MalScore
100/100
PurchaseOrdersigned.exe
File details Download PDF Report | |
---|---|
File type: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
File size: | 313.59 KB (321112 bytes) |
Compile time: | 2017-04-28 09:14:12 |
MD5: | 816717dd34c1fb56cfe4c9c1f1c8faaa |
SHA1: | ad77a5e9ba5311fdad22da98243b8d0c2757389f |
SHA256: | efe27a0f66e556b82304ce120d38dee56b6ac08ccf67a230c1280e28d2c3efe4 |
Import hash: | f34d5f2d4577ed6d9ceec516c1f5a744 |
Sections 3 | .text .rsrc .reloc |
Directories 4 | import resource relocation security |
First submission: | 2018-02-09 13:39:03 |
Last submission: | 2018-02-09 17:05:52 |
Filename detected: |
- PurchaseOrdersigned.exe (3) |
URL file hosting |
---|
hXXp://sepprod.com/PurchaseOrdersigned.exe![]() |
Antivirus Report | |||
---|---|---|---|
Report Date | Detection Ratio | Permalink | Update |
2018-02-08 13:31:02 | [23/68] | ![]() |
PE Sections 2 suspicious | |||||
---|---|---|---|---|---|
Name | VAddress | VSize | Size | MD5 | SHA1 |
.text | 0x2000 | 0x44e54 | 282624 | e8dd36a6399e8702e047e9476b5ca9c4 | 1c525ebec4f3aa1f57243fd2bc124f300ccef637 |
.rsrc | 0x48000 | 0x750a | 30208 | f5bd769b82979f23ccc1c1e494a6947e | de49628883362ecbdb786128a01ceaa70c5455dd |
.reloc | 0x50000 | 0xc | 512 | 4401fcb362632d2c35dcfd8242fa51d9 | e91cf3f435805f6c4dfe1752c0500651065499ff |
PE Resources | |||||
---|---|---|---|---|---|
Name | Offset | Size | Language | Sublanguage | Data |
RT_ICON | 0x4cdc0 | 8732 | LANG_NEUTRAL | SUBLANG_NEUTRAL | |
RT_GROUP_ICON | 0x4efdc | 160 | LANG_NEUTRAL | SUBLANG_NEUTRAL | |
RT_VERSION | 0x4f07c | 676 | LANG_ORIYA | SUBLANG_NEUTRAL | |
RT_MANIFEST | 0x4f320 | 490 | LANG_NEUTRAL | SUBLANG_NEUTRAL |
- API Alert
- Anti Debug
Meta Info | |
---|---|
LegalCopyright: | Copyright (C) 2006-2017 NVDA Contributors |
ProductVersion: | 2017.4 |
CompanyName: | NV Access |
FileVersion: | 2017.4.0.14695 |
FileDescription: | NVDA |
Translation: | 0x0409 0x04b0 |
OriginalFilename: | nvda_slave.exe |
ProductName: | NVDA |
XOR | |
---|---|
No XOR informations found in this file. |
Signature | |
---|---|
MD5: | 841dc56cf06e8deaa729ac4f5bbda44c |
SHA1: | 44924c4a6a48d935028cd55c87322fa26f416a64 |
Block Size: | 7256 |
Virtual Address: | 313856 |
Packer(s) | |
---|---|
Microsoft Visual C# / Basic .NET | |
Microsoft Visual Studio .NET | |
.NET executable | |
Microsoft Visual C# v7.0 / Basic .NET |
File found | |
---|---|
FIle type: Library | |
mscoree.dll |
IP Found | |
---|---|
No IP detected |
URL(s) | |
---|---|
http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0: | |
http://ocsp.digicert.com0C | |
http://ocsp.digicert.com0A | |
http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0 | |
http://ocsp.digicert.com0N | |
http://crl4.digicert.com/sha2-assured-cs-g1.crl0B | |
http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0: | |
http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w | |
http://crl3.digicert.com/sha2-assured-cs-g1.crl05 | |
http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O | |
http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0 | |
http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0 | |
https://www.digicert.com/CPS0 | |
http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0 | |
http://www.digicert.com/ssl-cps-repository.htm0 | |
http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08 |
4166bc0d-998c-9f42
4166bc0d-998c-9f43
4166bc0d-998c-9f40
4166bc0d-998c-9f41
4166bc0d-998c-9f44
4166bc0d-998c-9f45
ProductVersion
FileDescription
nvda_slave.exe
2017.4
4166bc0d-998c-9f20
4166bc0d-998c-9f21
4166bc0d-998c-9f22
4166bc0d-998c-9f23
4166bc0d-998c-9f24
4166bc0d-998c-9f25
4166bc0d-998c-9f26
4166bc0d-998c-9f27
4166bc0d-998c-9f28
4166bc0d-998c-9f29
FileVersion
OriginalFilename
VS_VERSION_INFO
FIL
b416f61c-bc95-68
StringFileInfo
Translation
VarFileInfo
4166bc0d-998c-9f19
4166bc0d-998c-9f18
NV Access
4166bc0d-998c-9f15
4166bc0d-998c-9f14
4166bc0d-998c-9f17
4166bc0d-998c-9f16
4166bc0d-998c-9f11
4166bc0d-998c-9f10
4166bc0d-998c-9f13
4166bc0d-998c-9f12
4166bc0d-998c-9f37
4166bc0d-998c-9f36
4166bc0d-998c-9f35
4166bc0d-998c-9f34
4166bc0d-998c-9f33
4166bc0d-998c-9f32
4166bc0d-998c-9f31
4166bc0d-998c-9f30
2017.4.0.14695
4166bc0d-998c-9f39
4166bc0d-998c-9f38
LegalCopyright
RAny use of this Certificate constitutes acceptance of the DigiCert CP/CPS and the Relying Party Agreement which limit liability and are incorporated herein by reference
CompanyName
040904B0
ProductName
4166bc0d-998c-9f5
4166bc0d-998c-9f4
4166bc0d-998c-9f7
4166bc0d-998c-9f6
4166bc0d-998c-9f1
4166bc0d-998c-9f0
4166bc0d-998c-9f3
4166bc0d-998c-9f2
Copyright (C) 2006-2017 NVDA Contributors
4166bc0d-998c-9f9
4166bc0d-998c-9f8
NVDA
zN:
H[
zOFn
MGGw
iz$v
&vw?'
K~R
j4;_hjK
+ 2Zre
M_kB
'bPo
_G +$
v T
Xl9b
H[-bt
jT.
