY?
Xnbs{
IYu l
)`yD
K<0_o
;v<*
Zr x
K(N"
]5/}[X
F-GsP6T_
``hjP
H1RX
l-f%
RY=P+.
%D.!
ut]kK
5pb0
l0AO2
Ylu9
<[Wt
:3h `
W6w(
,(h W
?-i2Mx
%sjM#
*5Xf6
o 7>
U1qC
oh!y
Oz@S
cm&c
ee`e
'Ncl
bi*X~>G
nA*qoT h
]bpa"
'$*k
rY |{
4` 3
c#\6
(!U
[bV~
H=D*
C(+_
`cMAcJQ
c0a0
V)^e
l1 H
&5m_
^mH'
n/z
})%\
e,M/
o/ls
x|]d<
njZG
;u`pd
lOnA
tC)9/e?
?Z ^L
xHL{
$ +
k-k#
W:%~UR
AJ29
KIP;
sH1
o u80!
NDGNACTIU
O&f\
F@aQ
Rs%9
#G.)^
G/C>s
lm#bY
2qky
-k:`'
$#^C%
zW7t
m{UN
7}y.
.G8%
{c}X
7q.q
C~rv /
ot (
,R~M
5bG@
sG$h
iL]
$hl~
o)'x
%#~B>
Ay\r
f+I.Y
KwU+
9_(s
Pgo\[I
u73MVI
M&so
z&(6z#
fy&|Xz
U}yz
,!E?
8R1_
`$)"
~p@2Gp
I;_w
C=AD
e[%v
%lqv
B d(6
Wt}+
"
x?=C
v]ii^U
T7K
eM5
:~kmF
{o 8mq
^ 0jzY J
U+#^
^?)\
[&2&\R
N+qZm
/+0 EAg
O, 8d
Xjc_
Pk11
.\pc
?1b]@[
.$;,e
bBT2
`Q <h
Fy}D5
Jl7&
\`[=
3l:
m fz ns
K!0`
zn:\
_q[;N
l.fs
P'<S
*E],M&
d7*q
gcX5N>
GTIR
.6X |g
L;~?
{CEx
Gm,|
l0;:7
be? @vU
sx;*M`
hmfa
170301203824Z0
EO`U
GI^\R
2k^X:o
>!.}2
.>\|
KL;%O
- #wH0
H\zZ
FYG|
ip(!
D>AF
RV-j
121018000000Z
^=rZ
dw qs&
O rI(
<q}9^
59huP
!r@B
;cRX8
F2)<
fw>3
hce~
hT-.]
-70M
^ b D
oKL3
W}F
2["CP
HrQ>
E Vv
fj+zG
#qig
:Z:0
n66E
C9]+
/Q|u
W@P!:
6<&WM96QE
OmR
>m
Iel_
V~G8G
Yd@@
:?M ~
V4 n
iI7YE
`I[z
H R`
L t2[
u2lx
g=QJI
N6)1
=,^W]
*ELm9D,
2K0;
}'>e
co`e~
{?Z\B
w'_U
tItaQ
8D?`
@&+X
vra?x
y^-7~>"q;tzA
,Nd S
"vn;@
I8p n
E6b\M%
*BSJB
jfg{
&l#\
6Sd\
A@CZ
CompilerGeneratedAttribute
Zg]|
System.Security
{qz`B
-XT%.
B~.$
g('
{Icp
< Nvl
WlXt
} B@:
}b 05
1^qh]
@HG~
Xs8w
ci7J
eKk}
->W.&
11 l
T)df
h-d!
Ta7Kr
kt8q
jDv
caaxu
AL |e
21D,r&
q_G
R4f+
2$|; ^
` $9
TJ%Yu.7Y7
Uf2;b
+"Wd
&M. F*+
g_%
I: P
m-W`
kDm4.}8
rssq
8]cA.0K
{c T
C@Rv
6E />
&]uG
D6r#
G598
(`c?
etKq
fF:ME
7,J"
Y$6 o
0*0(
m_b\Y _
3QpoVr
0:6XuDe=4`p
U)?*
U'\#
Jn0D
5Ca+
90;3hI
H`r)
= 9W
\mSD
I,r(
0lPC
Y 0}l
YAp~
2 Tj*
+*/y"
*7zX
jbjH+1
|Z/j
,OKx
h_GQ
/g1!e
'Zzi
]
vx\b
^ la
r^=e
Wp'4
J@`p
vQg2
(bb6
^z_Q
3>/a
, H
9,DZ
wn /.
=-:1-
LZfa
gu Qh
oSh'
quo%
;4gK
fx}Q
JMxm
~%x
/NBI
Hd|d
Kt*a
{g
<&|E
9(}h
3Tf^4
<o>>t
DU/D
[D=Z|
j~@+
0@58
Sb obiw
E eq.
qd9n
,u^c
vcGeQ5
P-U;$2
.5'Zw
&bcI0mw
SegvU
#Blob
!B8n
=B.}
9Osu
@KqZ
q8XXS
9vIn
T}6j
yf?8
|yJ$
AC_
Rm9i
$s0B
jzaD
|P(D
9F~cp
9zO"
*^SG
y",;
Hszj
gT)[hFw
0v1|
5G>T
,.J N
Lb"!
} SP
v% x;C
@I8eOS
G3RdK
EN3`
#4!
ME|{
IQIL
K3Mz
?iLf{_j
IO}%d
r<#hUj
~ {
.-z<,
oTp)
3kWY
mYnGK
*2)T(1
_{.w
IVXP
9<'6h@
r9} j
xIvO
iI)r.x
*<xF
`Y~p
Bn={<'
Wpw-rf3'*
+2*
9RsNi>
0~Oq3
hooj
F}(y
c`ZR
#eN6/
z:1<
M_UR
9\fBG
d9R_%%
Wm!e
[.e=
$SD1
PWc2
)#:$i
NDDrv
X#Z
bbrz
P39
=Hp-
http://ocsp.thawte.com0
X^2$F\
K/pP]F
HE 2p
snU?
XQ;5
K.W O
lfCM
BRmMn
N =4
=E{L~>
s1v^
Y2r>
~WBu
x}L+
Fe([
'a6&
http://ts-ocsp.ws.symantec.com07
}Ss%n
,qZJ
We8-h^*
16?y
n0IG\
`+zS
_d7
^ E:
4T";$
J$O
U0OA
RSPdk
h_Y,w@
]F!^
X*')
0E^V
;dh7
v}37
\5<K
EtP&
g=+_
^chI
4&Qr
NZ'a;-
0\(dJ
f*Xd
5]Sh
'=S
-G^)x
z,Se
7XB;
qT/
_=F]
:Y{j
~8oj
2T7<
vo*
5,}.
fnv e0G
'8,+
I0}
:GT-4
5eg
B-T,
o/Y}
U8o1
%F<QP{
R6Y+
K8DsS8[x
\Q 3s!N
SIYs
@d>@
/9)5
,d>n
,\*zk
M80}
)-V
Zl+P,1xP
L,M0
Fg!2
*7lVi-}
u$`'
ncSh
3)&au
3SU&
;E) X
eNc hG
nF#
2# ;I
991m
_/r77
\Yvy=
7oL#Q
(WGL9G
tTdDP+
'/F|
}o>_
Os]k
jnJ5
aT^w
y3+.{
xW>
T xz
kS8Qx
L~w
p'cae]s
C*:i
p41
D)J(L
Z Ro9
k>#@kM
\w7 b
\Kg
h 6(
0Y>!h
;`/<
T0Ug
0^1 0
a @ G
r`d"o
I1dVq
W ux(.
CA :@q
K/ f
`Kcf
[N8n
{^y
ke93
^qcU
kvhs
X.8o
+Dl
zu>cA
VV#g|
0e"
7Wrs
t9B[
gxS~
@O7b
WGu
aP{p+
t=6k+
$g) v?T
"$Qt
N:pr
:cX+0
H{2m
laz@
XnN*n
s#H?
\8dq
a,0[B#
& y="_
R7)
8SaT
;8aH
8rbc
Co0&
o&t
6n?s
O3r Sbo
N'0)
DS}0Phu
0MC?
J+*o
U Af
(*zvK
VHt@
J#*/
^bQR
G \9
nE`"
}?]A+
jka[
{lrl
nowE
5$QKI
4+QV
7F9W
_Do:2F z
z#\"0J
AtNt
0[!Y
oi T
L'Eg,
``MQI2Pn4
5]t5
<uu
r9(C2
a-!P
Lw^G
)Cd\
*M
On!%S
^q}r
)_:l
8n_e
0r1 0
{ E7/
g+T}
A7e;
d+fJ
LvQo@
zigo4
hoX24
Y5i_
Z^\#
L0Tc
m:Sml
ZlAZ
F1-
.w}w
-ih
}Nh/lpV
j5-Q
2VH.
h"Rc
[2G0
.'3g
X=N {
up?Ym
8a#Qh
>%s
73T )
eYs"SYA
ZF\j`
<'jY
3+T\
} "pW:W
~=K}
Gzk
@'Jk/
System.IO
$dO*
WrapNonExceptionThrows
N 1KCi
_`&C
Rg7>
*@a|=
4Utt
si6dxh
K{ExC
T9' B
~z_M
=n2z
<:^N
A> -
0*}%K
Xc:i
eKa}T
0aY:-e
=n2J
<vQ37
s~u0^i`e:
^5-Hpt
-J{`
/m7r
:-?R
#BbZ
B;sg|
mx=9
qTr2
Wd^{
,XT&
-ZRQQ
^jRv58
+HuU
1H[dx
<RB D
+>3>a
f2uA
#jsag
F:]7
8J#^#R<
P+!
w=P>
C: Q
57r`T
tY .
wdT/
gG0%3
* (d
6%RAA
sbd1S
ha3y
' >4`
~8:q
/S>C
`VzH
2b5i
j4Q/
QcEKv_
p;{c
tw;a
-W;+
!n [
u73?
*Y*f/
A51< S
xZWY+
^Wn=
"?"SZ
]#'x3
UkVQg
"YP]
5nG6'Z
7ffFA^
^.f~
<i/V
fR4Hg
0&~Cli0
3Ah&
'&UH
yAE~
1[(<r)
>vSM-
Ak0H
2"cYu
^>GeRa
$=l8
OeMpr:P:#
>QMj3R
m&e>
B{eOsg
LOB&kZ
n6xO
op'f
}}`@
DWIkMC
)%%D
DNzkq\K
V7|*
r*f:
9cv##@S
)u!'
-jD\
~L<p
p0_/
vCu_
;Jcz>q"
~||
|J.$
q+/L
b8R<
iQV^
?p}n
Ksr/
nx]_dmK
1 pG
Xj 0
Z"xB
G* a
3U:M7
|DV~g"
9?Qz
+YZE
H%*s
vEtHEm
.l0H
"HZ Vb
PA!:=c
!fJ]
Z,kU
: t
GpVvH
FWfo
Z=d,
20%#
'5f6j
}IT`^
Y70.
3 d_
{Hz\
zO$9
%npi
h=K6
4Acn
~yYC
Q[.Wq
*O)~
H3}rm
zz""
5};(8
a=0y
saSr
:RAS
VY \
w[Gy
t%|J|1J
]H;1yJ L
-$ 6
bxy~
:+eo
4d{H@
$B]V
e{=_
6(=6
(}].
LD[_,
R8>_
Wn/g
N IZ
hUp
hp\&
Km9|
f ?B!
/@>.P/B
dU+5
HJtv/
QcQg
V66B;cggd#
m}1:Q
y=b"C$M
[2sx?C
z"vk
9Gv#A
@GW_
1 0
,2jl{
b07x
DGHD]
P>;_
0WwI
JM7qy
?oX!
xHPd
w?7CO
*/[O
cc he
EPw t:Q }JnYR
LOE=b"H$
@Y6
S r
q:Iu%
+7?Y
--O^.
{ %u
{xfe|
6fO]
5.68
rmkbiX
l#"X
ay'_
#N3s
REYxE
VQJ4
[=3
^J'B
F{-h
mW?Vi
xWt`D
C9Oya
pbjE
9 78
[*{`
^)t3e
%8P i{
H**Ni
6n$
is_^
GGmD
L8}
Am"
_*];
gg[X
>" Z
';5r
'$0kXU&
1;(D
9~N.F
YB=C
[Tl%X
5og!
]uu|
~34M
Wf
i74g
r6jM
LtHu
Dh(
uT,B
VHsX
\^jdF
A/Z(>
b$>d
BSn^
|'9<
|7vY
U&),
wuSx+q<
[gI[Z
:s|p
(b!.y
AJK/aIg
"j5,
0(j*
ir::
p5J+e#
T 60T{
5 Dv/)
II
:odBbp;D
% [U
32zB
Microsoft.VisualBasic.CompilerServices
(0F_
_hlJN
CKKf
S,E-
urY@PPR
G~@
Ht!Q
b3T%J.
F7Xz
23<\
,<K*-
rm]$
<I$s=
bEi)
1}G
rg0e
Ej tc
z ~|.
gpeb
0ekxS
pvc]sm
! ZB
+sgS
6(/E|L#
x~;f
LZ)&VCh\qN#
3Y0[
0mK3"
wK +/
.p")W
IkIW
@FXS?
Symantec Corporation1402
rE_OI
q|m]):
CR_M
jV{e
&-v/
BraX
O :0
.o"S
090
xa ]0
LL7RM
rz*w
4EKn
dvXx
W`J$[
!fr%,.'
=d4
[d:o
e-x;
4#~
OU7Q
P/$rE
)%>%
} rY
$?i2T
7aMb)@
;CWM{
41%7
]d%g
xe
e2nxc
v*6j
V|42K
sJ\,
ifir0
|M "b
7oAm
8x]3
p d#
X-\
P.7nO^}L
=U#
to7n
[*#{
;G %
>!RF
AR$vM
jWXad`
J5b9
ic+_MC#
whva
^j{Mv
[|o'
02L;/
q%IW|
smxyuUB
9*?U
)9y_
f4 9
C&$f{
.U \
m4e]
bgb,\e
T*3#
RjPa|
?*#O
W$qd
$&psP
(w6
1Fd+-
!'+9
7:l{
[:hk8
xjBX
2flA
A[zF
^-]:
BE.f
km"^Y
.X" 3,
6c4|
bve~
OQCE
|$Vg_
&e|Gf
chE2[bw7 3
L%>_T
8n]B
W+W^1
ca`^
iN8]
jEr8
OnnoUJ`
L,h={
6IvM-w%
p2vO
gE (
M.j]
G s?
B9aeed#
Pv3]s
61AX
;1F!
$."3W
$ .U
k$zh
>3Q4KLQ'
!8&8
O sb
rg xT
hvPt
d||*/-
I&`d
Zg\(Et
ND
0qYnv
N+~$q0
Zups
, Q[
%I*"K
kZYm
`N H
?2(
h0XI
nJfI
,%ch}
=#dM
f-r
MA!y
#b:3s
|G (
a?74
I'.P
yL`[
#2+
65Ab
l~m"
l^j[
svI_J
E8X{QBm
hC4vc}+
@a)_
LB 6
<!H0
Q#Oj
SEI%
+ PE7s
on"x
@6 akD
yVWC
=(5V
|A`
:Dkil>
k 5
zePb(
1x @$
Lp$0
((SS
4lhTu
[Xi|
FZtF
qvU-
=?g|, _
1d N
c?(j
{C4"Q
f|>m
lwy|
XVS(Rx
oQ(Dp
ZYVM>
*0-T/
I_pqG7
V# R
Otdf
*QM[zw
=9vc
`ts]
^u[8
d**o
tV]K
NmN'umXq3
1<gy\
&8'z
_oKj
s35ra
YvEN\3u
%%#H
% 5Y
Aata
Z z4
Ca5
|6=^
jszA
_t%/
47V Y
JF 6
K-Lizg
!Kaet
^-0;
E-h/
/~&R
{ig
xI l:
>iT
00eG
qg>-
F0q2/
%#__]
Vcg`
bq`2
AUnn`
UI&U
cZ g"
Y{ EPk/
]^V['/
0O,2
K 6j
!0;j
f f]
!q-J?
Z]g3
ViB8x
R~;.M
mVgL
+rB
G(mr.
NwtzB
E},2T
w)OB
@hOy
X/qj
* hET
F|E|
H w3
k# ^d
<6/f
^jKN
DD:`u
BBZe
0U,E
>R|n0^4
H:?a
"].
p EJjp
Q=q-
3bi3
Jax3;)t
aA6L%T/]r
*BrR
d[ =i
}k^R
YYA(
S2Ou}T
c _-1O6
q wm
?N n
o!X0?/]
X4'f
E EJOt
"4jjzg
aIEQ
#g&E
EFv%
w?Y*
cl3)|
Zg<>
2!}z
4jP)
i<ue
F*JO|
q rv
Tw T
3v|a]
>z1N
w5sW
7dR'<S%
_85 #d`
k=^r<
(Vf{'
@n'ICt<'T
&pod5
.qE>
3oP:
Y=(6
_vyQ@
9N2b
n?Nob
(}&
^J!N
Fu>Qp]
<rUM'
hvNH
TE:!9
J."Y
Iv@e
1U9J
M~T '
=\v6/
h4sU
fIb
&%8+
jmS|X
k]m w4;iu
vpqR#q
m_@]U
Ug3W
4rNZ
En!k
3]du
W k
3af41
v LS
Q >u
g!K#
) Sj1Y
I~7K
pEQ
T XfS
cI k
~ =;
q#A }
`sO
$UL9eX
j,`Y
Y3^F
L'C Y
F>C
y_2:
W|w)
[(9X5
Uwp8|3
S/L-
FcAu4d
x 1e
:]Kj
B 7"<
N$<E
i i8$
Assembly
. Z[
f({<K
@X%)
b!B-
?X_d
Xd0m
X0}~@>7{Y
Z>3(z
~z@z]
CQ
vqGw`
m-lw
qAiH
sWaT
zd o
/37~
.W=9JD
.B hT
x/&L
M/9O
ZA6AA?
Jb;4#
;!M76
a|6sz
s8kH
8=i=
+i d
1% ?
z D8
FJi,
2ez`
TVTk
}Z.;k]B)Z
+-lo.S
0\z[\
^E`;
17.#
p_p[
tX\
rh{,
\)Dq
Z1?(lO
3 wV
\x>\
f,G%$
3?L
#CbS,
mz[5
FR`8n9-
,69f~[
,[ 0
u{',
IR ?
)*2?}
\W Z
Z (f
5@M~53m'
Zq'/B{S
uUc.
1YFS
V xXcl
@s ^
MsN]IX
>xCwE
5(e-
cFkb_
SmmP
)ID\V
1w`>%
y(nC
[IS4V
4 ~K
I?[
XX]F
j\^yp
!>n.
aDB=t>
_]7n
a!*AY^E
w M@
{%r 8?
^^/w@
0dOUF
&d(nS
- "j
z`k7
+M'y
Px"Lz$
15q5
(-cP
Z2K"0 d
=;zA9C0
ug`W
_Wk
gB9k
-mOSP
PKI{
"sNX
[&M_&c
F&P}
Ei_y
Ubz"
jPR J{
YCNAOICJXQIFF
O1PX\
0lo<-
7`-Q
\3g;N
eZ[~
zeOw
kWqi/
Trc.
r;4H
z bC
2pU%{
]OAL
yPGr
+zXQ
]oH=
\R A
/0"{@y
HkU<
[O#J&A@k
yHVf
U >o
pG=j
{=e_7
hX%W
/bG;}Y}
m.obVs|6[
pZ!:
S;f
J.>Zp
-E4T
zX2s
California1
J10<
!Rsu
9>L>
y6"z>!
n$sz#
MDE=Js
Ac|H
^!&CN
1CQJM>rEs
sXV\
xg5d
K5s)`
f=rpi
d0R{
pi7~
a;EQ
Fz% x
Gg<7cX
j|9@
Cb[p
C-]*
sC_3
tt_!>
X! 8
@$T';
$9L
Cjz
6fx3R
:><>
}%V9-
xJ1s
&}r7
7I9cd
@*ETZ
~K?s
l:G~j
,6DeK
tQI5
v W] Re&
SFoO
j{H
5(-_
WzH
YLYe
9~8OB
R|>Xb
uccHr
QO=4K}[
a)+E]e
uRt
bxe y
Zu#m
c:P
]'!v
O":#
2f- l5
| |%
v :j
L.|
D>fp7
zE+J
/http://crl4.digicert.com/sha2-assured-cs-g1.crl0B
WTfD
f; 5
xatQ[j
Ncy`
"RH|
tLW
kr
MGd
6 Gm4
E7gp\
6Yv|
,m<{_
wI,-
a^2$S$
180713120000Z0v1 0
SJk
?ncT
' x_
tUEt
|b /
dSOvQ
a<A(;<B
2*e
hji
Wx{m^
<j]zhB h7D
)|1+
c$5D
DIv;<
V9 &
lt\N0
KzFN
ovm^
];%4
V_y[
C$OF
ymp
/OmQ*
[w.p
'<]F
U~f
x /5
Z |0
o49}
}1O#
4E+Q
VozD
[))t\V
{7Bof
{iN =wL
R;wsM
D9XYd
<74+M
HhXp
]?\xs
UU@*"
Flo:NK
J^~+7'
N4Vq
p`Dl $
bp~
N|}X
v0953
|gpJl
nzfV7
uU%0v
h#-5$@
`F~T
3eJ"=q;
0RT
@_ L
pL%?>
]$U$
TJ}U
.nO 5E
??8 yB
$E+fT
}b^3
7{XV
BvvVu
U5(y
+j,b
#jU{k
Pi(0^"0hkb 1
91f
<6-0
" 9Gbh
IaG>
i`?
c^)^/
,GYq
rr e
*eu#
eA86"P
h8jJn@e
Qd&l^
L3Mr
'$3)k0a
z+Z,
)4N7
=_{P
.}Nol
`}jW
System.Reflection
#!?p m
&/^)"
O/ J
OBIg
Y2!*
;*2Sc
&2Zy
,\t-x
8_1q
BudK
P&U(
Ib/Y>
JGBldD
Ec{0
@(XR$
YQ8 J
uawoq+
/.MT
=(oH
6` =7
B1v\
o#j*|C
wuQO
wV]2a|
t mc
h{:,
okO@
,wy 0
=/$Ep
k=~%
f9H_
EJq
`^ f
b?3-6.7a
j?o
h !H~
#yJ"
&(Nu"
IY5.L7
,A3=
2i`C
vB*^I)/q
jsxL
lhD
8u5j[!
D#cQ
hW&Ym
}=_2w
Z$L4
8`7#
o|~qV
HVAO\
'N|m|U
+WSK
lqynn
Jr$>zg
:Z t
_ AI
qOR[:#
.SG@a
v6Mj .
g{S E
jTUQ
,<}n
vK3E
)&ypH
3i3J
]$'4F
oP9$
?8 b5
Wtg3:
} or
iXVS8
_zdO
;}t"
8m>(
*]=;
)h8O
8, :TE
(wSVwU
pO7m
?fg*9i
']>LG\
&j 2
Z[\/(y
il#yAq s
oZ7F
O[e?
NHl]QN)
$|UVu
wiWb!j
O=Sp
@HR|
#d7(d
g8;O
H:O
jgn@pB
r y}0.;^[
|kW u
*$\F;~
W{Hl
^#`-
@|R|
RU:,
3l}TWQ
4W.: %qx
lf"3 DV
FU1r
<}2(
p#}!-!gX
`!Y*
;m 2
{G==
d9}4v
+/3I
KBKPLVPDCUADIYZHPOOUYVW
RN]*(
dsr1
YR)z,
^ t1x
. #;
j#gV
tS9{
K*Gr
U )=~*
VEQp
cJC
,E'
pl
A4@
QxpS?
o}>S
|Bo=
r!#
]P`U:
$!<0
n [&F
,Ob=>
"QGL
{BK|F
x+2
Ag5=
D8dr
T\cz
%$KG
<oq[
07:/
C4ez
fP\kkc
],C`7g
Wr8E[W
|q ^
b p+
vy`_p
bzWl
MeE/
_S>
n;I6
J?wS
X/gtM
/nzG
h;%
hygU
o Zm
9=f/
C'\
}}zcc
PSnr}
qfoZ
VZg@1
4w]Y4
-5P"
AEoq7
}=h}
#9nyJ
"ZBA
_*aa
aBB[L*DkW^vN
GJ%_
u5^R
.p_#
xY(?fY
F0t0
s>{%
H'1h
@9>
YdX7
RB`"
SjaZ
D3}es
'Ope$
2N)7
/]j!Nf+
DX}N@
*#pQJ
.]]"
O^a} P~
{bJg
`>6TL
id>V
EXK M
c+l1[;2
?sU;
V3)xl
%0L>
r] `c
d3U^
:OU)
aM A
+>C@2
H&@0
gntw
'Symantec Time Stamping Services CA - G20
U0((
w=/T
oP<{G
1CC2
:r1ot
4NTQ
VXq
S5}x
xz[8
't '
< J'
)Vkb2
eX"W
olmc
5I7U
(DigiCert SHA2 Assured ID Code Signing CA
c:ji
l{m
mBtb
^0+c
>}n{>7wdD
fF"
ai{
kX>s
?sUH
g~w5
IzqF
;mqR
Vq?
D'-Yf?
_\;B{
1@Q>V
EqOX
65Yn h
"!,j
R|@Ns
<oJ)#
BpIMpW
pNd.
Rf@,4U
_8Ib
k+x]
e@j98
`vcz
5zhR3
!V%
smMvb
>0!0
;*-gO
y9;}
"FIn
C;RBS3Fk
XHw~
I4\
Mp R
w32A0N
zlMf
a@%i
z b*
x_Lm
EpaC
x]b,T
5G(gE
JNC%g
kl4t.$
qci3
_{7 X
(]@h
1*nh
-\~L?qm
UV$qi
w"Sf2
@"@Z
4JJ|O^
/6=
M(;s
HOvjd
_h)2
eYh&
h@&m
\>dO
c<;
.:|9:
D7"t
/t2_
@ih'K
_NW"?
MTJ'
bG_k
@r` "
U 7i
#ycO
t^Yi
ueP@Q
HLbq}N
iauFk
Iy'
Zzlv
smxP
7;n3^
N "'
D>)YM
`XBT!
&W:t
$V.Y
axhM
t^ ~
PY}3
Eec(^
BLHl
nW)P
?km9
':T
p1f3q>
F Z)
V6xU
wEwxz
^a^
ziy
!z(<1
iN!r
B3LP
wtyJ
N1jd
nJhj38pzT
!'DF
UFpu
~0q
Versioned
"AZ!
hlD2
I A{
nVC6
'(n \
A7[.
IYq!
v"9>8
nJ2Q
Gdhp
J&6 I
MRpte
9d5B
p2CO4
r]?L
a,A.o
v5'|
i D
%OQs
&0$0"
-@.]
!*);
NP,h
#jkI
_-+gyZ
n-$];
M3NR
dD4e4a
NN d
h`QK
/<d&
UN%NK
f.)?
vQ"m
N..B:
b' Vv
A{8l
][ DY>Q<
g&Oy
Lm= V
D %{UY
Ok_!~
Q)<Hs
jw/7
e`0f
H%2}
l[tSJ
Om-7
1Mf
V'vp
hh7Q
<U5G
WW_%
u$ R
MS1J
Xp"y{
Kn[7
!h[nQ
'WY&yk
w#aG
1O,
GV\06
\OM
wkyG[
G b
:6 T
Sg"E
=\q
?vQ
b[V
?o)v
jZ?B
a'HQ%
h"Bd;
8Wjr
A[Q[^
{^\!
h2T"t
fp&+
2 4=
SM;y0
'3@Y^d
#Se #
aC $
7q u
_AWc
(hU#
9v98
m@b
-8H#
QG/'
d[hKiud
m&7y
z" A
LTq,
W|K
Acb)N
w_o%~
QH`@
vw5EE
(f3'
8>\Q@].-
&~qf
Jf&~
a/} $
)'5<;
{YX@
~st.
Wgv]
IZ9G
&.?+
D e`p
J$m$s
>IH:
V<0@
b``g
d SKE
|@_Y
cDG~
,8lQ!E
m M$D
HK/;o
p_=w
wjV=
}J'Nv
^B *}
%MH}F?
C\li/
27#%j U
V <T
l@(Y
7*U^
C/'9!
FMiQ
+kkJ#9R.
% 1mG
O/|`!X
'-&{z|
99M~
ilH&Y[55M
O=U,
[*M|
a]\|
tAhnq
m{!.{
m!!aY
{8q-
`Quo
Dd?M
Me:J
/.,
pal2K
_vj
ss6w
xp*q23
w; j9[=
2L/z?
lC7V
5L+>4
-(>:mLTH
JA!y"
mcMbp x
Ky8Bu
&TdN
5FYqG
5%`L;
4(+ NV
-DzO
D`"y*4
uKic
vyj,
80604
OZn8
F_+%
W63^
eIG~
[FG*^hI{1
@4`A
/7:Vx=
d9jmF|
~^{*
5SE)1Mk
_fm9,
7g1|
ikbB
gzEO
0V[h
t<-Vn
v^kf
7 'Y
EDO9^
?aDr
$9EKd`
Ex!A
[;:B
$ nA
'M9
-~P#
*O~ r`
oKz&
\Ytr
sSg_x
tSl*
H<WZ
R LC
%[^K x
H<WC
**((+;
BLq
|7?Y
8"oDk
LH]
y4'!
UnverifiableCodeAttribute
bXjX0
,8t2\
nW49
[4,muHW
#!Xe
tMRZ
0HLn
T8}P
"J_ ZA%R
|Uj
C@py
u,A1{G
+omC
4w+&c4
,6R%=`
RAPq&X$
&Pw+3
oEL~
*q .
_G(})
:AhoI
wRI"
- b6
Dqp++
nwFY
T L'
gYZI
6v7}
H" q
^[=
[;5(A
ZRVYMXWAL
$(/
O:'=h
1 E5
cCtw
['-<*GM
*Xn?
2@Y!
@j4,
F.9Z
lQO~
A D|
TP@I
vRwr
1/b&
( A\
}8+X
z;3/
-8OJ
O0~m
ma>4
c6Hm
J'>b
]jxdE
L2)gk
S8HD
)M) j
(@{2M
ma>
1!
q(A%
vGy
yQ%V
$ Fj
pFZc|
Z0X03
8vV\
l ?
`@o
)/ @g
bmxZG]
'B1t
QdPb
*fJR,
x(z|
J }?
%g|4(
1| c
6!1
!-+$
B@9#
Y^6w
'fK8
toybh
\GF
E;[>1
2C d
f 4P
zE/O
@h^t
b(Ro
1UA(,T
.$h
e N
x,+}
IPKp(' C1
SRXW
^E;jD}]*k
oT,dk
y\0Z
\<z&:+
*XJSr
ENmg
.m!c2
E9<r
J+ )*
@Z_[N
J1L3
!b#R
"BT0)]
+=0q
7,_r
,ixx
g;6R
fh)r
C6Lq
h^(8.*
_*E
bE\2V
<"9]!
MvErV
\W,L
-\#{
m5.
b+|8P
Dk'G
Aw=<.
GetDomain
\g(U
e|uK
D[GJ
? 0\7
3Lju
C9dK
|81.
5,>&f
"_F^
+rDt
V|lc
?Q$YF
:z1d
GiAwP
W?f2
mT My
GIQQ+
L[Vp
={~3
>C=dM
$A\*
Y|[vZ1$
td<v
HB/^"
}:E5
d!>k
b{+*
Q3`x
Mk/E
riZY
2[P]
^Nn\
"A)#
DPCt
1wSP
Zm$ 8
& Y
rx8 Z
>Mt6
?a/?-
Durbanville1
{~<s
$%d>
l# (z
[L7BJ)+F
\ HR
//4rE
V6 2
]^Y
Ws>_
v8X^
K++
2uwp
,& @
H W\^H
f:zQ>u6
- X'
*N'A
4PoX_
D~ (r
t:NC<
vBDcD
sn
#>;=e
D)& +
[Lv8gk/B.
zIk
To*?(
I'hF3
XW+"
>3
~E ]
+Q{UPn
Pc+?
4ilS
Q?QK
N Lz
t2;D
9d7^
U5$|
b??,8H
HD ~r
W.S/Ej$
2+m"
eUkisI0
zrZD
O_g<
jy_7
{[F;uRN<
)T?0U2I.
]S0VJ
ji*q
]0'QM
|0^gX]wa
g+pHf
v u1
YgO
/&)t
mA T
@]P
pNtb.
j {e
@}]{R
j_l@-
]OTJ
{m;#q:8
uqx9R:
$V<E?
b iM
281022120000Z0r1 0
R1S{
CkKJ]G
}OkI7
,pno^.
gQ]m
6p2t
g j|
D0[v
[*:E
Lny7
L{+n
nNm.
74zU
W>},
Z5:wJ
E/-0P
XSh?*
s3?I
.+ {2}v
&An:
#utx
mNi
u;ys[j2L~%
9pH9
r |=
V}8.
oL@+bm
fV4&
;{;
^E&G
CJ}*
P!_9
RHFA&
t4Mf
0zMld
$)VY~
/kY4o}
Jd^P
9Vmfz
.]9 u
V~Bis
S;G*
xCr!}
,ugI
H| -u(
#3x:
k*}-
<YE`
QG)=
qX.@
;<3
l(5}^\R0f
{QZ_
fB}u
3yMt
H4rE2
khWC
>\hO
w],D
[ywq
xe2t
>1UK
?k 8
zuea
xL 3
xFm3|>A
r 1p
q"r0r;
%! >;
M_/r
cqpMeX0
LL@@
6sOFE+\
~kja
zd`xl
P 5{
F l$o
qi[(g3
Xo{G
T `LH=
b<N~
Aa5
nvaF
F a}N
J"L(
h[ZU];
,~O,
"MP{
p}yuO0
9lo;
4/Ha
;P(|
Z"HB
w_[~
_,k_F
Gm3r
.E:)
|[H-
\8
7P]0
o{ {
}W]
j0f[
2oNW
`tNQ
-i&x5
+]"%U
p "n #cc
Y7`v
x^ij
.pJ<
ZEOu.
<T *^
4 q\
/3)`
YYA%
w3 M
MW.`;
pK| V
&inC
zhmF
.BU^V
sJvW
62t7
m, |
]JQW
HhH|Z
" *};yk
!au 0
l'&'
Q,-">n
60E?
g9'2f
A]_`
r(Y8
N9KI
0 g=
m>+Z
E9!R
.4 Q
qTAR
:Xw<#
(?qsj
k[_
<77yv
s7 *
Kv8r
(ey
z4KC
$$method0x6000145-1
zW.
\G_Id
y(:~
?F{N
"EW(
=DF@
#Ocm
llbb\
_ V5
|Ha z
)36k
_U1&.
<:&K
|_@)
,f2W
qr.S
#uiG
'K*?]
JImK
kjp-A
S>\_
aT
633 J^
"NFhy
O@DgC
!v=
U0;k
;"BL
73>a/
vr1#*BV
9= j}"
d*jN
q@PY
%?./
5ia!
i8#
-'g'
%\K;
<B8_Gb
(QO,
>'}p
p3iE
aai|S
t!E`]y
,)a>
|s|A
<iKi
%&Y)e_d
A~oj{
RT#Q
l6a7+
s,OH=
~!Gb
~,q<
:r"=!U
IjF!-1Q
Oh}9
C]^^GP>
;7N?
!&cp
M<JCA
yS\1
%|%)
]E}Z
Rb]e
x|aU
~3Q
0m2|W
Qj9\
#87Q
'fMB
)& V
zfS8
5_en
$\?.7
6RN
dN53|
\///r
"^=V
P(.="E
Xr,v$
zJ\
A}m>A
J ius
-#Xe
_)/~st
Nm
~!4#
foEx
U >N#?
Hlv
014S
hc;?%
5|vAFY^
| [
>@ -
yYT z
A Wu
Tgf<
C|+z
y50_
BB8B$Z
bP?4
91N,
&8?[@
?qxKK
&|In
hf&I
E^s>
[tg"
)T<V
%!+N`
^.KD
C!wo
f&@w
4VAOz
a<p@sx
>.A=
NvVfFzN
d``? nw
|s0b!
p\IG
Q*}c\
P#
[Q :
{B[\
/V&D
kOAM
T9Mm
r"0v
[ oI
m@~<
'!ah
X TB
fNA5n5n'5ugYewh
!s7A+
hs%\
fx5K
>=HDd
KP*h+
kbB9
P:9QH]pJ
'!a?
{e j
3mmd
j.eN
!O(8dx3q
r;b
w{w|
7L-V_
E7Ic
;I ]"
d,) RN9
A B/
fuSC
C N_
Thawte Certification1
\$Ti
BWh3
s*k<\
S3'F
0nf`
;HPxV{`
MAM
vqCR-z
NW3p
g^"eDZR
w:KE
1-l_
,$ABtK
h|ws<c
|>5H
i &WyQ
ONb2
N<^f
\<t )l
9_;>9
{u?H
_^h7f
amkg
<9ec
"_D,
{wnY
d ] >
ddd$D
Z|d,
AUVIEYBOSLPVLYZPTSN
^~"Y
:S"e}&
'juY}g
1R/<
,vH_
MGj}
b6w|
G*X$
:75/
7^lCc
YoWn
1`Vt
lR^p
KLY6q
"=nN'_
Ij>e
WHsv0`
DZm+;s
.5*q
>OU)9c
-;I%A
cJK<
NrHTue
R)];
5O66
^JO-7
g7 u
X>u
T,@[
>m<a
tvvF
A @$
lqKT
:CoUP
OETtz
XI@
Read
[!lD
\hA.
AHz-
!w73
2J*7
rS);
r{@($
:|.U
QYpu
[SG`r
UzL+
p4MN
Dg~.;
k-aS
0^G~
# N(#
Thread
BAU:]-S
Rovy
]pq*
8a\G
aKzZ
`+M`
97]y
\7p
Uu3i
5B;k
]%}(
,=3c
wHZ!
PvP1
sKaXl
BVCe
&zR
3 2{
zZf 3
Fi@[
xci"&
=)!z
[`9U
Jt]2
\9 O
p5R/.
KgDb
F6a*xj
*-g7
DRMTUGFHKOVKIEE
Tqnr
`@v6
8k/.X
\:hCR
at~.!
a[!cfV
a_ OLV
d c e
UyZ_
fe_q0
?'h}
m#5m
Kuu1
=E&PtJ
j^I
j`Q]#
DecompressGZip
+7uBE
1ia~
TSY`
p]t'
A1Whe
[?R.
No"g
o*"g
bCAe
`h,7
z=>
ta6CV7
]2,(R
#a[8
{% aS,v
7^$A
szHX
RCu~
M8WoQ
2DL;w
69:=d
d>DL
uLmY
"}gs_
k{[Gk[vY
S|R`
}g@!
:#VY,
`{mZz.
q(f8
A'u2
m&N<
9@ }O
iwZ2Y!i
J$9ZR
'5EH\
&QJodnp
PO-
1'0Tl
[8q
Xgg@
1s17h
U `P
p|1?
^|%d
;0907
,=K
%wMBH
E/'}
CXDL
'rUxB
+XtK
5ZEy:
/~'
9@r$
XoF_CG
p5UqM
Z}TBh
~E>{pmRN
K\:g
Hxt=
Vgn@
<=+C
$# o
HAX0
<RDv
;ol1o
?20`^#
M4s
0T:~
&'^~
Z/ UX
ty@8c/
^nDn
.K6~
C=!E|`zR` &
2DC4-
3F/#
+=_v
(=Tzs
o/Sb
xlUX@
Ui:=iX
]T3T
[>|b
e`D~
~h{j
t]6App
5#iX
*.c0
9\-
jeaJT\
_~nD
BuT)O}
? ,>
2Bad,;
b'_
O@|R
wWgGS
^A |
GoGF^
dpX
a`
o*YTE
7#J=
$ZDC
^Nhe:c
)IH
ynw:
T7wY] ,;
S%{E
G_[_
p'H-
+7MS
LkN2*-
LPh
_^e,SX
BpQ8
zR]X
yL"i
}fGu
eE^QJ
P>!J+
kS}9?
b)IQ
@>k}
-cw+
cprn
F]w
E/o-
+iCt $d
H3k|
]u`Z|"
(%Tz
KA!
|omP:
BQ D
3I7;
}2,gJ
h?([
R*\.u
6u'M
o'J`2h??=4
i0)j
O4BS%
Hy-?$.
8(yR
eDyR
##qwk
f-9i
2z ^
E}pu
lSx4
PM[
01MB
&Kw=
Q&vO
fi, ba
\!$v
4Zb ^
?pnH
`OUa[
3,>9
tDyH
3 /f
WXK3
sY =j
IDq%
=`5%+
Gsg.^
ZhKNZ
Zci|
u07^
@%o3
=o64
=':d
;Lx*
Hs1t,
MCaY
u(!$u
]yVZ
ygS3
?6F?
h'Xr
Jnl
wg&E
$L%#b
?>v
1"A#
ET`}c
[*@y
$` Tp
>X2J
s ON
%DTM!>
fb]<
RuntimeFieldHandle
.v[@
HG4GTm
..p\
&0(J;e
*8UB
M)$XF
|\uu
QQH "
6O<[?B
O*w|
Ld%
P}ZV
Jm5f
"^.J
J%{
l4P4
+lmr
NMh`
VT$>y,7g]Q8*.
jSP59-@r
2 1Z
%!!%
3^M
q,qg
Wv+TT?
IH *M
`vK|"
icNE
s2s
$JFA
,hmI|%
O'+:
6,7sM
9 T|h
rI43p
as_FJ
oVI<
^oCb
'}#C
"Tm\
Bc"w
'+i&
o_Q$
bZ l
,oa)X
.#9
bn__
4 <,
I? =
zu\;
:2*d
V}|'
(lB]
e \s
o:AZx"Yu
"dW@
cg,#z
ni|c?
`&hR,S$
T. k
c?j
J9,/6
{k(n
R4*e
ms:|
K~HY
&"l~5
/ Ron
?6-Ya
$z&~
UBOBOKJV
!R]J
64ek
b+2g
l!5T
SzVCy
{ ^P
X<wK2k!
z(W:
%/t
{W7j\
7N =_k*Z,
.fNc
iq&pw
RDHb
yNkD0@
[~vu
Rosq:51
GetObjectValue
4ih'
K0~d
xF@R
"tg>
5 c"\
y">}
#HZr
r>NG
KeyD<
eac5
W17\~
$?;0
t$TTTzA
O[.
<65`
9Zm 7
:UM<
6 pGX
n.'4
7"1;
d $Ibr
TyIA
6_Uy
`6<"
MCVF-DW
>L\ 0
a0Jz
$$_8
q"gv3_u4
#%m
"T&/aF
uw0m
f6d
As<wU:?f7J#
k:a0
3w5|
+N~<
jKqF
h7'Q
[ 6&
%}`(
kf)iq
ldPA/
W\ba
~eia!TLaH
Wo8
Og=1
8{$?
FrPNt 3AT
aK|8
2BZ_Fw
iJax|
LY|R
!sOB
V/!67
J-NOs>
[.[v
a,#o
KnQ7
I. N
/ M8~
&`a
8~2X
jV ]
_D?vk
s[y(
?NW!6
97_s
[ZsiBL
nY&{ &
b+%9d
hs8
xNA`
USGee
KOU|
#*_&A
h$e>
#!$-d
:w$xo
H{%W
~ mk7-
-wg^
WNEkV
V K6
</lE!Df
CcZds
HAy
`ac9
9K,y(d
ZefQ
]C"|
|@
xmSv
o{^7k
JZ ^#
>X>Ka
qoh~
-G3r
^a B
Afql
y_$X
Dxs?
9 LW
kDlV
N}^lM
=U=}
RMY?
:. h
^"f'
U@G!
Vo1
o&XDy.
c ;
%anT
*&W8
JH?Y
JI':v
\V25
==5v
- 1?
XXj1
<3p+
b&`,
;~D4
g$9bJ2
p-$iD
hfb|
K+wl
w{tg
`g1~
sY?bK(#
;Un29
a]Vd
0EOei,?=j
P|P_7Z
O >CJb
sqO
rdVt2
g2:d
S27R[
V22P
l`Y@+
2yMs
Rt1_
Y1BJ
8Y9 $
3&R{{/
6!g7?
xQ:Ajb
z=gJ
0r0^1 0
@eqH
k,kY
b avT
Y8r^
"'cz
lZyO
O d%
E5B)
z=1
\G .
xg(s
=z'>
hS4G1
xlxX
E1~I
&Fc<
bh^*3s
G&M9
zM3A
Wn~ ,
0e1 0
6IF{}X_
!VeK
clw{, y
g Up!GTE
I,o=
HKm)T
nxUEzm
VE''
:][7M+
s[ZTPO
Uzmg
yl}w.U"
dk}wz
DhQ+
f&2w
Sgp7Q
VdMd
MCsqqF
?}15
S=b
MaH
; R
f{~W
q.mOp0
NNN 118
.Qae
$]^{
nwhD'
;2J_{
|fhc
aDP ZSM
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
dgu]"
fR $u;K
X7Qen
2cFD
&fs>q
m4XHt
!7?\
(tgof}Q
B LY1
4oqYw&
joB
5*!Q$
H&^{?a8-Z
={g+
Z`D#N^
OB+~
8?% U
w568W
A Bcf
,P#n
24}-
`=y7
8.Ng4
H QI'
hjgJjTeX/
[GY[
Y:TG
&&@g
27<Y|'9F
5qgSP]
nfa^6
BA{m
T&fJ6
o7soK
_aqe
qf<]
121221000000Z
VhB.Z=z
QZ=
4a*hO
db*9
x0v0$
ZVDa
l |a3
Ugj&
,t>F
Mj }
|s3Wz
2`|M
Dv~a
f(i'
#GZWhB6D
}bqv
X r a
z+Z`
9pKOTg
93=]&
frFupa
9xpk
j<d*
cvT)
Sw6]Yv
Q .
2yPi
N@6b
A9A'9
,!a#Y
h6@r
c|>N
j(BN
8~||F
QW7H-
K_Sk
K 8i/
5u[r
6*0&
F5H YsU
L?rM
\E/
s<s]}
4qs<
dO bG/5
~_#F
Y6kw
S'(9
CB(kx
!J#b
_{=F
e1C:
N\T
Qjj^
`qI=I-
.:P8
fdWD
J4}S\q
9sRH
I}\K
Ue# Nt
Cw@!
$-'0x
Write
GxQB
8mH<!
(tqQo
Trn"s
+<F3
oQt~#K
6X0^n
zCLN
*%|o
N+.n
6> H
xD$po
o pOO
9bjuXVA
Bd D
L_uK
~^Vn
2>7
D9H
3]zld
G7fH
8 |z
dWR=
sG mk
FQm>
5 I
#p}}
zSGt
!8Rl
~BP+n
e9$P
Q.e:
of*SP[
$.W1F
|O6l
MRDT4
{i.w
r0F'7
5`lq
\ld(
i}q-PP
6tI}
ok"Lb
K5Vu?
Ltye<I
+gQ
Omu P
fVz"
{- q8I$
=GGf
8Bnfn
bG'f3
K }2:
~-A8
0x9]m
Fi5%FB
Z479
0|K^
igac
xGTOp
Zn(+(/
~v ~
4nGI
@4il&{
i3L|
Kzpb
{jK8
10kN
'10}
xL"
2 fv
ZX*%
/OEq%|
is w
RDvD
@Xz|Z
G9WX
yDKa4
LT#4
<Cd9
q6EM
vw77p
s g${
y%;v
c6q"w:[B
DGGq
SO/+
C2bq
~|#G
5z7_
r;%v
w!64
yS=8g0
RHO:
UJWEf3
v(p'
euEN
]gw^
Bqg0
VVV[L[
H&p
uqS/
Pfqs>6'
];/O
9+-!
HOK?
16,^
XR -q!
|P8.
?wJ!?KF
65$h
".^v
&G3
!o4Y[
?G5D
'"spX
s>1e
W(]:k
qAxQ
7/\8?
xL:`%
D3u[
,c |
oD={
b/uY.
:68G
eu.<
www.digicert.com1$0"
22_!L
3'8f
&eq^
_41
X(r I5
: "x
*##V(
?c! @
n1Cg
1?j8
m3HD
RNRVXAZHCYEFNBYCPIW
L"#V
~]n-5
Z;h'
!uRO?
PR@"<
aj8=
a~b}r
%6q8
Vvb=;9
sS *
XGf-
#SY6
Y)c]/
WCOPGSDKWN
%591
<: s
6}l9
!{l\%
7[c4
7U{v
$(PI0G
<5MX
:T96
M+C7;
ww G/
$CT1*
ykI]
*u>v@
fQ%f
E"En
.cmM
av\!
vV~/
t${r
M4**
^D }u
2 ` |C|
~xpD
EEk4
ab[7
U!?P>
mY '9
|Gie
v1c&
qEgD
eH8jS
xea"
aL n
r8vp
~!k;#'
I>a!yH
8VVH
z ^(n
EA% ib
KK/&
h<*
r{5H
]Pl4
Sqg#&n
4<V>2
eVs5#
3x#{zH
+SkJc
%$ 2
Dj|]
"~_u
OWq0
t5;:
F$^1
$f%U B
nJWD
Hw[
JL,C
uYN\
)>AB
wV<%
j@CB
qG|
YI$@\=q
wE !2!2
xT=U4
W^>Z~O_8
FGyY
/LL5
5wGu7
Z q*(
h]sUk
e>16
7OsT
D0Vq<
Oo'C[
*\z[
Fjd'
\zHc!
!5<2
%@d1
_:5I
8JEU
a|k2
(m]{G
h<'bz
KF&f
tL#G
\P.|
o# w
^, ~
&e3]
f{HU
mX &
7aX
(aLe
^)&y3
?:'n
<VU(V
131022120000Z
d5ke
k=\P
m%P,
<bJG
Z,8i7N
)v(f
_u~G/
x6:|
o?%w
cA"fz
+) >
z#<wE
\,! d4$
[^`?8
NOw4
/`vn
^}@f
&'/
xK0L
9(X`
Th]8{0
CcBvJ)
<j'=
wk'7'W
fQ9!d
wcMJ
A xeA}
P c(
/p!
e<zU
bEgs
PL#B*
j{DAQu
, ey
eHQA
W}g7'
HT?x
RU4}
EFAn
?gbs
7fd7
,Y^H
+Q/a
?)kM&
l]KZ
@@pr
+Symantec Time Stamping Services Signer - G40
L"AJV
#Ni[
f)A`
XWFF
R U J
jS&xv
H*yn
v=jK
L\(*
y87f
j :Z
sC #{Vc
DSJOOGCQNVDNRQUGSVXSUSLKFAGIQCEDINNHGKTPKTVQYNT
f)A5
k;N/
$Wo)=
9J{o3 N$
.7#/
3_lx_
,fIh
SS#q
q tZ,
x{?*]0
e o0
+JwU
5_As
dhUx
o6D
'DP B
U;>M)
oiuZ
yUAx_
N Ji
/B>;
LO\2%
R#u]\
@?Aa
a(SG
ZF a
yJ<E
b vE
j,5z
(5wyy
jC [
fbA{
XR9L
?xoq:3
S:Y
<-!N
|tiBX
.?H6
6~=r&
<k_8
&7dRWq
:k>|v
POEBnoOFX
'Jd
Fa3p
A4&9^
#uO Z
up oL
nl].>
vck*
Y``1L Fp
O)_.d
pd"[
DL)YJ
Kp=
<).QR
ETMPSZJXT
O#cp
?= 6eV
Z"Y1D
_ 0fY
jg -
TC-i
,N(gK
,_AL:h
K; rO
8-<dh`h
C*Fe$
?Phe`
~gl+
&2ZO
i dxr
8{!Q
6]|ZHc_
hk B.
?w:@
o JXot>
wNgSJ
=}hK
_PA0_<
L+h 92]cf
:tpw
TENSZCCCJZFFXHHYBJJX
w:Dl}d
J2q%W
*bh,p
I*Xwy
+ s6g
2{|#d9
C`NRVvRt
9C9H
h5*@
|:P {
!sV/
~v__1k
{ iY
^4 qso`BDJA
$T6>
;..|
*:8<
<` v
2<\
z}F