;@"P,
PNG
n#]U
"x)9
!y K
nV:
ZF4h
}k|;
&W1QJ
0JLm
Xrtx
@3WHwA
H^^mF'
!S5@p
/Yl+
Yn/8
eZ gI
9Qc`
V "
KLLc
O'Dk
.7'>
W'c%
Dp5J
xrcd
v7RY
7a*)
eNA
b6'/
UUUUUU
UUUUUT
Nxle
CG80:
UUUUUS
|oPw
,/q|
]xo7D
pe!
"5awL
90}j
&
Nn&{
]9r+
mS`Y
FU\S
MarshalByRefObject
[8dcq
>0<0
r<;S
FcZM
w -fF
VmKC
eA8o
\Egb
S>~,
0sVrt
bm1Oz
I6M:
c `l
LbdM
sBZlM
^b?hr
8cP_
+XL&
HhW+
YT{c
System
$41-
Q0 F
cjDgA
Hna,
bNGu
#@hl
xb63
a llEl
<h7|
w'vFd
uEI:l
`^L|
5O)@
!
#*7
X=-,
|F#:
z-k@
9\{:
d #
becU
pQ+q(
;OS
}cO+
sIvo
@K+'U
r*E
kKw>
%x"Z
RuntimeFieldHandle
ES'%,cIY
{9$\G7
System.Security
"G$[>
.chw=
[8w4
o(?!
351
QB^*x
C/;&i
!, k
F7f~
0qbLwwlrbzNw
w!t+.VOY
&SP
N!DL*
mscorlib
bjs)
8TgV
9>4$~9
,h@t:
5WZp
x3)]
d=v~
9Bsk
Y:%n:,3A
7v$h
^ Iv]7b
ZR$S
V:,sq
kxF~d
!6r.
G=9H
P"P&
?GYC,
IVs*
q=}r
,Zrr
*>G %
5>S
p%kbha
as{y
/,) "
G`sO:
eWP
!F)6
5U2:
Concat
&GG$
O7]A
G HIJ K
tj%Yxu
h`B~
?#l?%!
U@DV
ZY0
[Mpk
vcU:
36(V
ffdSj
F# G
(2g!Z
i=)7
AssemblyCompanyAttribute
v$K[^
3 4
K4 [
r{ywr R)
+,
/I|D
~@w[
CL6u
HO;8Rd
"Qx'5
'0?v
bXmXbz
uiZ2CD
*OOw
b1j#
*GZ
HxuU
j^+N
s R"_
R3u^
dB&w
?ZK
/\-{
]6D
QR
vu`*s3
#Y[.
9}k0
C::L
*E.zS
AppDomain
P6]kY
_i +
Tb%K2
Ct~I
2gn
aR(
i@q:
aRrz
get_CurrentDomain
)h\8dK_
\3~`g
R
eREtF
ww;E
5UUUUT
o1Aq
get_Assembly
gJy
u.r;
}|s5
>Ta]g)
S[Z=e
?9`*
Qu8
171206024325Z0#
7bE3
t!*h0
Hidh
%
9'fZ
l"q0%Ed
>[v
(6vX9
~;{;%
/9L.D
;k
f4%|
*C&}W
AssemblyTrademarkAttribute
2awU
<R@DT
)QS.
)uE@L
nzC
cNww
PG5)
d>4:
5w>k
VLSQ
(o:R
X\*L-
/tf&+u
7o=h
UU5US
qr!
0*/
${ s
j klm
1a(g
jwM\
DjD{
lBoXW
>(m5
{_:7
{RGj
rvEB
`{CY
pP@&Q@P
U0tR
b4U\+
78 9:
#H$f
$t :
I3UI mg
WI-'_8
.~n)
^
q}:P
> |gm_
>bW~+
_HaW
|5&!
C ,
BEns
>sm
[\'8{
aApQ
aXQ~
A~95
/_o`B
Df{v
9-s
WU#\
6GW
WjT'
oo?B
\WO}
EUUUU@
;Z&~I
tL3}
wK+CkZ>
K`\j
0/3Z
&h7#+
BMds
" X
HE d
s@ >
{=_
Jk N
Mk
K"t~T[l
mN:m
oQB
F'?5
aZM$
e;/?7z
_w7sj
-@m`
L$lZ
ThSit
=
L336
/-mA
bg|Z
{OhMP
p*k.
W m4
V4mh-
M({(
<PrivateImplementationDetails>
Char
#%``
m(tUK
;;6K
5UUUUUU
{X.B
("jS
5UUUUUP
#3P=K
}B_/b
X.uz
}QO7
;Y 88
FH4A{k<,
WUWzz
&PuUY$
3# 9@;
gY 8{
?s)3u
Dx{t
_^'w|C
ZqOt
UY?K
{a_b
zqC/
X+,y
glyn
'o~j
n_0m
5+3L
kQ"Yni
)%,Ix
lhV{
!3NxH
<_U
eZGt
+A E
fF&?
/n5
!kcB G:
5Iu86
(1ge*%B
UA) R
fF[D+
`5!@U
> ?
z kp
b~2
ab
n8 7
7 Z),
V6+4
m A6
'y u
&~y
#UUU
WxWw
6m'n
5UUS
OL]C
z!a)>X
tnBm
T&l
k"6X
u'zw
r@B~s
6|>d
Z0nBq(
'!nb
kT-eY7
6FmGZ
>QN?
.wm
q7Q
.text
|$,0
}UF\_f
9.i
cmqv4J
tQ~0X
PiOe
Cy!8
AR/O'
(A{
,gno
5J+X
:q!2
4 5
*EjR
*:Bf
^.P*
}ALGn
h+mu
_=nh-
"eqc
m[QmoP
~O}K9)
i)$&
0CLG
<e>>
@qi-,I[m
uMK,
x@`3
uz8/z,
@R;1n
}$Cf0'
OM7ymX;)
g^<O
gX&
$%7m<]"
=o1i3
]QqE
ml {t
dCq G\wb
{E&A
a
&V?Q8
PM%s
CqGA
_64rH
_B"Bv
{|
LvYy
n@I7B
D_tw
m +M
<V Q
Load
0-" 6U`
%h{R
Rj{*zv
RCx
y0tGE
&w'
%JPQ
+~qput
aea.L
@N]@G
]FQ?cP
!{U*YD
hQd/
Ya9,
i$HA
|30t
&#Mt
~aEF
U)YU
6Zadi(y
+> E
p!fS
m zLIrE0c=
0,}U
RuntimeTypeHandle
7Gs5
|8>E
[Y +
m?E`
!v-
1`&f@;|j
5[?
g9/|
/BgR
[9]5
OqYB
'*E|
`.rsrc
yI|4Dw(1
JNCs
FqJ:M
jW-yF
}O_Mi
u:5?