www.digicert.com110/
owzN
/rwb
@inG
9 i(
97\m%
nsFD
t23`/
mOn*
z84bJ
H+j
=~Nc
}-_e
U'3&
{p\`g
.<yL
`b=
,y&Ni
qC[z! j
s\Hl
r-9<
LjG=
T6L@?s
|0lG
)nq\
C( A
'OLO
...!! Cc
%f w
|)P)B
CMh]
vtVwg
V&s\
Ytqg
ys-a
_/:
`x_
zte
`:(}*"#H
Q'hV,
LRmjH
z\U)
9nv2
w Gn
@wd!
$C<!}
JUuW
Zzq%>>
2f)\
4j SGpF}
q68x
}9{M
W [)
X;#x !
!r&{
gJ$K
$Hx>
uwYo
qb@
Tu lI
Kq *
|FkoW
`Co|gjD_
U4d{
x@P_
_BE
mfQ$
/E7
KC]r
.:`4
f"-Q
$F:al&
Ka ]
?OZGa
le>@
KvV)
j@b) 6
hg#C);f
0)"-
r{4|
Ckee'
qNq rt
oa#m?
Ce=xE
$cv<9
u8<!
g" })
W+RI
m6Rcb
'?IJ
seW]U
{8L
QS K
h{6v
3e)(i
#G34
ZX{
:m0Ae
E@t
1n22sR=
ejsv
siud4_
R#.+J
?K@A\
System.IO.Compression
('Q=
55tj
& z47u
PSQs
-IZk
"`}=U
c3k)
LM\4
HA7}
|k1Q
aaI}
Ns
uQ V><
7zjH"P`
b'"<
,\Pv
nS3G
./K]
bcxW
)5D
Dc9'
o*GR
| l
C`1?n
/http://crl3.digicert.com/sha2-assured-cs-g1.crl05
4SM/
| b\
jaz>
?2@eh
VI(/L
4t?F
~yT=Z
=1rh?
<bx[
Z2"
osss
# 7L&
#/ Ta
kyo`
E46@w2vH
Cbe\a
v?y,@
Byte
JHn;
;FQX
0?L{0
g0I'q
W XS
t%;KSj
4z)^
=].8
.2''
fc&<\
3Rp&
1Gq2[2}(
>d?q
p;w1`(P>
iB7.u
buA3
?: `*4zZFXW'gg
|o 3
lL@j
1Lg!O
iv 'z
& Mi8
p \n
_ppe
5H `
5tr+
c&GC
3rqn
aQM.
pp1I
hj\{J
!9LJb
5!y[
vPcKp
Se U
F$op!m
RUAMQHVVYEMVDRXXXEZTTQ
5J;
xs5]
> R~
:@+{
:%@kk2=
Y:QIv
eu.T
wVkEX
x8RW
_])6Tw
\|>?
.f<BQ
X)"i
9v<jk
t=9;
)tlJZns
^`{BJ
#&.7
% sz
DRCb>
7)~
<kax
|lL1;
kz 7^6F
Z^j(9+
Oe:j1
4Q6v w.
g2l
D Dvd~
-^ 3
)h4
(tFQ
0gv@
;@kZ
.iu*
AU{R
qB +LwP
!.{R
P, 4L%
t;kS
30:Ggzd
mu5y
]\
[[[]N]B
Vl!!
.X-S
GpRUE
>BS_
i\GaM
OJs8
o(a^
f&.
K@:v
[R'`zs %
`\}a
3upg
4 1Y
59 5<7
<=1~
jm?,j3
*fm`
dB)>
})\C
)*=z
\!e%
"MXg
n$Jo
'Q23
j`oT>k
2Zv@
jA3X
1 2G
zM7'
V2kH
> 9Z
R4*?
c(9,W5
I%tk
jQ38
*Or
rTM.
YBe,
&{O
1&;r
<8G!=u
5|:c
8 -
sDD##
Zssa
l=>Q
9ZNM%
:fDxx
0[FC
_<'<
2/Dr
H00!
hrC-
H%u0G
RH !
[r3xc
EOt]
&RD/
6~\~
}GM\
px.T
:&rm
4:NO3
]W:}vP
Y ;
[t%{
w48S;
ZWGt
G$7D
e6z
+Oa+H
nsyG
}sGs
l9'r;
#[84
\,D<
~>g,}
~$1F
>zOm
2|\'
=Kg1
S Gn
~r(L
hc`N
/TZ}u
$<,C[
GXT=
{#QSQ
Ct)eQ
^K%i
ICy&
IQ=_
rbq*q
lB-_W
?L~xG_
zR[1
NO X
m]X;
D/IZ
Z\\9
RbU;
MyiX
;c>P
29%Om
eVT+
<bR
WsKf6|
n]4
"X#T
tt$N
WX$G=
kUd9r^
y]Rp
:o&o#
m@ 9
oUej
`Y^q
*)Ac
9i37
;y,v
F)f|
n%I8
>5) va
1Ok
(! :
v_Yw
=qYX
ov<73CX
|5<o
wdjx
m5Y!
NOX-
5?{Z
0/ ?,8GD70
y3>w
PsS_
MBx\Y
/h<d
~H M
IA LLdJD
)B&C
;ID0
bm 4B
z iDW2
geF@
*5;:N,
,-%^><
GK(+
!nmT
!K2%
xM *
o~L|
;Di7-,A
GkKH4e
h'2k9
>Jo2
it5/
#INbHN
!%j5
%VwJ
%{Be
2e 0
^fWL
e@&`
# k
z$.=
1cJAD
kF4B
,&iZ
)Rh
`@tcLL
!_t
>,D<
CMjv
8_r#n<D5
uX?v
gH~
a pH
22Dk
9W^%
}4Jl
D2r>
0.ry
Dh29
\~Pn31
FpIB4O!
"1?m
]Cc*
tb\if
e)?O;
nzd
T#-ch
H}(H$
6YMN
z"8Q
P`f@
D!tT
r_%5
p1]>'L,
L.Q>^
it?=
xt
g AM`
?is}
;"~ cN=
,A}QM*
3lae
<Module>
{*g]
H"XC
eL70
&n#Z:#
YG=}
vx*#{
6{W%
+U*1
{ah6
\ U sM
.@[5
pm2X[I
|$G`
xV%zx
) ]'
KXuI2
oi,2]wS)
Mh; h#c<
uU%>r
`+Sa;
JL7[
~<Cj
>eyI
S;nYC
3BT,
'4qF\.
(8tnJ9D,
G=$7u1'?
bc+Z
UKZ=Jd
}eql
ur #
d2=c:N
3Z*/
D"ri
E4"G8
guGCN(
8^M
RLlC"O
92+i
;`"Du
7H$M4
KU*9
q,,g
yOft
&#Z
x%o9
2qbg
`6] V
Og6l
m/ax
Pfw)e
^Z!AeK
!^|#
qiVt
KTvAb
0WaL
hn_~OL
X _M
@1^Na
+VD`L
N)M-B
6?z.
m#en
3Qo;%E(dg
%s x
4j w
58LY
ZS \
Odt1
m0$>
q_%>
$@yp
SD t
+b G
{Fn4#
] X$
a&O
GCMMA5
rmPu
Uz)7^
:!`Bp
7pn7%&
[gHI
:1V
?(%(
qReX1)/
r<] B%c
G!c2^
S[Xeh
'WbV
u#|O
wsWL
<c1
O.$x
+uvuN
-4u>
s %z
y^m9
!$p~2S
4^M"
jk?
+u!{El
1iyK
~~>P\
BpuPv
xR"w2
o`&(
?1ou
<~r4;U
|pTy%0
D!At`
A7X(gED
e_!
vj*2
w+(+Y
B{'h}}
rG](
1y#y
Plgv
]#C6
Ilk^
RO)s
4o@w
L;,.
EMCq
q/rj
:Hc}
@P>w)7
h&yi
SQUF
m:pf?]L
e)1
+!xx91
x9FV
}J p
s\W^
vo;D
b<DL
['jK
d17?
f~$$
w*=d0%!
[QyI
j 5|
!'znK
qPY
$Z !\
C'Py
ex~L
{lK*
l%{L
]$;`
:i?Q
;U?:
8_t80<
YN\w
6^}R
<**H]
{uju
tXxO
-V p
c0,@E
(f/<
5b_le
pntD
3?O!l
Vtb)
N Dn= :
V^-nz
C{qk.
xd)_
}~ko?
UrgNI
glaw
B2=[F>,,AX
XoED
[nS_
C]C"
Gc#%$<yW
uYr<
,|%)v
C+^p
yL`;]*
|aOFe
e_gE
t+d+CoL/
zf U
U-"#b
/yDq
Rh-#
SRIX
~,{ 9
*%GM
[Kt&
qczw
[~(:
wBr^
,G/e
F )E
[Kt1
J:2E
nhZ_F
'KSP)Y
4)Xz
|5U+
S'fw
,VR\
<F~pK
,!
Jo8=
PL.p
Gp,:C
^eMk
WRNe
]|1~M
]D7%
-wUM
rV k
1<on
6*~e
t-0
tx]
Xlv]Ho
26U9
'Symantec Time Stamping Services CA - G2
:760u
d5vb
LUJg
=#q
hsg:
J Ta
l_Q4
.6 O
fGa0)P
6]kn5
78J>H
HI:h
wWTz
hC$.
!]WC
7lK.\
g0e0*
!"~&|#
:QJ(
P(vt
^M,s
|-`W
JiJ]
P&N>
/{?]C
"Dq(J(
3)za
=~m;
:vJ]
B}fuj
f}61
<b[i
RH3s
TF"~;
:Vb
nhb0
%ou N
}L^7
5.GG
GE._
d,/PwQV
{$4f
n!o
j0Og
CSXL
W=|\qm
}CRb! 3/
=u;Ui8
+FAn
z.@ ?
C#C(
XN np
BW{B
dIn#
K982
I~_~
hoC{
SEF|
T6D4GG
a[wf
J<WR
sm-c*
m-A{
XLubq{
ZGd?
4`RN;
7@COh
M|3-
`N6`
^F|.
}%&'
+' &
0L]Z
CoY%
!Z+4Z
"~F5
2i#_l
/n?Q|n
_96b
|Zx/e
nyAa
~/5jOO
y" A
s 8
L}<b`NO
E >+
x2gD
R=d7
l da
d`,
K<5"
+vE4
4 8'B
Y;+o
I|U
x7c]
zmOG
roq!
p%Zg
Pasi
bm{e
C,GM
FgZ>
Fs+g
>[h(`
>lc2
=vFl
RPC/r
L$IY
CrTGQ
0c!!
R `
fdx%<
Tn=)D
fONf
<F]Tj
py|3
44EW
n)MM
wQWB
/-u!P:7
g>(X
SeP?JY
&/9a
Tgo<d
aX|W"
;Jo6y
{z|Dv
*<M~Y
M.lPj<*
o 2/
'tnO
~VV
B-L*6
tZof
Yg>}
h{ D
SL+8]&z:
ENy5
uZj)7
S \?
}l )jt%E{
6z*rN9
uu t
1?(/
i5 o!U>
&nB2
=H$Z
P$g
Z0`;X
deM1_
^NY/
^Wz[
(<GLN<_|
{1ih
@!..
7,Ib6
bfz$
|^I`S
A]*{
Jnw.I
^Za9
]J726h]
q{gt
JaI7
'WT&
%D{Q
!W @v
|kN`p
m9%R
4& i
kK&)
vN b
l.a;z
:u:
uq+0
X-bz
]6-2P
gg'gg
| .:@S
-%#.
?"a6
VWh<G
TQ9`?x
95mO
_7 +
,ly{Zg
ws;j:
N#kE:
[>0K0
8opi
rd`b
"] m
%H5L
:qF9
3MeITU!
Nk](
JSO1
{ 'u6
|!a?s
KX }
`a)J
\I@@)
^5g^
MXK@
"I/+/UQ
@@~tTU
2z\f
x H`
ew2E
"->(
" x
tQN)m
Wt-H
A;=r
fZ %
CallType
]+s0(
)jP~] 7u5A
KA[r
ocj/
YSxX
9]R
hba`Y
(6{+
ewmK
nJ}#
V/C
swO
Ak8mn
}2(C
1wq
\%@
t/>D
l-A\
YyEE
?G\:;
" i Rg
@9gd
)rpl
NE'0
>^!t
f$ll8
v12t
3E5r
s0p3
jWxT
f*+bLMp
7!"S
tAB$
_C$ 0VN
(,ooj
*'7
6"c_
V^O%*
Z !P
?[XM
VLYe
|`6\5+TB>
{}n&
IW}2
*TjgA%F
S71Q
>> v
'h8G
^{G^S[
A{a
+JR$
R+
GQbR
DhTcz
KKDEWGMKSVBVXXFZCFXYADCFDNWO
HYJ:
AgaLU
NHHf
nNvVG
s8-E
"$N
T\\gR
wlk;
r[?w
_m`+
`(:b
1sV
6; =:
bF.&
*cw/
-u~P0
hA`*
?}FU
?7(p
<|iG]x
,2[6
$..
{%}]?
LL<l
/bz.
/2 }
u?_V
Wq)!Rv
B *c
]$D~QX
(Eik
A.uS
og[(
/z&@
T/\>y
;jBo
JSE'+eD
^M 9
u?6 =
rHwH2
A+n98S@
DQ+
P# .
qTVi
z<~jS,
0qm_
Bh}l#
pol>S
e! w_
G9%P
cbb4
V+KTv
A@]/>S
+Q| p9
!lgX
GAHPg
d * $c"[
Pzg&
@9]q
&%K}Vr
R>4P
[*~1
?wP!
[sB}
$vB7
QUzG
>"hcS
^2$0
W2m}
!ny<
M8*<>}:
i{s9
6, </N
Z%}A*
>$`Y
QKl<
( UV
2kx|
b]1NU
FdyQ>
?4?U
Mt| B
E~p
&BJI
Db {c
dHm;e
Uko7
>WEa
FiC
Array
(s[68~DV#D]M
!jGD
F{DZ
L?2
(|%Y
Q%_x
KVvN
znR
.[W,
5WXyb
)9#s
Nlt"
8s}b!
TIhv
[4
*+z$
S 9i
%~[}0
P{'O*U
})P=
XQ&@;
O08WV
OuiH
Lkoa(`
?}9S
F S[i+
{In\
Eprd
O`R=-
^L~FC
W"wz
m@OX
a+0_
J^d}
tZpy
n]h^
qhM.
"VN.Y-
BZQ+
qmlVX
LX_g
[KrY
dCT(
SK]
@46N
p0n05
JnwHp:
47..
M =
a7!(
M^3zo
~AD%
cGX
@^"e
ky@y
<AL4
ho}sY
"Dh
Djj!
kaZLq
3OoW
Oql lP
c7i~<Wx
tfnh Y(
-0FL
QI_\@e
String
^;@@
fpp
&]hL<fx
ulz#l
%GtZ
D1
} 7K
x0"3
5jw6
_zK2
10+
@d#?c
SLlO
JX:*
u\Yp|
oq q_g{
InitializeArray
oV h
JZ0W
~|U
,[?K
Hbom
"YZc
&iTY.
()5)
>#gPG
s<"D
k#gE
?# 7
- =!7
XVw?
:=~Y
i}xUMn
EevKi'
L~fn
3hFo
-*2+Us
{-ETi
k~.d
EwH |X1!(
.V3,
r^ b
4U+6
f[*A9(
l[r-
Af,*
G{;%
ykl:
Oo->
.VhN
f4 S
vqF6
ay [
K6%5
Z2qY
NqDoYDi
XIBP
yD~D
k{^ts %d
%PaL
l[rW
Load
m -3
Hqq9
/$x(
E-c-
}MEHLNA
Zte>6;
+) p"
]*S::B
b~Kx
e}d`zi~
Lm;.+9
+"h8
;; ;
mCD3E
PsW\
\sVgh'
;; <
\ |(
~({s
=fNb
T6}>
t^/.Fy
tIFl6u
^oy-
19dI
EJGgRbFv
bEXt
5B 1
bVHj
r,7f3
6i>3
q4(]t
T+'<
yp
0mL?u/
n /g
c$@N
DnGg
\5 =
7v _
[h:q
y@b%
~O*9
fEdH
>$RM
3 8<
'""d
+j=dydA%
c1j~
N$-L
Vd}v
RuntimeHelpers
BlSO
7a{H
W m(6
Bhttp://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
AmP<
O}gy
|&^uaj
Aoc>
*7b$
E~ Q
?l3J
(pk
VUO+K
'3G6J
39 TV3j
ykfi
'jI=
0wml
miKYj
O&_^
)/Pf
Object
+ka8]X
qxuj
Lfvg
o h^
>7vL
4>n?|#
a_,
'TOC
Rf K
A4%
ek&6
?uC&o
/yFK
SpGE
1X-6
6} \)>3)i
{4m}O
{0.]
93 #
Yh[B
DigiCert Inc1
*ZW
Y%{"s
6)ku
aZn;
*-tR
24=1_
q62o
[l^A
M#Se,
g74P
*)`/
}: *J
4~*hg
Ya=
Rv8$
+t 6
NPIl
_kLQ
1;f<
b3AF+
y2gY^P
2f']\.
%yZ4
k+x/
asi=2M
L2_
}X7_
>\(,c
i8NR
ZHnRs
\ QI
V@j!
? nw
_-U[N
,3\Vv
kF)h
M}5S
08y.
}E)R
c29R
6QZb
AMQm
/"K$
9Tdp@
FG|!)[
\A@O$
]`$Z ^[
Bv,g?cm
wHQmad
lNG ?
fMX>
DSyX6?
Q?:r
8B p
&naH
r1d~
o'9H
wMR
A\9
=6p?
! (N
#:}#
\^OD
&sA
,5/L
x3 nP
R(H~XIKmf>(
9sw0
;u2Z9@
w#) x
.wJ|
CeQ[<
yQGi
eHnl
X?TK*-wl
FS;
1Dtr
eQb!_
xpA;
Ax/;
)=wz
gm7S
"<-u}
}N@gX
6m}h<
df^*WvT
FGz7
39]Y%
A- h
/!!~
&_&(%
ZO1[
KTvu
w ww
Mq[Qu{
C*J`
Uvgg
W#.?
rPn
5*@a.
^,5!
S)n?
]Rg
R.bK
qzs9:
" mH
TnwE#xu
R ~F
~4]/b
gr<gl
~YSN
\ qe
S<,*
X tl
-]xm
System.Threading
y &+a
q!7u
;0JUQ"
"8l?
<lbL+Jj
Ma.
a,@c
)n*e0
I]M}
wPxTpX
#3 !
BL{_a3
$ztI
c&]$
H3X>
x0,TY
: wj"
-8 m
Q3/!jv
ValueType
#/Un
:td5
i_L>
E8k8
YO)r
XY@G
83AV
qTn@5
"=agM&P vU
O}J-e
R]LI
\,f]
jO~:F
ac1l
<ifsY
vD..
d""1}
(] >
A N v
nWHCR
^P$
69
GDJWOCULCHHMCOWRYQDURKXWLVH
vf*)
*o3,
r|Pd
$qE1|
fuzf
ww`G;
2hr"
v 6p$
z=QK
:jme#
jtIt 1
_ -^
;c9 *
kau=
ReRM
f>[+
Thi*
"ejC
'1x6
[ jX-lrw
sNpA
~J]1[
_j5V
m6B_
)G@1
VIA?
m6BE
Ckdw
RbI{0e
O}:
Q9"8c
Cfs=
Western Cape1
4 Q:
f.TO
yq+T|O b
'm|YnwkC
7>(b
2ymQOC
9iuO
aaL Bb
w{DJ
Q`^&
p$) I~
UNXy
R0db#
s?4*
$\l1
7$k(,?
P}"TL 1tG
9}@}
<PrivateImplementationDetails>{C8BB7FD6-B0AB-4578-827E-EC607BB7268B}
- )
FQ{7
a@*a
?HCZ
T2_U
'+jdFX
M0HFm:
i#>f^
N6I
;? R
jf<>
!Q'?
,k4t1
h U
rX;Y
]X+y
qu5b
6 ~eU0
vMdZ&!5
9SO|g
1: w
g( b
'1+
OHgzB
l-/Kp^i
CgHL
K@?kw
y`_/
dVvB
ApJg
2G_
>Mj9
upbl
+:-ki
`B/`97
Ui)>
aQ?B
<7=&
t 0E
Ko|Q
22 8
F):j
rIN>F
Mk0"AO
bOTP
&|DU
X6t(
OCY{u9
#^V:
imdX
6Gu{
*)O-
a<899
Uw }%k
1bGy
w3ze
[DK-@F
S}K+,
{xi9F
EK^d
EwFV
fLg
"7>L$
?oKH
h[v~
eL*d+
AwD
:>l~H
GJr q
D(aX
g>C(
2Eas
F!am
MS>'
P 8
3_UO
7yeVA
Gj!\
c<n8
'Y'5
b-Av
88BF
c8Doy%
F*%4
t9:
hJL>LN
y\.e)
*?w2i
r \l
$S5~Z
C G
LkB{
<#& 1
S5O2
5a;{
f] +
hzxsAc@
<xh@
D,!{n
2;z6
i&@1oY
''I~
System.Runtime.CompilerServices
|{Gd
`Fq[
s~A
BVTs
$Q'(
#QPs
zAb
#AnWX
gIo6
l |6i
`>#QlSP
"%zq
cyb`
jp9S
8} $
XfvD
$J21
DZn`QK
L995
v)5B:N
3xz"
4fmJ
OR~C y
oUiP)\
O/_A
7\YIW
!cIO
s,FL
F{*a
B>gp
-%/B
"/m9ut
38@2
Xh
^N^F
KG$=^)
%!=(
1mEKJ
b n)
[Eci
co$=)
I<TR
gXq`u
L3X*
/ pG"
- eU
Ei*xV
}s-"
M$fh
cct+<G
kUEgo
/sCH:
4S+3%L
V:p1
|ud>5
O+^
*8:W
X]6"
tbOi
RbQE
Q;iqZ
eu[p+&!
,*qu-_H
9s1S
-33
$7T%9kmL
S*
Vt\:
.*xK
x1' \h
DG;7 v
9FBVc*
+eutp7
,U{E
]F<3
lTey_}
b] 2
#Sflz
vt^v
;!k<
X0 f1
=mXm
KX [
rB94
p@'0
z!l
YV$n
h9SP$?
glX
Cl(Y
qC\P
r]zA
X-&/m;&\L
c8r\
6bz>-
[8Lr
w>x;LA
/'a$D
;9k1
GO2
/ [a
d[-n
" C%
C:I
>FBP
x37x,
#Y8Gy1
a45\]
K.@>
rbT
DTci
aYwpq
_3.
Y)Ef
fz6B
r.?hO
o6H>l1
(1[T
7L jf}~D
F4j`)
vojt
Hmv&
m Q.
O@j
HJ.
+@sF&
v+ ^
JZZ[b
exdx#
'aKQ%
@}U\
d 6
G8@AQC
>3M'/
>+3
/vg
#&"
<R c
!jR
Epp>fU
fmth
UsF4(
W;?U
Kkj{
}3V
uT)z
nbFT
t#5N/
!Pd@
nkvak
HhD
)Dj?.1
_QYH
JTj$
D'TE
$M]#M
GX.[
-*qa
#zRij
0ZlY%
3j,
:1 &
~Z|ofOw
9f!O
'r3CC-
Ne"
t|`!|z
*ZI
PYxqYR
*8b'
L}An
lu4D
)etqL
w1 n
8:n:(
Sz#G
63"p
@>Yw(
4[>
RGX*
<7MY
3G d
G&b-
o`{-
a/8t
j^vc
rH*<
om4C
E=)AZ
<4*_+O.[2
mW3}
t}DzU
VFoxM
~8A.
7/h&
]to9p
sQWn
WITXYZIBGMONFC
zsu)
Ha=
#sBo
55~\
EHZCXIPQUQJSCKWPHL
MA{q,
W9U?
76_ m
ICT
LE\]
TVe i
_-Z>eR
Cg%l`81
,Z&{
Dm`%
0 )K
fgszu
B[ !
>gQ9
LNJ(
!g)!oz
"2<UO
z0<0
p,0s
#}ZK
\Ia9K
U`:0
Y!EC
;,+`~
H| -o
zJOa
&EzT
X)<&
b*J:*:
x\Tz7
r$H
hXYN=
u;_:4
+_8~
ygL"
r4Q#AHD
k;1z
nqOT
"N^|D
?]R~
U|$2
YUKZM
UWU+2P
#R8F;
H0x?_#2
:OTK
/=zz
=`OY
w%RVH)
`&?O
\9qIE$2
W<^d
n)dp
sRV6
zEO5
m(j.
5O@t
q]C uf
2,'v
|.2[2Q
fsIX
8xCs
sFB*
I]p]?X
>:s%
8\vC
EY0(
;g31% T
wnNo&&I
~! 1
||YF
%]@Y?I
Qr)H`
[T3%~
tS~6
(6X\
/,aR
I6'2@5
!7:;l
6-"!r
2J}'
Zp3B
n \j
-_!
7Oia
|X<M
Yo S
l bG7P
W:A1a
NgL)
2w83S
[C54
,D~N#
1Qw4.*-
oR.x
Uv]V
3W<t&
5k5]<
2*~V
AXOG
nX_f
I*Ih
@[ K
z~Yz~UG
Rrd
;L or@G
}<Jn
;Fa%
G3n~
* BDN
5y+~
rX9H
s8vr
r$b#@
}JV]
%s?pj
r f
53BV
6.`
(.x*DY
(o(
-D D
,0~lRp
EGQZWQDKGYIOZTZKRZEDCNAHCHIBXULSGNEJMEHSK
"s&
t%'|
!I4R<
+N.'o
p|fW
dz ,
ejGy\-mj
f\Sw
z |{a
=f R
J ng
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven02_64 Seven02_64 VirtualBox 2018-05-10 12:19:33 2018-05-10 12:22:32 179

10 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven02_64 Seven02_64 VirtualBox 2018-05-10 12:19:33 2018-05-10 12:22:32 179

9 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\wassus.exe.config
C:\Users\Seven01\AppData\Local\Temp\wassus.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSVCR120_CLR0400.dll
C:\Windows\System32\MSVCR120_CLR0400.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config
C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\96c8ba86b82ee32f586da00a8b721fda\mscorlib.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\96c8ba86b82ee32f586da00a8b721fda\mscorlib.ni.dll.aux
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll
\Device\KsecDD
C:\Windows\assembly\NativeImages_v4.0.30319_32\WCOPGSDKWN\*
C:\Users\Seven01\AppData\Local\Temp\wassus.INI
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
C:\Windows\assembly\pubpol21.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\Microsoft.Net\assembly\GAC_32\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\feeacef715fd335a37a58022b3a2fefb\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\feeacef715fd335a37a58022b3a2fefb\Microsoft.VisualBasic.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_32\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\ea5ca00aa792b96c036a1b3d57b28f9a\System.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\ea5ca00aa792b96c036a1b3d57b28f9a\System.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.dll
C:\Windows\Microsoft.Net\assembly\GAC_32\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8811a034e0362a8ec740c44c7136725b\System.Core.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8811a034e0362a8ec740c44c7136725b\System.Core.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Xml.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.Linq.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\SortDefault.nlp
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c7dd43f20550205c8b37ec91b5f2bec7\System.Windows.Forms.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c7dd43f20550205c8b37ec91b5f2bec7\System.Windows.Forms.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\00ea0c71c0a045ebceae2b3d938d251f\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\00ea0c71c0a045ebceae2b3d938d251f\System.Drawing.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\Program Files (x86)\AVAST Software\Avast\avastUI.exe
C:\Program Files\AVG\Antivirus\AVGUI.exe
C:\Program Files (x86)\AVG\Antivirus\AVGUI.exe
C:\Program Files (x86)\KasperSky Lab\
C:\Program Files\KasperSky Lab\
C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\service.js
C:\Windows\System32\UxTheme.dll.Config
C:\Windows\System32\uxtheme.dll
C:\Users\Seven01\AppData\Local\Temp\wassus.exe.Local\
C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2
C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
C:\Windows\WindowsShell.Manifest
C:\Users\Seven01\AppData\Local\Temp\ghzspbf
C:\Users\Seven01\AppData\Local\Temp\autB390.tmp
C:\Users\Seven01\AppData\Local\Temp\winmgmts:{impersonationLevel=impersonate}!\root\cimv2
C:\Windows\sysnative\wbem\WmiPrvSE.exe
C:\Windows\inf\hdaudio.inf
C:\Windows\sysnative\DriverStore\it-IT\hdaudio.inf_loc
C:\Windows\inf\hdaudio.PNF
\??\PIPE\samr
C:\Windows\sysnative\wbem\repository
C:\Windows\sysnative\wbem\Logs
C:\Windows\sysnative\wbem\AutoRecover
C:\Windows\sysnative\wbem\MOF
C:\Windows\sysnative\wbem\repository\INDEX.BTR
C:\Windows\sysnative\wbem\repository\WRITABLE.TST
C:\Windows\sysnative\wbem\repository\MAPPING1.MAP
C:\Windows\sysnative\wbem\repository\MAPPING2.MAP
C:\Windows\sysnative\wbem\repository\MAPPING3.MAP
C:\Windows\sysnative\wbem\repository\OBJECTS.DATA
C:\Windows\sysnative\wbem\repository\WBEM9xUpgd.dat
\??\pipe\PIPE_EVENTROOT\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER
\??\pipe\PIPE_EVENTROOT\CIMV2PROVIDERSUBSYSTEM
\??\WMIDataDevice