! k
!ODy)x
wc +
?:sk
0O%){
QJwo
|":0.4
I=a|
UUUUU@
`rFAw
3xDy
6p!H
c W>b
0 6Zp
9pFO
&?g|>
x#klH"?
V;Vbk
v_TPm
\.zm
o[M">{
v:|G
z,,J
7Kzw
=b1{nO)
.ctor
.F 2D:
qKrF
2_!%}
Y9a|
\2cG
^sjF
T-F;G
Z*!05
0q
tsh%X
+x)ZN
4Q{bd
P))Bq
M#8<^
Dt5W
p41V
xWGQ~H
2Gg0
g ['4
Kow^
T+iN
Ybg!oFT
pY:i n
*\ .'z
kAlX
[ \:
1=6*
$UUUU
J8)u
~dF
lUS&
-_xegMN
X(}z
@]gs
5T@
,2"t
c jcG9R
ogC`[5e
gtw3=
G+}g
%gL8~
H j(
*FJv
-:Q}R
+yLh1N
x0v0$
tX$|
$U`d
*7#.
4!HR
{;7t,
J()K-|M
(r3L\T(
`2K;
78
^5SJ1d>
-C$r
7'>ARPV
IN)R'
05K<
87JX
qw_2
E'uL*ZK
[ 3<
v0t08
_KhZ
^w(k
x2Vvfv
C |V
}R"^
211110000000Z0b10
M]D.\
s3J m
TN7H+
'>
]<.
|cD2
clSf
x~Z
W`^w{[e
ZMh"=
Wn_[GgBO7[
(k.
VE~C
vq<C
6m4F
BHJ~U
P>H+i
.&JKSZ}.
O1Q.6
H@/
f|PI
cvPw
R>)
Q-1\
oD>|
dXI#
WRk*
m:yt
&n.
f+2Z
g ;
BTT}
GZ+r
QP1d
LKc)0i
@bc'
2http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Mh A
DigiCert Assured ID CA-10
`Go3
)Mk5
'B?5K
jX@R
5kdo
ICustomAttributeProvider
DyaRX o}
0r10
J>#D
System.Runtime.InteropServices
0i\cDH
v-O5>
};Gc
vg> };
tiJj
G73(
pHKZ
"wO
EEqP
[EM
dW@
++7Aj
C(8Hl
"f0J,
1;%;
xEO6
{"X
4e;
]]@m
. .
7im)
U)hM
0e10
s7vN
Nh[ m
p _$_
T3Pt
$ %
yGe
c7 z
2Do^
3S50
s uU
N <l
#_VA
v9+6
cbz0
r*[s_
S[J!
]&"5
YPH+
Invoke
=nb
sIDAThC
{DK1K
@Uw
x&%D
fR;z
34JtL
G:1#
<T@P
c1i
rLZ!,
=E{y
/E+zW
.MW?
5UUUUU
MNn(
X(*~f
Console
<^E2
pn::"
c2m:^S`
~K}zY
'ONj
N-]c{
fMqr
-Z= 5
_=S@
A>,
F?uH
x 5f
':+K
(Kz2
*E~RX
y{&$G
yZ>`
\H)y
.3_>
r6"*
{ Xk
0%!Sb`
=j]|t&N\
#i%D
.6*^$N
HU7E
c^q
Ua.$
&kI6a
%-4&
] (
!&p;AF<?
& '
i2zG0rtMT
d TV2
&*8W
NTG-u2
&*8R
`/Y'9
# ;|
?'16
IHDR
Z@e
k0;h
System.ServiceProcess
x]Q
{]0ZO
%%k$CI
t*A:&
$~+r
#'{R
K<*
ILL
fv d
ye}s
G]r
&YyU
FXh*fe
%nt$oU0z+
9_o
P{-Z z<
9 Ac
Y[r@
|4k6(
8s;3
LFImp!
d<IO%
8x >
`3a^
L`JE
}qf|0
w4M)
Odb5
gA#e
! wB
p6*k
LfJJ
EPmb
O P
`_$?
:DlJB
XB]{
)>V
i ~>
?9
`OnN
!*a[5rpX%
o s5
X,~t
{k{^M
pw(_
dYr<V
$k"n
k2x%@
s/CM
+q1|
,Y8W
To\t
5UUUUUUU
Km@
=|]0vF8
X}W.:
AeC|
a b
{5]u'
xvS
%
L( v
?"[a
`^dHJ
@GK$
n0
.H_s
z><|2
yUZr3
CBu~
EUUT
(4gE
'}ok
. |}
}vQ`
"?QY
UUUUP 50
#QUi
#,>8
%~"8#Er=MmU
www.digicert.com1$0"
#`i
M'
.]NAD
)+0VO(K:
g
CEkz$
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
#$
\z)D
= )
^k7D
*" 3z
RDPCX
UU0
d1=L
M
get_EntryPoint
vs _z
ValueType
XO5+e
ui
?@t
S^+R
460!
($F"
!N7E
J3zH#9:
=giv
^.> 3
8k$Q}
ORNB
`ekJ
I@Mk
FMN9c
%Owfwz
EUUD
r[8<
^NO
W~ON
EH9h
v:3XL
rxT(vR
"ZKL
<T=
add_AssemblyResolve
`
( )*
(EDO
.;$!
31$330
+8U}
H6TT
ServiceBase
O Hv"
$R y
DigiCert Timestamp Responder0
v-._
U:w?8b
D") 8.
rR#'
!})K
+@ E
esj'
|jI\
%x/q
].]`ev<
^C+U
Xk/~
[(4r"
Mayn
mpf!
Q;x
Ky)U"
#>j;
FF_^
7.r
6e1P
u=Ud
`gX
rdNs
5Uup
j?-/!
http://ocsp.digicert.com0C
http://ocsp.digicert.com0A
u ',
http://ocsp.digicert.com0N
T~~+C
vR _
13lS(t
ne\
Um#G7
bO0U
!d[+
10
{V \-
/"1<[;vK
m.GV
]o<i
8wip
cU W
grvqg
!Zn`
&'uG{2L
VW_s3w
?n6[
y8?9
\9B> (
UUUUP
kU n
Tg n
g']
mcB0
vG vf0|t|
R)+d
_CorExeMain
ma~g
4wk
p`>m{
q!\h%
X-=pY
EUUUUUUUT
B3-^^
Y<)2R
Kj0jF<
R>>-
m42?!