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\wassus.exe.config
C:\Users\Seven01\AppData\Local\Temp\wassus.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Windows\System32\MSVCR120_CLR0400.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\96c8ba86b82ee32f586da00a8b721fda\mscorlib.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\96c8ba86b82ee32f586da00a8b721fda\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
C:\Windows\assembly\pubpol21.dat
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\feeacef715fd335a37a58022b3a2fefb\Microsoft.VisualBasic.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\ea5ca00aa792b96c036a1b3d57b28f9a\System.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\ea5ca00aa792b96c036a1b3d57b28f9a\System.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8811a034e0362a8ec740c44c7136725b\System.Core.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8811a034e0362a8ec740c44c7136725b\System.Core.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\feeacef715fd335a37a58022b3a2fefb\Microsoft.VisualBasic.ni.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\SortDefault.nlp
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c7dd43f20550205c8b37ec91b5f2bec7\System.Windows.Forms.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\00ea0c71c0a045ebceae2b3d938d251f\System.Drawing.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\00ea0c71c0a045ebceae2b3d938d251f\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c7dd43f20550205c8b37ec91b5f2bec7\System.Windows.Forms.ni.dll
C:\Windows\System32\UxTheme.dll.Config
C:\Windows\System32\uxtheme.dll
C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
C:\Windows\WindowsShell.Manifest
C:\Users\Seven01\AppData\Local\Temp\autB390.tmp
C:\Users\Seven01\AppData\Local\Temp\ghzspbf
C:\Users\Seven01\AppData\Local\Temp\winmgmts:{impersonationLevel=impersonate}!\root\cimv2
C:\Windows\sysnative\wbem\WmiPrvSE.exe
C:\Windows\inf\hdaudio.PNF
\??\PIPE\samr
C:\Windows\sysnative\wbem\repository\MAPPING1.MAP
C:\Windows\sysnative\wbem\repository\MAPPING2.MAP
C:\Windows\sysnative\wbem\repository\MAPPING3.MAP
C:\Windows\sysnative\wbem\repository\OBJECTS.DATA
C:\Windows\sysnative\wbem\repository\INDEX.BTR
\??\pipe\PIPE_EVENTROOT\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER
\??\pipe\PIPE_EVENTROOT\CIMV2PROVIDERSUBSYSTEM
\??\WMIDataDevice