KI&
fDgk
DdT y*A
sg w
h(Q
pqy#
O0CR
(j.
3dbJ
yI}f
rA1/
_H<9
TJSH
-zgod
!zj
X#wg
7Dm|<?
Kr\5O
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
LoSU
(Ay~
V-T@
x!w?`
[7vF
i!O5v
W~xkaA#_mz
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD
0crQ(
&LY
CD EF
'sdwjb
`,=e"
yi~cK
d^X^
,m!~
BG|A^
4D~3N
vEAAm
}^h=
b&FU
dig6+
P?m8k
!wik3
hLp
A"wd
)AYZ
r -'
68+d
4UHQ
' zyh
0eQ%>
"Y3PRe
?K~}&I
UUUUUUU
*sO`
#Mqq
;%VIC
6n`
V--
O '
Mk5 e
t+2x/~
7ycS
sEDnblhW
;#w!=
b-?(
UUUU0
UUUUUUT
=)mjrb
Kk2_
08p"
#wjZE[
gpv(w<
v{2x]Z_|
E8n+
T _
6_6U9
Ez
4b6%V
5UUU
!*}%
OqW R
#wj}
!rk Q
WW">
UW!*
ST U
"=`4
UUU@
& UO
~\kg
gh@=
bh'I
Uu\%
/U88
[u37
0]?<
5UUUUUU@
B!^1
UUUS
uVh
\H'f
ZT|)
Project1.exe
9: ;
qmO]
QWEm@
KBH
4wj 3
Y:|BC
^eQCC
/KC!
)Otd
lz[~
[f]5S:o
'bb*
&{<l
\k%PS
I5Dk
\0G
s^/A+
j&B>
mt{0k
S$@*yw
l'PA
!&kZ
*4B'?G
[ ^\
Ds>;
_s~
$F6d
g+v=
#Strings
vmsT
%UUUUS
(*}cA
^r;w|
Y8ZI
{~^jY
*caV_
:P6)
4z)*>
TLL[
oc"B`c
%XY"
2- $
/0 1
%5I
a0Qe
O*D
vm:
mV?~
k)HxX
F|!.n
0cGt
MNOs
+|JK
g7cdJ
ojaW
gk
h8]$
5oK-
6[z
_M[aZ
0yM'
0C,3b
-l<{?S
5`X:}
: ]\
(34j
`r [Z
IEvidenceFactory
.:JE8
F0rU$
fky
%UUU
t9?[
8_/]
bZ39 m
SQ6
L V
-K]i5+
ZEFD
s iK ;
m%k?1
r?-L
uh6Y[
3[?_j[
c $Sx
5,(%,
NBB!,
"
yi!7
`Jcr
R| t
H=2V
H1UC
System.Runtime.CompilerServices
q7}e
_=HU
gxBK|
VUdp
9-T
T*, B
F")u
^PEN
l
(.q@
C~#3
~!G&
, "
=s}l
Y@\dCX#l
I
@"mY
T%GJ
cu]gZ
;b J
;"0.
9Qmb
yr{e
w<>)
Be*r
uIa
ZY 8Z
s`%R
5y[Uk
cDfC
D<NG
As3h
IEquatable`1
@OIb
%GnA*$k
Bhttp://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
m)SA
4Ux}
!s\s>N
cElE+
xz0
LOPpQ
@sp!
@MMe
'or:O
3)Z8
bD rd|
G{c
\!rd
Yr]]N7
180621120000Z0p10
!vp
%w e
B.YH
Fh.4
qx}C
]m[$
Qz.p
rOR^8
QZWH
~?i}
pIDAThC
(kZ }_
xe)!
ToString
gFHy
-=`t
XOwy
#[Jk%
5K(f
4szVdT
=d~/
3q t
EwzT
8xt "
Enumerable
>O+r
uDH<6ce
;.xMN
]XyW
[GHk
%iX
" ]Fc-2
kd^+
ZlQ_
yr^|N
VP;%
=,i'`
`l5=
330
qDnJ
-6=@J
Q'z_p
?p!E
:x9e,
tk
(mq5
lyEe8
|`k,8
[ktR7
9/ZZ
~h9C
D_{&N
:xT\2
c8t?
r2a
(DigiCert SHA2 Assured ID Code Signing CA0
!wkG
$_jC
tI8~2
Gp1dV_?u
6*i/
kAJB n"
QR r
!}&E
>DLf
fC7@D
zWcfS
i|#.
ie3l
P'YxM
YN*$
1Ccl
<z q
K36;"
>H>g
xz '
+-8/
5D2V
p#!!:
1mL7
bU;{z
?IBt
Np",
/6NI
F*AN
V9aY
! YE
hd +
/{G
9H A
!wk
tD&4
I J
(/:D
OpBz
L1 ->
9nc\vx
1r14
)M(gb
syc
.ZH"
Queensland1
sY3
$l7O
>Hch-
x-FJ.
ywt T(d
m,]O
>zjX
fLi6
S,6:
> ?@
31><
8.}
0v0b10
32sYj
j+@
{mm<2
t/\]O,!
rP?Wk
-bK!
Data
IQ[eF
F?IlT
2 3
O=Pa
Y4/t
xg/N
4td*]
+ud
[~r)
'NR,X
bEa
gAS~
`"e
;?f}
@_a
vj&jO
:JM-0
ZpHr
dc e9
_6;L
+ZsJ
- .
pHYs
MD<J
/T[7.
jW*
Y +
Zu v
Container
~
[f|
i&G=
JK^+
KHc
D<9q
nF>v"
=-gm
-jBP
NewGuid
B;c+@j
Ek0u
b73@ >
'_za
YPwd*
N
i X
%dIO
::BJ
zKq+
lw>F
"# $
DigiCert1%0#
v2.0.50727
%})g
J|2
N O
)t]"
0'cuwIDR
$JrH
TVWr
_v,L
Vk:^
t\B
6+A+
PxZ
wpDmu
TF K
f)@_
~3$ 0
[([
w=z
w=x
cL"
;eXY
o.ly
+c FH_=
4v.B&
DigiCert Assured ID CA-1
()Fc
Array
}t6^W
E@v)
DAR+0B
`%y$
(2q
Z.y
ObjectHandle
pO_F
&<hh
@.reloc
=*a6
R]9}
\O|P
]d$&
(-r:
MH<J
)]$6G
VCqM
+E6
f/8l
f)$}
[,c_
FG H
f
N}\c
* +
c
KUD)I
GSZ,
lrNw
Byte
&I6t9
8/vm
S<G]
ZN~O&(
mIDAThC
20G}
/TWO
O1PG
lH]A
~P.vE
RhtB
PcGk
uTfG
'Fg&
8M}
Y iI
r3R-
Ub{e
}VlY~
c {Z
ContainerControl
\\[
VJk2
E+F l
lBo~k
EUUP
Yw8I
%'Yg
k~3P
oFmq+Nn
6Xc`
lZ_N+:
&4LH
r96s
Hn2<
w=IN
nWwXz
UUUUUUUU@
p>~rB
(NFeA4&
*(YE
7PK@Ic
${(T
A* B
3QH-=
#VB&
Y8c
FFo&.
+b}^=
#]v
,*T
B6W-K
B C
6Ueh
C1k98
d9vp
Ly x
DN\~
>Lj*
Project1.Controls
wvo+>~l
EUUU0
!wk
x0V_
=.Y%
!]zG
3@ 3
9:=Y[
:-RPJ
]V|3
D?ZyK`
e q1"w{
b@v]9
&_#P
Dyu(
.pTy
3[\c{
cxI<HX8
X@FI&
^l\_>|w
i6YP
d+cD
8v#
J!@Hu5X/9
G$}W:
4ES%
jPi/6xQ
U0M[S
[-Y/
3tIC
Eb@
get_FullName
m\]P
LkKj<
~|]D
(ntS
,yG
0qP%
5O+*F.3A
=NHQ
+!A2
4http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Y,m&N
+_}Q
}CM}
!uk
f,a{
u8*.*2
sL K
RuntimeCompatibilityAttribute
^G%LH
j- @
__E
PdDQ+q
/cft
(Qj5
.60~L
MMU%
*v{L
Assembly
9p4'b
9: ;<
Z@s&
hP"z2
!ec=
YF;M
V9If_
B7T
0I*}6"
aXO%H
9'y&
W4E>
XM"6/
3&{)k
;DO
d$YG
w 'V|
iq&3
2dmb9
6ZuA@
!4(
&3-
T7)R
" {5
nvbuzn
;3 7
o_f)V
Cv0q
LYMq
hJx# -
SAk(
jYpm
0O0*#
Y(mj
UAB2a
S0 T
S,|+
:!&I[
mRuE}
/kV[
lro
:.g&M
4http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
SM.;
IDATx
ctHID
<qLs
@O\B
?\o@H
< =
?t
6MF^?
a!#nL
iW!]4/
set_AutoScaleMode
_[h;8F
$*@+
{um
CF4
snXL
Z20~v
dX75?
ifzr
26/&
h4Zz1
0'A]
#|2[
"L9*
%UUUU
yJyw
|Q4*K
X
$wKO
&_m
Rfw
IContainer
SOJ%s#
sn@K
$}3
tA{SO
tYfn
v*qj
:/Mx
60Ic
O </
ajDD
tj/$Kn
!- P
&z+>
,]Pp
|GaK
PS)o
)J_i0
+{cL
\8$%z
,SdT
Ky?XcO
a@k5
7f%1d
[K]1"
x)=A1
AY)8
NX`v
=Vl"
P(fB
$IZ
.sJ,2
UUUU@
r~En
hlD2
X~)aR/
Bwxk[
^Vm~
=k[ ~9
Iv#B
5~(N
AssemblyDescriptionAttribute
0>yaQ7M
v/Z
RJKdz
L^Ged
+Lz"
MethodBase
AssemblyTitleAttribute
;}ok<"
32b
n
.0Q&t'$w,
'dl
h|jPT
'vD68
)K*R
"/i1
qY8;
$:Qh
cA7O}
O1aRuP
X,a|u
O"M'a8
~?mN^
kHp(Z
`1PK
Rfnb'B
#7|S
@;/Zh
xWV+
P?VD
c{P=,
~(S]
#oWp5)
U
{o6
.#z8
9G<F
g
KE r
@1@;
dWC*y
*>mI
+ E
EUUUU@
sSh6
fR1f
@Re1
|eOa/
$?!$V
www.digicert.com110/
l C]<T
t=e6
t7fP
VNY
2Jf_s
lEl8UKV
,0*#5
2#@,
www.digicert.com1!0
JB['
#6_f[
/http://crl4.digicert.com/sha2-assured-cs-g1.crl0B
:pC
|I2H
6[b[
.Fi%
sxMI
2F'O
:wyHMu[
bUe>
MYNU
CLF2n
ov:F
{)zD
wHQ]
p[A8
@cd^
=^6=
F7W_
_ex
bJjm
v&L
j=j"
weZ0C
@-ekJ
MV?i
EUUT
4=j(mv
7%+5t
)*}A
x$%i7{nP
AssemblyCopyrightAttribute
wE,T
_xC
^ cT
XQ>a
Project1
6Yh\9$I
45 6
B'F+
TuU-
Y 8=
d'Wq
JmXK
*' s^
N=8=
.f!d
Fy)-
*["p
eE<W
WXa"Si
>WG\
KM>n
SN]s
V l .
}Y f
h~4m
K2:-M
0uQ<2
L 6V
1w>[
?.sp
1wk[6~
0~Q;
_{O
!f|.
fO6s
c$L kXFDw>
c_g2
~k(o
igra5^
L\7$
u&?Oi
t?P/
uV\b
UUUU0
150618000000Z
EmzV
RuntimeHelpers
=rs;
U$dM:
j(bE
Y 8j
^WT
hUYL
P[ 3
Vo/)
p \v
'6nk
#M5R
RgIt
{<N]
V:(?
%w k
E$
<&?6
K_y'
)Yb#
EUUUUU0
:YpU
5UP
x`,
*e7H]
c?T}
D!ta
UWk@
JMbs]
T0>oI8
&9,e
T<6b
m@if
XBIc
k3a.
P
T(vy{8
BSJB
5w*6
~8m_
sz:&
2uh]
q|I{@
JfovM
Hb0+
x0j^N
8\$H
c*lN
Type
gR_
(e~M
+vOT
L*b(
MQ|k
ZPfV6=AY>
nD WH
5&b&
e26[
QOTY
OXCP
m u
F{_=4
UUUP EUUUP
gr
UUUUUUUP
tMZ
gVN]\
^&!7
ML:6h
<QqT a
`|IZUk3
pqbR
bSE\
G$QB
|!,F#
"j$**&
>PlA^*
NUEs
DDLDH
K(b
=Jt
siPj(
r/)k
f#mPq
K5I<
wBEcq
u4NyD
gAMA
}yKP
.vqr
tqv
i~4-b.CF
&%wy
UFRqC~H
L_g4
ajI:
0gNMl
~][@
!unm
[L~8AmH
ig[x
)`'t
b&0
UUUP
cukn
9KC5
n}P
LmXR
rFxE
.cctor
x^k
NioY
kN]
g|lP
^;HQm#
%$H
{6J!