Write Files

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\service.js
C:\Users\Seven01\AppData\Local\Temp\autB390.tmp
C:\Users\Seven01\AppData\Local\Temp\ghzspbf
\??\PIPE\samr
C:\Windows\sysnative\wbem\repository\WRITABLE.TST
C:\Windows\sysnative\wbem\repository\MAPPING1.MAP
C:\Windows\sysnative\wbem\repository\MAPPING2.MAP
C:\Windows\sysnative\wbem\repository\MAPPING3.MAP
C:\Windows\sysnative\wbem\repository\OBJECTS.DATA
C:\Windows\sysnative\wbem\repository\INDEX.BTR
\??\pipe\PIPE_EVENTROOT\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER
\??\pipe\PIPE_EVENTROOT\CIMV2PROVIDERSUBSYSTEM
\??\WMIDataDevice

Delete Files

C:\Users\Seven01\AppData\Local\Temp\autB390.tmp
C:\Users\Seven01\AppData\Local\Temp\ghzspbf

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v4.0.30319
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v4.0.30319\SKUs\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319\SKUs\default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\NET Framework Setup\NDP\v4\Full\Release
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wassus.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseRetryAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseMillisecondsBetweenRetries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\NGen\Policy\v4.0
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\NGen\Policy\v4.0\OptimizeUsedBinaries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\Servicing
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\it-IT
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\it-IT
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\AltJit
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index21
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.10.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.10.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Numerics__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Numerics__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Xml.Linq__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Xml.Linq__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000410
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_CURRENT_USER\Control Panel\Mouse
HKEY_CURRENT_USER\Control Panel\Mouse\SwapMouseButtons
HKEY_CURRENT_USER\Software\AutoIt v3\AutoIt
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\wassus.exe
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\msvideo
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo2
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo3
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo4
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo5
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo6
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo7
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo8
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Classes\winmgmts
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WINMGMTS\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WINMGMTS\CLSID\(Default)
HKEY_USERS\S-1-5-20_Classes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\LocalServer32\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\LocalServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\LocalServer32\ServerExecutable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\LocalService
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\DllSurrogate
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\RunAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\ActivateAtStorage
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\ROTFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\AppIDFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\LaunchPermission
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\LegacyAuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\LegacyImpersonationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\AuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\RemoteServerName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\SRPTrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\PreferredServerBitness
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\LoadUserSettings
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\Elevation
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Power\PowerRequestOverride
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Power\PowerRequestOverride
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Power\PowerRequestOverride\Driver
HKEY_LOCAL_MACHINE\Software\Microsoft\COM3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\REGDBVersion
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\HDAUDIO\FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034\4&31E60982&0&0001
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\HDAUDIO\FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034\4&31E60982&0&0001\DeviceDesc
HKEY_USERS\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_USERS\S-1-5-21-1822907384-1282624486-319450072-1000\Control Panel\International
HKEY_USERS\S-1-5-21-1822907384-1282624486-319450072-1000\Control Panel\International\LocaleName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\HDAUDIO\FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034\4&31E60982&0&0001\Properties
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\HDAUDIO\FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034\4&31E60982&0&0001\Properties\{b3f8fa53-0004-438e-9003-51a46e139bfc}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\HDAUDIO\FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034\4&31E60982&0&0001\Properties\{b3f8fa53-0004-438e-9003-51a46e139bfc}\00000007
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\HDAUDIO\FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034\4&31E60982&0&0001\Properties\{b3f8fa53-0004-438e-9003-51a46e139bfc}\00000007\00000000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\HDAUDIO\FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034\4&31E60982&0&0001\Properties\{b3f8fa53-0004-438e-9003-51a46e139bfc}\00000007\00000000\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\HDAUDIO\FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034\4&31E60982&0&0001\Properties\{b3f8fa53-0004-438e-9003-51a46e139bfc}\00000007\00000000\Data
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\LocalService
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\ServiceParameters
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\RunAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\ActivateAtStorage
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\ROTFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\AppIDFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\LaunchPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\AuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\RemoteServerName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\SRPTrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\PreferredServerBitness
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\LoadUserSettings
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{eb115ffc-10c8-4964-831d-6dcb02e6f23f}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{EB115FFC-10C8-4964-831D-6DCB02E6F23F}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&31e60982&0&0001#{eb115ffc-10c8-4964-831d-6dcb02e6f23f}\#eheadphonewave
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{EB115FFC-10C8-4964-831D-6DCB02E6F23F}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&31e60982&0&0001#{eb115ffc-10c8-4964-831d-6dcb02e6f23f}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{EB115FFC-10C8-4964-831D-6DCB02E6F23F}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&31E60982&0&0001#{eb115ffc-10c8-4964-831d-6dcb02e6f23f}\DeviceInstance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{EB115FFC-10C8-4964-831D-6DCB02E6F23F}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&31E60982&0&0001#{eb115ffc-10c8-4964-831d-6dcb02e6f23f}\#eHeadphoneWave\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{EB115FFC-10C8-4964-831D-6DCB02E6F23F}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&31E60982&0&0001#{eb115ffc-10c8-4964-831d-6dcb02e6f23f}\#eHeadphoneWave\Control\Linked
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{EB115FFC-10C8-4964-831D-6DCB02E6F23F}\Properties
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6994ad04-93ef-11d0-a3cc-00a0c9223196}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&31e60982&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\#eCDInTopo
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&31e60982&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&31E60982&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\DeviceInstance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\Properties
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&31e60982&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\#eCDInWave
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&31e60982&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\#eHeadphoneTopo
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&31e60982&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\#eHeadphoneWave
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&31e60982&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\#eMicInTopo
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&31e60982&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\#eMicInWave
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&31e60982&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\#eSpeakerTopo
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&31e60982&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\#eSpeakerWave
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\HDAUDIO\FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034\4&31E60982&0&0001\Capabilities
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\HDAUDIO\FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034\4&31E60982&0&0001\ConfigFlags
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#hdaudio#func_01&ven_8384&dev_7680&subsys_83847680&rev_1034#4&31e60982&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\#eheadphonetopo
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&31E60982&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\#eHeadphoneTopo\Properties
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&31E60982&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\#eHeadphoneTopo\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&31E60982&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\#eHeadphoneTopo\Properties\{840b8171-b0ad-410f-8581-cccc0382cfef}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&31E60982&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\#eHeadphoneTopo\Properties\{840b8171-b0ad-410f-8581-cccc0382cfef}\00000000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&31E60982&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\#eHeadphoneTopo\Properties\{840b8171-b0ad-410f-8581-cccc0382cfef}\00000000\00000000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&31E60982&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\#eHeadphoneTopo\Properties\{840b8171-b0ad-410f-8581-cccc0382cfef}\00000000\00000000\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&31E60982&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\#eHeadphoneTopo\Properties\{840b8171-b0ad-410f-8581-cccc0382cfef}\00000000\00000000\Data
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#hdaudio#func_01&ven_8384&dev_7680&subsys_83847680&rev_1034#4&31e60982&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\#eheadphonewave
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&31E60982&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\#eHeadphoneWave\Properties
HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\Tracing\WMI
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\SessionEnabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\AreaFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\Session
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\LogFile
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\MinimumBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\MaximumBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\MaximumFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\LogFileMode
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\FlushTimer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\AgeLimit
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SYSTEM\Setup
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\SYSTEM\Setup\UpgradeInProgress
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Safeboot\Option
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Rpc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Settings
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Settings\ActiveWriterStateTimeout
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\(Default)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag\WMI Writer
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Settings\TornComponentsMax
HKEY_LOCAL_MACHINE\Software\Classes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000100-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000100-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000100-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9555-4FB6-11D1-9971-00C04FBBB345}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9555-4FB6-11D1-9971-00C04FBBB345}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9555-4FB6-11D1-9971-00C04FBBB345}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9557-4FB6-11D1-9971-00C04FBBB345}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9557-4FB6-11D1-9971-00C04FBBB345}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9557-4FB6-11D1-9971-00C04FBBB345}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\CIMOM
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\IdentifierLimit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\QueryLimit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\PathLimit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbThrottlingEnabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighMaxLimitFactor
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbTaskMaxSleep
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold1Mult
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold2Mult
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold3Mult
HKEY_LOCAL_MACHINE\system\Setup
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Unchecked Task Count
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\LastServiceStart
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Working Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Repository Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Build
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Logging Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\MOF Self-Install Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Default Repository Driver
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueCoreFsrepVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Repository Cache Spill Ratio
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\CheckPointValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\SnapShotValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\CheckRepositoryOnNextStartup
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\NumWriteIdCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Class Cache Size
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Class Cache Item Age (ms)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\EnableObjectValidation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\NextAutoRecoverFile
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Enable Provider Subsystem
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Transports\Decoupled\Client
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Transports\Decoupled\Client\{4528B43E-8110-4BC2-9519-4704F6839CC9}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{4528B43E-8110-4BC2-9519-4704F6839CC9}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{4528B43E-8110-4BC2-9519-4704F6839CC9}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{4528B43E-8110-4BC2-9519-4704F6839CC9}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{4528B43E-8110-4BC2-9519-4704F6839CC9}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{4528B43E-8110-4BC2-9519-4704F6839CC9}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{4528B43E-8110-4BC2-9519-4704F6839CC9}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{4528B43E-8110-4BC2-9519-4704F6839CC9}\ProcessIdentifier
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Transports\Decoupled\Client\{98ED7337-6B70-4CB1-AF2E-255A91FF690F}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{98ED7337-6B70-4CB1-AF2E-255A91FF690F}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{98ED7337-6B70-4CB1-AF2E-255A91FF690F}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{98ED7337-6B70-4CB1-AF2E-255A91FF690F}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{98ED7337-6B70-4CB1-AF2E-255A91FF690F}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{98ED7337-6B70-4CB1-AF2E-255A91FF690F}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{98ED7337-6B70-4CB1-AF2E-255A91FF690F}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{98ED7337-6B70-4CB1-AF2E-255A91FF690F}\ProcessIdentifier
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Transports\Decoupled\Client\{9AFECCEE-F4AB-4D2A-8F19-A565C84B3A3E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{9AFECCEE-F4AB-4D2A-8F19-A565C84B3A3E}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{9AFECCEE-F4AB-4D2A-8F19-A565C84B3A3E}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{9AFECCEE-F4AB-4D2A-8F19-A565C84B3A3E}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{9AFECCEE-F4AB-4D2A-8F19-A565C84B3A3E}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{9AFECCEE-F4AB-4D2A-8F19-A565C84B3A3E}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{9AFECCEE-F4AB-4D2A-8F19-A565C84B3A3E}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{9AFECCEE-F4AB-4D2A-8F19-A565C84B3A3E}\ProcessIdentifier
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Transports\Decoupled\Client\{E67713A8-22A6-4301-8DC7-EDD0251B97C7}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{E67713A8-22A6-4301-8DC7-EDD0251B97C7}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{E67713A8-22A6-4301-8DC7-EDD0251B97C7}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{E67713A8-22A6-4301-8DC7-EDD0251B97C7}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{E67713A8-22A6-4301-8DC7-EDD0251B97C7}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{E67713A8-22A6-4301-8DC7-EDD0251B97C7}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{E67713A8-22A6-4301-8DC7-EDD0251B97C7}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{E67713A8-22A6-4301-8DC7-EDD0251B97C7}\ProcessIdentifier
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Transports\Decoupled\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Server\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Server\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Server\ProcessIdentifier
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\EnableEvents
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueEssToBeInitialized
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Low Threshold On Events (B)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\High Threshold On Events (B)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Wait On Events (ms)
HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\ESS
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Merger Query Arbitration Enabled
HKEY_LOCAL_MACHINE\software\microsoft\wbem\cimom
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\SetupDate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Async Result Queue Size
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\CIMOM
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\FinalizerBatchSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ClientCallbackTimeout
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\FinalizerQueueThreshold
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Tasks
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\cimv2
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\cimv2
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\it
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\it
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueEssNeedsLoading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\List of event-active namespaces
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\ESS\//./root/subscription
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\ESS\//./root/CIMV2
HKEY_LOCAL_MACHINE\Software\Microsoft\OleAut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}\ProxyStubClsid32\(Default)
HKEY_CLASSES_ROOT\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InprocServer32\(Default)
HKEY_CLASSES_ROOT\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InprocServer32\Synchronization
HKEY_CLASSES_ROOT\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\AppId
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InprocServer32\Synchronization
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\AppId
HKEY_CLASSES_ROOT\CLSID\{d63a5850-8f16-11cf-9f47-00aa00bf345c}\InProcServer32
HKEY_CLASSES_ROOT\CLSID\{d63a5850-8f16-11cf-9f47-00aa00bf345c}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\InprocServer32\Synchronization
HKEY_CLASSES_ROOT\CLSID\{d63a5850-8f16-11cf-9f47-00aa00bf345c}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\AppId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\SecuredHostProviders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\SecuredHostProviders\ROOT\CIMV2:__Win32Provider.Name="CIMWin32"
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\minint
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\ESS\//./root/CIMV2\SCM Event Provider
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\Root
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\Root
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7B31DF9-D515-11D3-A11C-00105A1F515A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{07435309-D440-41B7-83F3-EB82DB6C622F}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{07435309-D440-41B7-83F3-EB82DB6C622F}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{07435309-D440-41B7-83F3-EB82DB6C622F}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F50A28CF-5C9C-4F7E-9D80-E25E16E18C59}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F50A28CF-5C9C-4F7E-9D80-E25E16E18C59}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F50A28CF-5C9C-4F7E-9D80-E25E16E18C59}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6B3FC272-BF37-4968-933A-6DF9222A2607}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6B3FC272-BF37-4968-933A-6DF9222A2607}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6B3FC272-BF37-4968-933A-6DF9222A2607}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0FC8C622-1728-4149-A57F-AD19D0970710}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0FC8C622-1728-4149-A57F-AD19D0970710}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0FC8C622-1728-4149-A57F-AD19D0970710}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FEC1B0AC-5808-4033-A915-C0185934581E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FEC1B0AC-5808-4033-A915-C0185934581E}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FEC1B0AC-5808-4033-A915-C0185934581E}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EB658B8A-7A64-4DDC-9B8D-A92610DB0206}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EB658B8A-7A64-4DDC-9B8D-A92610DB0206}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EB658B8A-7A64-4DDC-9B8D-A92610DB0206}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Sink Transmit Buffer Size
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Cimom
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\DefaultRpcStackSize
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\AccessProviders
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\wmiprvse.exe
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Hostname
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\System\DNSclient
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Domain
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\InprocHandler
HKEY_CURRENT_USER
HKEY_CURRENT_USER\Control Panel\International
HKEY_CURRENT_USER\Control Panel\International\LocaleName
HKEY_CURRENT_USER\Control Panel\International\sCountry
HKEY_CURRENT_USER\Control Panel\International\sList
HKEY_CURRENT_USER\Control Panel\International\sDecimal
HKEY_CURRENT_USER\Control Panel\International\sThousand
HKEY_CURRENT_USER\Control Panel\International\sGrouping
HKEY_CURRENT_USER\Control Panel\International\sNativeDigits
HKEY_CURRENT_USER\Control Panel\International\sCurrency
HKEY_CURRENT_USER\Control Panel\International\sMonDecimalSep
HKEY_CURRENT_USER\Control Panel\International\sMonThousandSep
HKEY_CURRENT_USER\Control Panel\International\sMonGrouping
HKEY_CURRENT_USER\Control Panel\International\sPositiveSign
HKEY_CURRENT_USER\Control Panel\International\sNegativeSign
HKEY_CURRENT_USER\Control Panel\International\sTimeFormat
HKEY_CURRENT_USER\Control Panel\International\sShortTime
HKEY_CURRENT_USER\Control Panel\International\s1159
HKEY_CURRENT_USER\Control Panel\International\s2359
HKEY_CURRENT_USER\Control Panel\International\sShortDate
HKEY_CURRENT_USER\Control Panel\International\sYearMonth
HKEY_CURRENT_USER\Control Panel\International\sLongDate
HKEY_CURRENT_USER\Control Panel\International\iCountry
HKEY_CURRENT_USER\Control Panel\International\iMeasure
HKEY_CURRENT_USER\Control Panel\International\iPaperSize
HKEY_CURRENT_USER\Control Panel\International\iDigits
HKEY_CURRENT_USER\Control Panel\International\iLZero
HKEY_CURRENT_USER\Control Panel\International\iNegNumber
HKEY_CURRENT_USER\Control Panel\International\NumShape
HKEY_CURRENT_USER\Control Panel\International\iCurrDigits
HKEY_CURRENT_USER\Control Panel\International\iCurrency
HKEY_CURRENT_USER\Control Panel\International\iNegCurr
HKEY_CURRENT_USER\Control Panel\International\iCalendarType
HKEY_CURRENT_USER\Control Panel\International\iFirstDayOfWeek
HKEY_CURRENT_USER\Control Panel\International\iFirstWeekOfYear
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Logging

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\NET Framework Setup\NDP\v4\Full\Release
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseRetryAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseMillisecondsBetweenRetries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\NGen\Policy\v4.0\OptimizeUsedBinaries
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\it-IT
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\it-IT
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\AltJit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index21
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000410
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_CURRENT_USER\Control Panel\Mouse\SwapMouseButtons
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo2
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo3
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo4
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo5
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo6
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo7
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo8
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WINMGMTS\CLSID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\LocalServer32\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\LocalServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\LocalServer32\ServerExecutable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\LocalService
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\DllSurrogate
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\RunAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\ActivateAtStorage
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\ROTFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\AppIDFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\LaunchPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\LegacyAuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\LegacyImpersonationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\AuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\RemoteServerName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\SRPTrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\PreferredServerBitness
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}\LoadUserSettings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\REGDBVersion
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\HDAUDIO\FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034\4&31E60982&0&0001\DeviceDesc
HKEY_USERS\S-1-5-21-1822907384-1282624486-319450072-1000\Control Panel\International\LocaleName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\HDAUDIO\FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034\4&31E60982&0&0001\Properties\{b3f8fa53-0004-438e-9003-51a46e139bfc}\00000007\00000000\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\HDAUDIO\FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034\4&31E60982&0&0001\Properties\{b3f8fa53-0004-438e-9003-51a46e139bfc}\00000007\00000000\Data
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\LocalService
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\ServiceParameters
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\RunAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\ActivateAtStorage
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\ROTFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\AppIDFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\LaunchPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\AuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\RemoteServerName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\SRPTrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\PreferredServerBitness
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\LoadUserSettings
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{EB115FFC-10C8-4964-831D-6DCB02E6F23F}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&31E60982&0&0001#{eb115ffc-10c8-4964-831d-6dcb02e6f23f}\DeviceInstance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{EB115FFC-10C8-4964-831D-6DCB02E6F23F}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&31E60982&0&0001#{eb115ffc-10c8-4964-831d-6dcb02e6f23f}\#eHeadphoneWave\Control\Linked
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&31E60982&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\DeviceInstance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\HDAUDIO\FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034\4&31E60982&0&0001\Capabilities
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\HDAUDIO\FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034\4&31E60982&0&0001\ConfigFlags
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&31E60982&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\#eHeadphoneTopo\Properties\{840b8171-b0ad-410f-8581-cccc0382cfef}\00000000\00000000\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&31E60982&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\#eHeadphoneTopo\Properties\{840b8171-b0ad-410f-8581-cccc0382cfef}\00000000\00000000\Data
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\SessionEnabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\AreaFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\Session
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\LogFile
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\MinimumBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\MaximumBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\MaximumFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\LogFileMode
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\FlushTimer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\AgeLimit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\SYSTEM\Setup\UpgradeInProgress
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Settings\ActiveWriterStateTimeout
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\(Default)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Settings\TornComponentsMax
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000100-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9555-4FB6-11D1-9971-00C04FBBB345}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9557-4FB6-11D1-9971-00C04FBBB345}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\IdentifierLimit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\QueryLimit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\PathLimit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbThrottlingEnabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighMaxLimitFactor
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbTaskMaxSleep
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold1Mult
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold2Mult
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold3Mult
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Unchecked Task Count
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\LastServiceStart
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Working Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Repository Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Build
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Logging Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\MOF Self-Install Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Default Repository Driver
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueCoreFsrepVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Repository Cache Spill Ratio
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\CheckPointValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\SnapShotValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\CheckRepositoryOnNextStartup
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\NumWriteIdCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Class Cache Size
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Class Cache Item Age (ms)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\EnableObjectValidation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\NextAutoRecoverFile
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Enable Provider Subsystem
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{4528B43E-8110-4BC2-9519-4704F6839CC9}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{4528B43E-8110-4BC2-9519-4704F6839CC9}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{4528B43E-8110-4BC2-9519-4704F6839CC9}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{4528B43E-8110-4BC2-9519-4704F6839CC9}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{4528B43E-8110-4BC2-9519-4704F6839CC9}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{4528B43E-8110-4BC2-9519-4704F6839CC9}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{4528B43E-8110-4BC2-9519-4704F6839CC9}\ProcessIdentifier
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{98ED7337-6B70-4CB1-AF2E-255A91FF690F}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{98ED7337-6B70-4CB1-AF2E-255A91FF690F}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{98ED7337-6B70-4CB1-AF2E-255A91FF690F}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{98ED7337-6B70-4CB1-AF2E-255A91FF690F}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{98ED7337-6B70-4CB1-AF2E-255A91FF690F}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{98ED7337-6B70-4CB1-AF2E-255A91FF690F}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{98ED7337-6B70-4CB1-AF2E-255A91FF690F}\ProcessIdentifier
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{9AFECCEE-F4AB-4D2A-8F19-A565C84B3A3E}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{9AFECCEE-F4AB-4D2A-8F19-A565C84B3A3E}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{9AFECCEE-F4AB-4D2A-8F19-A565C84B3A3E}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{9AFECCEE-F4AB-4D2A-8F19-A565C84B3A3E}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{9AFECCEE-F4AB-4D2A-8F19-A565C84B3A3E}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{9AFECCEE-F4AB-4D2A-8F19-A565C84B3A3E}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{9AFECCEE-F4AB-4D2A-8F19-A565C84B3A3E}\ProcessIdentifier
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{E67713A8-22A6-4301-8DC7-EDD0251B97C7}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{E67713A8-22A6-4301-8DC7-EDD0251B97C7}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{E67713A8-22A6-4301-8DC7-EDD0251B97C7}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{E67713A8-22A6-4301-8DC7-EDD0251B97C7}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{E67713A8-22A6-4301-8DC7-EDD0251B97C7}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{E67713A8-22A6-4301-8DC7-EDD0251B97C7}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{E67713A8-22A6-4301-8DC7-EDD0251B97C7}\ProcessIdentifier
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\EnableEvents
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueEssToBeInitialized
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Low Threshold On Events (B)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\High Threshold On Events (B)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Wait On Events (ms)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Merger Query Arbitration Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\SetupDate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Async Result Queue Size
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\FinalizerBatchSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ClientCallbackTimeout
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\FinalizerQueueThreshold
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Tasks
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\cimv2
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\cimv2
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\it
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\it
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InprocServer32\Synchronization
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\AppId
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InprocServer32\Synchronization
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\AppId
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\InprocServer32\Synchronization
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\AppId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\SecuredHostProviders\ROOT\CIMV2:__Win32Provider.Name="CIMWin32"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\Root
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\Root
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{07435309-D440-41B7-83F3-EB82DB6C622F}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F50A28CF-5C9C-4F7E-9D80-E25E16E18C59}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6B3FC272-BF37-4968-933A-6DF9222A2607}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0FC8C622-1728-4149-A57F-AD19D0970710}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FEC1B0AC-5808-4033-A915-C0185934581E}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EB658B8A-7A64-4DDC-9B8D-A92610DB0206}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueEssNeedsLoading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Sink Transmit Buffer Size
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\DefaultRpcStackSize
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Hostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Domain
HKEY_CURRENT_USER\Control Panel\International\LocaleName
HKEY_CURRENT_USER\Control Panel\International\sCountry
HKEY_CURRENT_USER\Control Panel\International\sList
HKEY_CURRENT_USER\Control Panel\International\sDecimal
HKEY_CURRENT_USER\Control Panel\International\sThousand
HKEY_CURRENT_USER\Control Panel\International\sGrouping
HKEY_CURRENT_USER\Control Panel\International\sNativeDigits
HKEY_CURRENT_USER\Control Panel\International\sCurrency
HKEY_CURRENT_USER\Control Panel\International\sMonDecimalSep
HKEY_CURRENT_USER\Control Panel\International\sMonThousandSep
HKEY_CURRENT_USER\Control Panel\International\sMonGrouping
HKEY_CURRENT_USER\Control Panel\International\sPositiveSign
HKEY_CURRENT_USER\Control Panel\International\sNegativeSign
HKEY_CURRENT_USER\Control Panel\International\sTimeFormat
HKEY_CURRENT_USER\Control Panel\International\sShortTime
HKEY_CURRENT_USER\Control Panel\International\s1159
HKEY_CURRENT_USER\Control Panel\International\s2359
HKEY_CURRENT_USER\Control Panel\International\sShortDate
HKEY_CURRENT_USER\Control Panel\International\sYearMonth
HKEY_CURRENT_USER\Control Panel\International\sLongDate
HKEY_CURRENT_USER\Control Panel\International\iCountry
HKEY_CURRENT_USER\Control Panel\International\iMeasure
HKEY_CURRENT_USER\Control Panel\International\iPaperSize
HKEY_CURRENT_USER\Control Panel\International\iDigits
HKEY_CURRENT_USER\Control Panel\International\iLZero
HKEY_CURRENT_USER\Control Panel\International\iNegNumber
HKEY_CURRENT_USER\Control Panel\International\NumShape
HKEY_CURRENT_USER\Control Panel\International\iCurrDigits
HKEY_CURRENT_USER\Control Panel\International\iCurrency
HKEY_CURRENT_USER\Control Panel\International\iNegCurr
HKEY_CURRENT_USER\Control Panel\International\iCalendarType
HKEY_CURRENT_USER\Control Panel\International\iFirstDayOfWeek
HKEY_CURRENT_USER\Control Panel\International\iFirstWeekOfYear
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Logging

Write Keys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\msvideo
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\LastServiceStart
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Transports\Decoupled\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Server\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Server\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Server\ProcessIdentifier
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueEssNeedsLoading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\List of event-active namespaces