S Pl
(&P9J
)S\E!
WB%
7 ?)
X Y
3A<
YS/1
`[<!
H|zUU
hi$Ps
Qg5Q%|
%\qQ3
jukie
| [nq
/:+z
h i
t[{{Bm
t{S
!qrt
;7cVK`X>
UU5UUP
%UUU@
fi(`H
g!r@
m0k0$
!=MC
!W>
)C*d
se@D
>.qT
UUUUUUU@
Guid
4Z/L
:-
~Z9M
X\"
'F/I=F}L
5UUUUUUUT
U-4
%^M^D
9Ohw
aV>
~Ce=
-BUqc
L]|{
s?ho
F_%3
lEzE
]A\p
l5=!
6E-;
!'ym
BZG7]
v7g8
vwAw
WrapNonExceptionThrows
NV Access Limited0
NV Access Limited1
ex\~)%
^H;`
HIcq
9'-W
R2fq!
Nm4-
2018
)\h1
>S#<I
p/7K
tfm_
e< nC
wH|}S7
s'kb
;~&s
*eQ%}{y
0$ k
YZx
FB.=
Q*sJ
@E8p
M,t:N
}; z
" "=R
nRM&
}V&y
! ST
C69:
vH 3|o
XZffs
#RtxH
?|i6OX
k8eV
UUT@
5 6
*t ,F
Append
pk
0td]
`t,!5
UUUUUUUUU
\B6I=
`%R) *%
W`*K
Oxsv
%m7&U
w*}$
4F873A0CBD3C31E7FC18409F879DD9377F7C3086
a(M4G
-75!{
^f :
d&IM\fo
lkz^c
qHs{
Incarcator
cYv*
b,GnO|
v+ul
0g
vVV~
MTwk
@W<E
*>n#
Ct*bG
S Eb
iD[E
a0x3
1 2
qg63
cy]z
$y-K
O6}z
#e"k
,6qN
}0SV
+SgvH
4+K+b
[_(B}a'
3SCmmn
[O9O'|`8
Vdr
%WNVA<d
U
,|%)v
_}|
7xz~q
R7E6
Aq4|yF
5+V*jM6(d
5lX
%<}!
-9 `
Vw"
$!U<#
gXUG
hYgp
ERQW5Q
tY:#v;
->ei
:@FM
3Sb-1
=V3V
dZ]|
" #
5http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
d7N[{:XS
_l?L
ComVisibleAttribute
,sgR
0Y-4
GJ_A
;^)F
{g3N
v-E7d
W ^7
=5L:
Rpnug
?f>6x?
l&*;
d|,4
:jY7KS
&'
.http://www.digicert.com/ssl-cps-repository.htm0
C[,a/zSf
}X2w:
System.Configuration.Install
?NIB
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
Iyr*
~ JA
m5>
2http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
M:P^
'}>g
,*o9
:KDIa;c
m #
W "
A,o
X),kL
n|wg
v;""
CgF~
e>~C
oo,x
UUS3UUT
T|F>
*D+lF
get_Message
!This program cannot be run in DOS mode. $
xGQ-C
#VNn
#?rb
LbAJ
]{5/
hv YHn
Vy[
hm<g
UUUU
Me4>0H
r/a]
*E4zZ
^-fF
Dispose
%x_D
4t
}$-j
EDp@
`sL{2#;
dd3
Qr5vOD
\Lw&
IW|l
bww\j|F'
dhCO
47v3/
ye7#p
/itRg
%
4|z%
v`i9
ICloneable
xS-*
)g]*
%S}n4
f52F`W
!l9M-
>Q(r
7%rQ
]U I
NFCW
;<
Jm v]
H[,&
rfkd
PO\
5 *;p
[BPo
3BF%
UUUV
wk n
bp )
D9-L
w:^l
Iv@*
]) x
rIDAThC
Hu&
/$ :
bzWd
5*RmW
_;nPF t<
?(dG
%]H.
L<bK
M-zZ
hp
l|N?
mbUC
j[KW
M j
R(9v v
Bs-
ItD~n
| Xe[
}Ivafz
BGF d
#UU0
pnC>
4E)yM
UUUP
WjNb]
?#ym
uOal
z?)df
7|fW
2rZy
HFnf
noq8
yeSH
CKS z
axM;
! Ou
s4"?B
G?/
axfV'
lIDAThC
HB\s
:qR95[
DN{R$
V
,FR*4?<
kD=?9S
b.NI~
Y\8}/
b+UN
+,-'.
oIDAThC
zAmr
I ^"
`*`Y
^zO%
4nTw
\2}t
$WjE&P
=8RL
A {pz
W*9o
4! K
l C*
7L`)
System.Linq
wk
xFU
om @
vm}=d
Qk"q
N$]o
n
141022000000Z
M9my
OaE:
6 78
9w@'
rA<G
BR_]3
tI[h"
2K[
\Gqr
A%_c4
jz{EU
3:s(
6Up
By!gRy
?9hR
e%/,
s'E3
UUU0
'7n~IW
P]#i
OJPo
UUU@
'st?
1e#
++kZ'
?,*A
Dw'F
UUUT
DVy3
*K&72
Opul
!aK5
4XhL=
*Wbw|
C>4x79
InvalidOperationException
Fd2j
rfAh
6kc
i."r
nbe(
8`Cq
qwb
#Tvk
LQEVTFA
W cR
DZh
LM
^L}R2
H 9w
nBV`f
A5KU
H 9
YYfp
Ai(C
=@{X
a.aQ
\,(+)
* ;N_w
o: `
d'~
`LG[
SYW#'9M"
QxyH
xuyo1
kIq
`v%_~f
: b bf8Z
%~1
U\?!
tXkX
qdLi
>L0]
=#``
`UF~
s?&K
#UUUS
_G-
KV A-c
).lC
c'%6/
d'~$
jIDAThC
T)?;
K%f2a
h&^q #
AssemblyFileVersionAttribute
r%+X
_4j
zVo3
2m[t
w"|o
JMXY
#OXh
L(HS
d9Jw(
7gkT
e'I@
;UeE=V
+Ap5
B04
k0i0$
0!0
#?,%m
IC1
n|(8
;xgF8
5kl9
"T5_
Hh5X
T|1oN
BX5p
AOL[v!
V= ~
F7l3
}y[(
Cb%h
LXzo
~2(V
}`%/l
UUUS
U*\Nv
Z&wn
i~=Z
/=u"
j%"b
bfg?
&8##
.!JDr
Wz .
LLY;DEr
MethodInfo
i{Qb{E
131022120000Z
f2m
(ykz
;GW
`+=D]
7OPR
IQhn;g
CompilationRelaxationsAttribute
iH/I
X+#k)
|I@
@U&C%x
,w%'U:
@dY`&$"
I @
!
cQq:o:S
CJK$38
w+>{
ogZ e
g2L`r
zm:W
h-1%
p q
Ahw(
S$zL
? @
nZ|^y
ResolveEventArgs
S$zW
k3]1:#
%6ze
System.Core
_/OQM;I
d]jv
dGk
^kU
/~ s
iBFy
&<[;_
KOk\_
wl
WM/s
M}j\:zH'9
[Dd
#dQ+h
p1f3q>
hA0lO
,EQq
;C S
4http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
.7w7
D$myui
J]C~I
[xn1
3A38
B4/,:3-
`J|S
QR
I7t);
<GSM
^fL6
_cE 9
!ws
!<2
U^(qqb
jCvu
?vC'#l
*GZG9
J@B~
jfpY
wJlP
v&fB
\P] `
IEND
i0s)}"|
+@pF&
6Kp$
@ 5
Ov@2
ik
Ux,%
o"Pg$-)O!
'0_<o
)_b9hz
&&I
G#Dg
u}O-
LD3I?!P
d4L^
Q4 4
Z!&_
Qx8S
:U'
jIj@b
?Sk7
9$yf)
stT^
\\Gv`
|L/iv(
j6(h
UcJpQ
|+QM
A B
E04C76D90E657BA0402F9D572DE08F8C086C724E
4ind
#w|C
PK8i
h`o
-RJ
Q@X[
M[!E
H+T\
;' ^
G05K
_i{.
;aSF
a=y:8
MoZT
MQ;G
m7\.Q
VBYy
J:Mj
&36T
=|)
C$rO
.zEn
fdLx
vbLw
&9%]/
h9d+
~Og$|_Kd_N
yH7V
i[:(
Su/>;
r({
E5gX*
N;jh
nhzO<
C*cV7
*s eQ
j!->!
_2P|
O7?'
B++4
"hc*
grdo
7_kL6
34X
eR_B
[x|V
PI*O
EopJb
7<=,
oBBB
[,^5
WL2.
[g[
!-[N
Nd-
7M;S
'v+
CwK7H
>3oDb\
ips#
@pW
{}I-CV
2+Y8
th,E
xVwL
E?m@3c7
0*0(
Q%i2
\NPg
k.c3cd
https://www.digicert.com/CPS0
>Rj
|`2a8
1\ai
, -
- s_K
g[M\
/oF I
Cy)>
({vU
F*T$
CAsP
DH,xQ
ij $z
. {
&>)t(S
%ok&ZEX
yI!7]g
eW@O2 Ed
AssemblyProductAttribute
EUUUP
FEkz
2e%
i9~+S
FPLe
Z9Zt
dRmU7m.
r5P-
QF;/O
Y4|C
m;n^0
Dq[Eca
%D5P
System.Text
sEH]
(>3
NP`TCb
qL!a+
Lbq?
6 gh
Db 5
Swmkc
C?#{s
@) }~
Y]hkn+m
zLR?J
0b10
]$+y
/y l
]7-zN
uO)=
EC\k_
5unL
_PBzC
CbNS
Mi8
yl~y
SL%W
6Vp
Oq41
(DigiCert SHA2 Assured ID Code Signing CA
-N"MR'
XQ[o
.buu
5ma'
t6}
*`.
+p<=9
ggaK
fUi\
iGy.
i4$b7C6
k8"
TE,`a
>BWg
TS2j_
.b&o
AVwt
IEnumerable`1
9Bq
D8"Q
bP_]
'T~&
6kX%6
Ckf|
Gc=c
pts%
)*~'Y0
G@Q
SuppressIldasmAttribute
naR-~B
ca9vO
E$qQ
m(X3
IDAT6n
nXC\qqi
V)N$
[Ox-
|KoCQ<
g;`cc
kmLzq
Y8A8F
p@x:
ZqcE
'N<V
fI9K&E
m6!2
wDKG
I+AQ
$/^+
mWw:
&|kk
f)|
{/`9
p0n05
kK}s0U
Ck=
6aq
YZKQ
&4/&
CC'o
B2+O=
kD@0S
x9a
e4;0
S%md
5UP
C)de
+.u|
tYo|
={P>7
&8.C
,N?k
{P]m}
[MNk
JI;l$
String
h?qN
t&\~~s
'?-\V
5YnZ
\:3D
ts87
UUUUT
.Q5f_
>JVPqS
osPN
0snd
zJ4:
:eo8K
UUUU@
~AlHb
<Module>
1DF8993943A4BF66DBD51235236F97F5220C49B3
bLc
j }
&C~Q>V#
_w:E
ZT693
EOj<
39z@`^
K< -
9YK$
0'# @
sZ?:IH(
a;sz
|",Z
urn{x9g
_=z
/mK
J3l)+
_=y
1reg~
InitializeArray
Ule
-,&K
]g Q
b akA
7Hof
L1;n
%]xi
`C1d
q>h
D n
Y$XU
>n^9)
EiL
Wroo
Sl Y1
`w!n9
phn-
28#C
%N0C
|zbi|ugZ
ToArray
owmk`
CreateInstance
.~LpY
Ha n
\
k!9fN
KPd#
.:V]n1J`
_G
W +g
'E.m
Da vi
K*D>kk;
c:79
=HO
B-2G
6"d5
F(=#
EUUT
3b?h!
pS-"
{(`"
t_(`
yw_A#}
)$CC
-B;i
@ I}
l?4}
]?0Yml{
WAlaEl
pP(E
d|+AUS
!Pk%~W>
]gPN
%|#t
iIDAThC
4$P[&){
bs/?
$ZzYs
HtoC
O7A!
;l@/
f4 X
~Xg
;O.Z
uF_v
h .HC
p-\=5
/A i
ui_^
pq^o
0i-D4sk
|px8
pdX)
DEAUv
fq9V'}
>'"<
;%CZ
fe:]I
1|U!
^l,k(
H+dQkH!
v8fL
LH{N
&t=1
r1-u
<Lq8E.