Delete Keys

Nothing to display

Mutexes

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
clr.dll.SetRuntimeInfo
clr.dll._CorExeMain
mscoree.dll.CreateConfigStream
mscoreei.dll.CreateConfigStream
kernel32.dll.GetNumaHighestNodeNumber
kernel32.dll.GetSystemWindowsDirectoryW
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddSIDToBoundaryDescriptor
kernel32.dll.CreateBoundaryDescriptorW
kernel32.dll.CreatePrivateNamespaceW
kernel32.dll.OpenPrivateNamespaceW
kernel32.dll.DeleteBoundaryDescriptor
kernel32.dll.WerRegisterRuntimeExceptionModule
kernel32.dll.RaiseException
mscoree.dll.#24
mscoreei.dll.#24
ntdll.dll.NtSetSystemInformation
kernel32.dll.SortGetHandle
kernel32.dll.SortCloseHandle
kernel32.dll.GetNativeSystemInfo
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
clrjit.dll.sxsJitStartup
clrjit.dll.getJit
kernel32.dll.LocaleNameToLCID
kernel32.dll.LCIDToLocaleName
kernel32.dll.GetUserPreferredUILanguages
nlssorting.dll.SortGetHandle
nlssorting.dll.SortCloseHandle
cryptsp.dll.CryptAcquireContextA
cryptsp.dll.CryptCreateHash
cryptsp.dll.CryptGetHashParam
cryptsp.dll.CryptHashData
cryptsp.dll.CryptDestroyHash
cryptsp.dll.CryptReleaseContext
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptImportKey
cryptsp.dll.CryptExportKey
cryptsp.dll.CryptDestroyKey
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
kernel32.dll.GetModuleHandleW
kernel32.dll.GetProcAddress
kernel32.dll.WideCharToMultiByte
user32.dll.DefWindowProcW
gdi32.dll.GetStockObject
user32.dll.RegisterClassW
ole32.dll.CoTaskMemAlloc
ole32.dll.CoTaskMemFree
user32.dll.CreateWindowExW
uxtheme.dll.ThemeInitApiHook
user32.dll.IsProcessDPIAware
user32.dll.SetWindowLongW
user32.dll.GetWindowLongW
kernel32.dll.GetCurrentProcess
kernel32.dll.GetCurrentThread
kernel32.dll.DuplicateHandle
kernel32.dll.GetCurrentThreadId
user32.dll.CallWindowProcW
user32.dll.RegisterWindowMessageW
user32.dll.SetTimer
kernel32.dll.GetEnvironmentVariableW
kernel32.dll.GetFullPathNameW
kernel32.dll.SetThreadErrorMode
kernel32.dll.GetFileAttributesExW
kernel32.dll.GetACP
kernel32.dll.UnmapViewOfFile
kernel32.dll.CloseHandle
shell32.dll.SHGetFolderPathW
kernel32.dll.CreateFileW
kernel32.dll.GetFileType
kernel32.dll.WriteFile
kernel32.dll.CreateProcessW
kernel32.dll.GetThreadContext
kernel32.dll.ReadProcessMemory
kernel32.dll.VirtualAllocEx
kernel32.dll.WriteProcessMemory
kernel32.dll.SetThreadContext
kernel32.dll.ResumeThread
user32.dll.SetClassLongW
user32.dll.PostMessageW
user32.dll.UnregisterClassW
ole32.dll.CoUninitialize
oleaut32.dll.#500
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
kernel32.dll.QueryActCtxW
advapi32.dll.EventUnregister
kernel32.dll.CreateThread
kernel32.dll.WaitForSingleObject
kernel32.dll.HeapAlloc
kernel32.dll.GetProcessHeap
kernel32.dll.HeapFree
kernel32.dll.Sleep
kernel32.dll.MultiByteToWideChar
kernel32.dll.MulDiv
kernel32.dll.GetVersionExW
kernel32.dll.IsWow64Process
kernel32.dll.GetSystemInfo
kernel32.dll.FreeLibrary
kernel32.dll.LoadLibraryA
kernel32.dll.SetErrorMode
kernel32.dll.GetModuleFileNameW
kernel32.dll.lstrcpyW
kernel32.dll.lstrlenW
kernel32.dll.QueryPerformanceCounter
kernel32.dll.VirtualFreeEx
kernel32.dll.OpenProcess
kernel32.dll.SetFilePointerEx
kernel32.dll.SetEndOfFile
kernel32.dll.ReadFile
kernel32.dll.FlushFileBuffers
kernel32.dll.TerminateProcess
kernel32.dll.CreateToolhelp32Snapshot
kernel32.dll.Process32FirstW
kernel32.dll.Process32NextW
kernel32.dll.SetFileTime
kernel32.dll.GetFileAttributesW
kernel32.dll.FindFirstFileW
kernel32.dll.SetCurrentDirectoryW
kernel32.dll.GetLongPathNameW
kernel32.dll.GetShortPathNameW
kernel32.dll.DeleteFileW
kernel32.dll.FindNextFileW
kernel32.dll.CopyFileExW
kernel32.dll.MoveFileW
kernel32.dll.CreateDirectoryW
kernel32.dll.RemoveDirectoryW
kernel32.dll.SetSystemPowerState
kernel32.dll.QueryPerformanceFrequency
kernel32.dll.FindResourceW
kernel32.dll.LoadResource
kernel32.dll.LockResource
kernel32.dll.SizeofResource
kernel32.dll.EnumResourceNamesW
kernel32.dll.OutputDebugStringW
kernel32.dll.GetTempPathW
kernel32.dll.GetTempFileNameW
kernel32.dll.DeviceIoControl
kernel32.dll.GetLocalTime
kernel32.dll.CompareStringW
kernel32.dll.EnterCriticalSection
kernel32.dll.LeaveCriticalSection
kernel32.dll.GetStdHandle
kernel32.dll.CreatePipe
kernel32.dll.InterlockedExchange
kernel32.dll.TerminateThread
kernel32.dll.LoadLibraryExW
kernel32.dll.FindResourceExW
kernel32.dll.CopyFileW
kernel32.dll.VirtualFree
kernel32.dll.FormatMessageW
kernel32.dll.GetExitCodeProcess
kernel32.dll.GetPrivateProfileStringW
kernel32.dll.WritePrivateProfileStringW
kernel32.dll.GetPrivateProfileSectionW
kernel32.dll.WritePrivateProfileSectionW
kernel32.dll.GetPrivateProfileSectionNamesW
kernel32.dll.FileTimeToLocalFileTime
kernel32.dll.FileTimeToSystemTime
kernel32.dll.SystemTimeToFileTime
kernel32.dll.LocalFileTimeToFileTime
kernel32.dll.GetDriveTypeW
kernel32.dll.GetDiskFreeSpaceExW
kernel32.dll.GetDiskFreeSpaceW
kernel32.dll.GetVolumeInformationW
kernel32.dll.SetVolumeLabelW
kernel32.dll.CreateHardLinkW
kernel32.dll.SetFileAttributesW
kernel32.dll.CreateEventW
kernel32.dll.SetEvent
kernel32.dll.SetEnvironmentVariableW
kernel32.dll.GlobalLock
kernel32.dll.GlobalUnlock
kernel32.dll.GlobalAlloc
kernel32.dll.GetFileSize
kernel32.dll.GlobalFree
kernel32.dll.GlobalMemoryStatusEx
kernel32.dll.Beep
kernel32.dll.GetSystemDirectoryW
kernel32.dll.HeapReAlloc
kernel32.dll.HeapSize
kernel32.dll.GetComputerNameW
kernel32.dll.GetWindowsDirectoryW
kernel32.dll.GetCurrentProcessId
kernel32.dll.GetProcessIoCounters
kernel32.dll.GetProcessId
kernel32.dll.SetPriorityClass
kernel32.dll.LoadLibraryW
kernel32.dll.VirtualAlloc
kernel32.dll.IsDebuggerPresent
kernel32.dll.GetCurrentDirectoryW
kernel32.dll.lstrcmpiW
kernel32.dll.GetLastError
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.DeleteCriticalSection
kernel32.dll.InterlockedDecrement
kernel32.dll.InterlockedIncrement
kernel32.dll.ExitProcess
kernel32.dll.GetModuleHandleExW
kernel32.dll.ExitThread
kernel32.dll.GetSystemTimeAsFileTime
kernel32.dll.GetCommandLineW
kernel32.dll.IsProcessorFeaturePresent
kernel32.dll.IsValidCodePage
kernel32.dll.GetOEMCP
kernel32.dll.GetCPInfo
kernel32.dll.SetLastError
kernel32.dll.UnhandledExceptionFilter
kernel32.dll.SetUnhandledExceptionFilter
kernel32.dll.TlsAlloc
kernel32.dll.TlsGetValue
kernel32.dll.TlsSetValue
kernel32.dll.TlsFree
kernel32.dll.GetStartupInfoW
kernel32.dll.GetStringTypeW
kernel32.dll.SetStdHandle
kernel32.dll.GetConsoleCP
kernel32.dll.GetConsoleMode
kernel32.dll.RtlUnwind
kernel32.dll.ReadConsoleW
kernel32.dll.GetTimeZoneInformation
kernel32.dll.GetDateFormatW
kernel32.dll.GetTimeFormatW
kernel32.dll.LCMapStringW
kernel32.dll.GetEnvironmentStringsW
kernel32.dll.FreeEnvironmentStringsW
kernel32.dll.WriteConsoleW
kernel32.dll.FindClose
kernel32.dll.SetEnvironmentVariableA
advapi32.dll.GetAce
advapi32.dll.RegDeleteValueW
advapi32.dll.RegDeleteKeyW
advapi32.dll.RegSetValueExW
advapi32.dll.RegConnectRegistryW
advapi32.dll.InitializeSecurityDescriptor
advapi32.dll.AdjustTokenPrivileges
advapi32.dll.OpenThreadToken
advapi32.dll.LookupPrivilegeValueW
advapi32.dll.DuplicateTokenEx
advapi32.dll.CreateProcessAsUserW
advapi32.dll.CreateProcessWithLogonW
advapi32.dll.GetLengthSid
advapi32.dll.CopySid
advapi32.dll.LogonUserW
advapi32.dll.CheckTokenMembership
advapi32.dll.RegCreateKeyExW
advapi32.dll.GetSecurityDescriptorDacl
advapi32.dll.GetAclInformation
advapi32.dll.AddAce
advapi32.dll.SetSecurityDescriptorDacl
advapi32.dll.GetUserNameW
advapi32.dll.InitiateSystemShutdownExW
comctl32.dll.ImageList_ReplaceIcon
comctl32.dll.ImageList_Destroy
comctl32.dll.ImageList_Remove
comctl32.dll.ImageList_SetDragCursorImage
comctl32.dll.ImageList_BeginDrag
comctl32.dll.ImageList_DragEnter
comctl32.dll.ImageList_DragLeave
comctl32.dll.ImageList_EndDrag
comctl32.dll.ImageList_DragMove
comctl32.dll.InitCommonControlsEx
comctl32.dll.ImageList_Create
comdlg32.dll.GetOpenFileNameW
comdlg32.dll.GetSaveFileNameW
gdi32.dll.StrokePath
gdi32.dll.DeleteObject
gdi32.dll.GetTextExtentPoint32W
gdi32.dll.ExtCreatePen
gdi32.dll.GetDeviceCaps
gdi32.dll.EndPath
gdi32.dll.SetPixel
gdi32.dll.CloseFigure
gdi32.dll.CreateCompatibleBitmap
gdi32.dll.CreateCompatibleDC
gdi32.dll.SelectObject
gdi32.dll.StretchBlt
gdi32.dll.GetDIBits
gdi32.dll.LineTo
gdi32.dll.AngleArc
gdi32.dll.MoveToEx
gdi32.dll.Ellipse
gdi32.dll.DeleteDC
gdi32.dll.GetPixel
gdi32.dll.CreateDCW
gdi32.dll.GetTextFaceW
gdi32.dll.CreateFontW
gdi32.dll.SetTextColor
gdi32.dll.PolyDraw
gdi32.dll.BeginPath
gdi32.dll.Rectangle
gdi32.dll.SetViewportOrgEx
gdi32.dll.GetObjectW
gdi32.dll.SetBkMode
gdi32.dll.RoundRect
gdi32.dll.SetBkColor
gdi32.dll.CreatePen
gdi32.dll.CreateSolidBrush
gdi32.dll.StrokeAndFillPath
iphlpapi.dll.IcmpCreateFile
iphlpapi.dll.IcmpCloseHandle
iphlpapi.dll.IcmpSendEcho
mpr.dll.WNetUseConnectionW
mpr.dll.WNetCancelConnection2W
mpr.dll.WNetGetConnectionW
mpr.dll.WNetAddConnection2W
ole32.dll.CLSIDFromString
ole32.dll.ProgIDFromCLSID
ole32.dll.CLSIDFromProgID
ole32.dll.OleSetMenuDescriptor
ole32.dll.MkParseDisplayName
ole32.dll.OleSetContainedObject
ole32.dll.CoCreateInstance
ole32.dll.IIDFromString
ole32.dll.StringFromGUID2
ole32.dll.CreateStreamOnHGlobal
ole32.dll.OleInitialize
ole32.dll.OleUninitialize
ole32.dll.CoInitialize
ole32.dll.GetRunningObjectTable
ole32.dll.CoGetInstanceFromFile
ole32.dll.CoGetObject
ole32.dll.CoSetProxyBlanket
ole32.dll.CoCreateInstanceEx
ole32.dll.CoInitializeSecurity
oleaut32.dll.#183
oleaut32.dll.#11
oleaut32.dll.#3
oleaut32.dll.#6
oleaut32.dll.#38
oleaut32.dll.#39
oleaut32.dll.#24
oleaut32.dll.#23
oleaut32.dll.#37
oleaut32.dll.#41
oleaut32.dll.#411
oleaut32.dll.#163
oleaut32.dll.#32
oleaut32.dll.#146
oleaut32.dll.#12
oleaut32.dll.#7
oleaut32.dll.#185
oleaut32.dll.#220
oleaut32.dll.#77
oleaut32.dll.#10
oleaut32.dll.#9
oleaut32.dll.#418
oleaut32.dll.#164
oleaut32.dll.#442
oleaut32.dll.#443
oleaut32.dll.#186
oleaut32.dll.#31
oleaut32.dll.#2
oleaut32.dll.#8
psapi.dll.GetProcessMemoryInfo
shell32.dll.DragQueryPoint
shell32.dll.ShellExecuteExW
shell32.dll.DragQueryFileW
shell32.dll.SHEmptyRecycleBinW
shell32.dll.SHGetPathFromIDListW
shell32.dll.SHBrowseForFolderW
shell32.dll.SHCreateShellItem
shell32.dll.SHGetDesktopFolder
shell32.dll.SHGetSpecialFolderLocation
shell32.dll.SHFileOperationW
shell32.dll.ExtractIconExW
shell32.dll.Shell_NotifyIconW
shell32.dll.ShellExecuteW
shell32.dll.DragFinish
user32.dll.AdjustWindowRectEx
user32.dll.CopyImage
user32.dll.SetWindowPos
user32.dll.GetCursorInfo
user32.dll.RegisterHotKey
user32.dll.ClientToScreen
user32.dll.GetKeyboardLayoutNameW
user32.dll.IsCharAlphaW
user32.dll.IsCharAlphaNumericW
user32.dll.IsCharLowerW
user32.dll.IsCharUpperW
user32.dll.GetMenuStringW
user32.dll.GetSubMenu
user32.dll.GetCaretPos
user32.dll.IsZoomed
user32.dll.MonitorFromPoint
user32.dll.GetMonitorInfoW
user32.dll.SetLayeredWindowAttributes
user32.dll.FlashWindow
user32.dll.GetClassLongW
user32.dll.TranslateAcceleratorW
user32.dll.IsDialogMessageW
user32.dll.GetSysColor
user32.dll.InflateRect
user32.dll.DrawFocusRect
user32.dll.DrawTextW
user32.dll.FrameRect
user32.dll.DrawFrameControl
user32.dll.FillRect
user32.dll.PtInRect
user32.dll.DestroyAcceleratorTable
user32.dll.CreateAcceleratorTableW
user32.dll.SetCursor
user32.dll.GetWindowDC
user32.dll.GetSystemMetrics
user32.dll.GetActiveWindow
user32.dll.CharNextW
user32.dll.wsprintfW
user32.dll.RedrawWindow
user32.dll.DrawMenuBar
user32.dll.DestroyMenu
user32.dll.SetMenu
user32.dll.GetWindowTextLengthW
user32.dll.CreateMenu
user32.dll.IsDlgButtonChecked
user32.dll.DefDlgProcW
user32.dll.ReleaseCapture
user32.dll.SetCapture
user32.dll.CreateIconFromResourceEx
user32.dll.mouse_event
user32.dll.ExitWindowsEx
user32.dll.SetActiveWindow
user32.dll.FindWindowExW
user32.dll.EnumThreadWindows
user32.dll.SetMenuDefaultItem
user32.dll.InsertMenuItemW
user32.dll.IsMenu
user32.dll.TrackPopupMenuEx
user32.dll.GetCursorPos
user32.dll.DeleteMenu
user32.dll.SetRect
user32.dll.GetMenuItemID
user32.dll.GetMenuItemCount
user32.dll.SetMenuItemInfoW
user32.dll.GetMenuItemInfoW
user32.dll.SetForegroundWindow
user32.dll.IsIconic
user32.dll.FindWindowW
user32.dll.MonitorFromRect
user32.dll.keybd_event
user32.dll.SendInput
user32.dll.GetAsyncKeyState
user32.dll.SetKeyboardState
user32.dll.GetKeyboardState
user32.dll.GetKeyState
user32.dll.VkKeyScanW
user32.dll.LoadStringW
user32.dll.DialogBoxParamW
user32.dll.MessageBeep
user32.dll.EndDialog
user32.dll.SendDlgItemMessageW
user32.dll.GetDlgItem
user32.dll.SetWindowTextW
user32.dll.CopyRect
user32.dll.ReleaseDC
user32.dll.GetDC
user32.dll.EndPaint
user32.dll.BeginPaint
user32.dll.GetClientRect
user32.dll.GetMenu
user32.dll.DestroyWindow
user32.dll.EnumWindows
user32.dll.GetDesktopWindow
user32.dll.IsWindow
user32.dll.IsWindowEnabled
user32.dll.IsWindowVisible
user32.dll.EnableWindow
user32.dll.InvalidateRect
user32.dll.GetWindowThreadProcessId
user32.dll.AttachThreadInput
user32.dll.GetFocus
user32.dll.GetWindowTextW
user32.dll.ScreenToClient
user32.dll.SendMessageTimeoutW
user32.dll.EnumChildWindows
user32.dll.CharUpperBuffW
user32.dll.GetParent
user32.dll.GetDlgCtrlID
user32.dll.SendMessageW
user32.dll.MapVirtualKeyW
user32.dll.GetWindowRect
user32.dll.SetUserObjectSecurity
user32.dll.CloseDesktop
user32.dll.CloseWindowStation
user32.dll.OpenDesktopW
user32.dll.SetProcessWindowStation
user32.dll.GetProcessWindowStation
user32.dll.OpenWindowStationW
user32.dll.GetUserObjectSecurity
user32.dll.MessageBoxW
user32.dll.SetClipboardData
user32.dll.EmptyClipboard
user32.dll.CountClipboardFormats
user32.dll.CloseClipboard
user32.dll.GetClipboardData
user32.dll.IsClipboardFormatAvailable
user32.dll.OpenClipboard
user32.dll.BlockInput
user32.dll.GetMessageW
user32.dll.LockWindowUpdate
user32.dll.DispatchMessageW
user32.dll.TranslateMessage
user32.dll.PeekMessageW
user32.dll.UnregisterHotKey
user32.dll.CheckMenuRadioItem
user32.dll.CharLowerBuffW
user32.dll.MoveWindow
user32.dll.SetFocus
user32.dll.PostQuitMessage
user32.dll.KillTimer
user32.dll.CreatePopupMenu
user32.dll.ShowWindow
user32.dll.RegisterClassExW
user32.dll.LoadIconW
user32.dll.LoadCursorW
user32.dll.GetSysColorBrush
user32.dll.GetForegroundWindow
user32.dll.MessageBoxA
user32.dll.DestroyIcon
user32.dll.SystemParametersInfoW
user32.dll.LoadImageW
user32.dll.GetClassNameW
userenv.dll.DestroyEnvironmentBlock
userenv.dll.UnloadUserProfile
userenv.dll.CreateEnvironmentBlock
userenv.dll.LoadUserProfileW
uxtheme.dll.IsThemeActive
wininet.dll.InternetQueryDataAvailable
wininet.dll.InternetCloseHandle
wininet.dll.InternetOpenW
wininet.dll.InternetSetOptionW
wininet.dll.InternetCrackUrlW
wininet.dll.HttpQueryInfoW
wininet.dll.InternetQueryOptionW
wininet.dll.HttpOpenRequestW
wininet.dll.HttpSendRequestW
wininet.dll.FtpOpenFileW
wininet.dll.FtpGetFileSize
wininet.dll.InternetOpenUrlW
wininet.dll.InternetReadFile
wininet.dll.InternetConnectW
winmm.dll.timeGetTime
winmm.dll.waveOutSetVolume
winmm.dll.mciSendStringW
wsock32.dll.#116
wsock32.dll.#23
wsock32.dll.#12
wsock32.dll.#21
wsock32.dll.#15
wsock32.dll.#17
wsock32.dll.#10
wsock32.dll.#9
wsock32.dll.#115
wsock32.dll.#151
wsock32.dll.#18
wsock32.dll.#1
wsock32.dll.#13
wsock32.dll.#2
wsock32.dll.#3
wsock32.dll.#111
wsock32.dll.#16
wsock32.dll.#20
wsock32.dll.#19
wsock32.dll.#11
wsock32.dll.#52
wsock32.dll.#57
wsock32.dll.#4
kernel32.dll.Wow64DisableWow64FsRedirection
kernel32.dll.Wow64RevertWow64FsRedirection
dwmapi.dll.DwmIsCompositionEnabled
lpk.dll.LpkEditControl
comctl32.dll.HIMAGELIST_QueryInterface
comctl32.dll.DrawShadowText
comctl32.dll.DrawSizeBox
comctl32.dll.DrawScrollBar
comctl32.dll.SizeBoxHwnd
comctl32.dll.ScrollBar_MouseMove
comctl32.dll.ScrollBar_Menu
comctl32.dll.HandleScrollCmd
comctl32.dll.DetachScrollBars
comctl32.dll.AttachScrollBars
comctl32.dll.CCSetScrollInfo
comctl32.dll.CCGetScrollInfo
comctl32.dll.CCEnableScrollBar
comctl32.dll.QuerySystemGestureStatus
uxtheme.dll.#49
avicap32.dll.capGetDriverDescriptionA
ole32.dll.CoGetClassObject
ole32.dll.CoGetMarshalSizeMax
ole32.dll.CoMarshalInterface
ole32.dll.CoUnmarshalInterface
ole32.dll.StringFromIID
ole32.dll.CoGetPSClsid
ole32.dll.CoReleaseMarshalData
ole32.dll.DcomChannelSetHResult
vssapi.dll.CreateWriter
advapi32.dll.LookupAccountNameW
sechost.dll.LookupAccountNameLocalW
advapi32.dll.LookupAccountSidW
samcli.dll.NetLocalGroupGetMembers
samlib.dll.SamConnect
rpcrt4.dll.NdrClientCall3
rpcrt4.dll.RpcStringBindingComposeW
rpcrt4.dll.RpcBindingFromStringBindingW
rpcrt4.dll.RpcStringFreeW
rpcrt4.dll.RpcBindingFree
samlib.dll.SamOpenDomain
samlib.dll.SamLookupNamesInDomain
samlib.dll.SamOpenAlias
samlib.dll.SamFreeMemory
samlib.dll.SamCloseHandle
samlib.dll.SamGetMembersInAlias
netutils.dll.NetApiBufferFree
ole32.dll.CoCreateGuid
ole32.dll.StringFromCLSID
oleaut32.dll.#4
propsys.dll.VariantToPropVariant
wbemcore.dll.Reinitialize
wbemsvc.dll.DllGetClassObject
wbemsvc.dll.DllCanUnloadNow
authz.dll.AuthzInitializeContextFromToken
authz.dll.AuthzInitializeObjectAccessAuditEvent2
authz.dll.AuthzAccessCheck
authz.dll.AuthzFreeAuditEvent
authz.dll.AuthzFreeContext
authz.dll.AuthzInitializeResourceManager
authz.dll.AuthzFreeResourceManager
rpcrt4.dll.RpcBindingCreateW
rpcrt4.dll.RpcBindingBind
rpcrt4.dll.I_RpcMapWin32Status
advapi32.dll.EventWrite
kernel32.dll.RegCloseKey
kernel32.dll.RegSetValueExW
kernel32.dll.RegOpenKeyExW
kernel32.dll.RegQueryValueExW
wmisvc.dll.IsImproperShutdownDetected
wevtapi.dll.EvtRender
wevtapi.dll.EvtNext
wevtapi.dll.EvtClose
wevtapi.dll.EvtQuery
wevtapi.dll.EvtCreateRenderContext
rpcrt4.dll.RpcBindingSetAuthInfoExW
rpcrt4.dll.RpcBindingSetOption
ole32.dll.CoCreateFreeThreadedMarshaler
cryptsp.dll.CryptGenRandom
kernelbase.dll.InitializeAcl
kernelbase.dll.AddAce
sechost.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW
kernel32.dll.IsThreadAFiber
kernel32.dll.OpenProcessToken
kernelbase.dll.GetTokenInformation
kernelbase.dll.DuplicateTokenEx
kernelbase.dll.AdjustTokenPrivileges
sechost.dll.LookupAccountSidLocalW
kernelbase.dll.AllocateAndInitializeSid
kernelbase.dll.CheckTokenMembership
kernel32.dll.SetThreadToken
oleaut32.dll.#285
advapi32.dll.RegOpenKeyW
oleaut32.dll.#286
oleaut32.dll.#17
oleaut32.dll.#20
oleaut32.dll.#19
oleaut32.dll.#25
ole32.dll.CoRevertToSelf
advapi32.dll.LogonUserExExW
sspicli.dll.LogonUserExExW
authz.dll.AuthzInitializeContextFromSid
ole32.dll.CoGetCallContext
ole32.dll.CoImpersonateClient
ole32.dll.CoSwitchCallContext
oleaut32.dll.#287
oleaut32.dll.#288
oleaut32.dll.#289
oleaut32.dll.#283
oleaut32.dll.#284
ntmarta.dll.GetMartaExtensionInterface
kernel32.dll.GetThreadPreferredUILanguages
kernel32.dll.SetThreadPreferredUILanguages
kernel32.dll.GetSystemDefaultLocaleName
fastprox.dll.DllGetClassObject
fastprox.dll.DllCanUnloadNow
oleaut32.dll.#290
wmi.dll.WmiQueryAllDataW
wmi.dll.WmiQuerySingleInstanceW
wmi.dll.WmiSetSingleItemW
wmi.dll.WmiSetSingleInstanceW
wmi.dll.WmiExecuteMethodW
wmi.dll.WmiNotificationRegistrationW
wmi.dll.WmiMofEnumerateResourcesW
wmi.dll.WmiFileHandleToInstanceNameW
wmi.dll.WmiDevInstToInstanceNameW
wmi.dll.WmiQueryGuidInformation
wmi.dll.WmiOpenBlock
wmi.dll.WmiCloseBlock
wmi.dll.WmiFreeBuffer
wmi.dll.WmiEnumerateGuids
oleaut32.dll.#15
oleaut32.dll.#26

Execute Commands

C:\Users\Seven01\AppData\Local\Temp\wassus.exe "{path}"
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

Started Services

Nothing to display

Created Services

Nothing to display
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven02_64 Seven02_64 VirtualBox 2018-05-10 12:19:33 2018-05-10 12:22:32 179

8 HTTP Request(s) detected

http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
  • Hostname: www.download.windowsupdate.com
  • IP Address: 93.184.221.240
  • Port: 80
  • Count: 1

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1
Cache-Control: max-age = 86400
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: www.download.windowsupdate.com

http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D
  • Hostname: ocsp.digicert.com
  • IP Address: 93.184.220.29
  • Port: 80
  • Count: 1

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com

http://ocsp.digicert.com/
  • Hostname: ocsp.digicert.com
  • IP Address: 93.184.220.29
  • Port: 80
  • Count: 2

POST / HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Content-Type: application/ocsp-request
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Content-Length: 83
Host: ocsp.digicert.com

http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl
  • Hostname: crl4.digicert.com
  • IP Address: 66.225.197.197
  • Port: 80
  • Count: 1

GET /DigiCertAssuredIDRootCA.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl4.digicert.com

http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl
  • Hostname: crl3.digicert.com
  • IP Address: 93.184.220.29
  • Port: 80
  • Count: 1

GET /DigiCertAssuredIDRootCA.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl3.digicert.com

http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAnmWtgHuEl7B0nUFWjWJtA%3D
  • Hostname: ocsp.digicert.com
  • IP Address: 93.184.220.29
  • Port: 80
  • Count: 1

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAnmWtgHuEl7B0nUFWjWJtA%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com

http://crl3.digicert.com/sha2-assured-cs-g1.crl
  • Hostname: crl3.digicert.com
  • IP Address: 93.184.220.29
  • Port: 80
  • Count: 1

GET /sha2-assured-cs-g1.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl3.digicert.com

http://crl4.digicert.com/sha2-assured-cs-g1.crl
  • Hostname: crl4.digicert.com
  • IP Address: 66.225.197.197
  • Port: 80
  • Count: 1

GET /sha2-assured-cs-g1.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl4.digicert.com

#infosec #automation

TheSystem Itself @ 2018-05-10 12:21:16