KN3p&
w'-;
x2~W/
nZ{e
zU>y~
P]cQogB
RL~y
f$oM
kY;R
#&Hc|
' ()
!+91
;ms&
SFOH
JIKL#.
T:i&+n$
[ \
UUUUS
https://www.digicert.com/CPS0
\Q\AF
PN_){
*tS
0(R^
`,0
O[+&;
1jXg
JK LJ
2-Yrl5Q
[JS
6P>oP|
2t=S
I zA
w[1
t Ht5n
r{^H=W
@z`I~
WdD,>M
RunInstallerAttribute
12OW
i^rhsw
$ ]gI
B( ]
O7bP
twC`
UUUUU
nI J
'zKsa
37|ad
b c
o
~@QJ
r|S5
UserControl
;%UE
}5D9
jk =
"i|c5
+EFoW
TcR,
D]Y|
fFrs)
@yj'
8,=\
{!X
(!`a
sRUI
ca z0Gqgv
e(if
EZ)Q
NE&2D
'?c
d@@R
M!(
d$^w
[[
Fd{i
6:cb
Object
rok(
N9_N\
VOYP
G~GM@~
>%u
`';v
GE;4p
GI4[
.0{{
R` d
z}h{_
~'Zx
ttNa
X} :X
/0Hw
+O+j
zytC
|!yX
`zI"7
%w|C
_ u
g# 9
?+c9
<@^b
1R`L
DigiCert Inc1
'G#~
%rBz.
tF|9g
|b+m!
^p6u
Gc{c
j}p
?T>4F
!sro
cWk5xM
8Vs&
z0x0:
P3p.
x tAw
R/UZ
U=
nIDAThC
UUUUUU@
]B>{c
AssemblyConfigurationAttribute
a \
.5s9
<6;k
'_~r
y0`
UUUUUUP
Kd>*c@
PTWW
c47?
24T6
FIDAThCc``
a_>3
<:3%
[2\|
Dp%j
1.0.0.0
AYa"SJvk
T7FC
^G1LH
R;6is
qeo 0\'
SEAa
I ?R
CPww p
9-fX
l_RD
3nKB
rjx-
{^#k(
(_d<8
jl{2
h1[q
%> +
mp)
.\B
"L$Q
J:0*
L+W
y|Aj
!(FR
(u,w
^weL
4wi N
rkw\
?qy'
jn!
C*
-8gq
l[?z-
kIDAThC
\K`p
+R!l+
D,/B
v9Wbr#
@d&
{aU -
ig"n
m7)
Bi$t
AutoScaleMode
CreateInstanceAndUnwrap
Sr.LM
,.xN
~AkX
l-[Gk#x
Y'qN
hp%%
YZ [\] ^
I^_`G940
!1Qh
~ .7
, qn`
m: u
niNQ
7M2cz&
/y ^
3r6c
8 ZZ
_#1>6
$UIS
/nw!_~h
{MW&]
Ypvh|Q
PC:Z
%C ]yj
=zx"
6 i_Yb1a
(Bsm
iv O`~
8bjX
(&N9
F+?2
xVVd"
'4
ou#n
I?\X
_b B4
+|f8
;QX|
]$F|:w'
ECI'
Xucn
5Pa]
#c1n3U
uR'[
g j
=#`a
LfR
O,4G
sSo0
D\<G
EgAC
-Bo
p \|
#Kzc
kCmR
9Tb`
0DY|F
ResolveEventHandler
c7E$
097^
OT7P
2\,'
{R_g
F7Mk
= >
I)kO/
DxO)X
set_ServiceName
e@=A
h\Rh
0:Xm
5B<!
wN`y
=cf1g
~lv8
5e4h
hS#A
=Qi0
u397c
XGgF
G%|k
u-QH|
UL>N
t iZ6+u4Z
k?+N
?$p#M
V7$>
*o=/
|xK
$ 7;
!JI4'
>^e(/"
b=m;
b'GF
I~S{x
/@'&f
% J[/
G }k
]i!B
u!]u
xl_f
`rV;
$306fdd38-de35-4469-a778-7f70a87b6303
K LM
afqfp
Y#ye
k?N;
|gbuM
281022120000Z0r10
OWJ^O+
2S#j
t*4.j
PN!J@^,
}X(F
UUP
m"7?
5b/z
Jrk
hH s
System.Reflection
XH2%FL@*
+4Y
w#ge
c}q"
.WR0dCI
|Oai}RV
p=C@
DI6%
CUd_
phYN^
*Ez
0Mq.
R#j)
Hjze7.
b51O.
-;u^
"Ar
>wa~
!w z
2@@4*
px[3
\4p+
}mF|
GuidAttribute
l-9
G,|%'7
!w C
J caG~
0
h(gsW(
>%
X5.*d-O
Y'O_
h2}V
Pf"
4http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
5'9u
~\n[
Bj-
vv*Lab
d
EL`3
zc# K
kZ5f
m_A)\
~-^G
{/MR
59
Ns6%
Mf]G
)[q8
\eq~
IlPN#k
l_q{
,KZC
<u`
aJ!rT
^3/_
P| gx
NO PQ
FNBNFN
9&xd
MHo"y
1~ jo
Component
#=t%
(!`?
4MB
kUHx*
.g'b
w'#j
LOnC
L>xk
'Vaq
Ferny Grove1
ZY0
|# k
_s-
ga1sR(
^2([]
8) pV
|A"5G
e^#}^
DBt>
ZgX
`l.}
AB<R
C+H"
r,SG
|n @
f:@
[|$yJ62
5U5{
bM)9
-u,[\
Copyright
SkU
$e!#
)fLg-
wV_h`
ArgumentNullException
\Ci"
;Q`K
'"dl6
}m4r
: Je
UUUP
Q:$X
e`u)qU
KLt{
%^xb
t 8B
oCDe
}l!8
n/Yt
ec2{7|
JN|nL
6:dp
Bx(C
* Q|<u
_#/w2M
#(SB
"%k
??Yc
System.Runtime.Remoting
wRMB
d{1U!
a+E
I?ai`Y
9+ym
g^ItB
/p5F
`A1w
jf HH
$GU3
t :_
m}I3j@
4#[a
<j-{
yV S
=*)ud~
|@Kd
@\9=
q)f?A
=C6R
)@t"
+hez
K06sZ
E+3Xf
VW
#E,%O=
vj,qB
YC{U
tx\ /
m"?<%M!>h
&>2f
Exception
e-$a
57KX
N*zV78
Q;Y_p
yn4<
E{z@Y
'AN C
}_qP
y(:~
h]f
t4!MqH [
3x\b
sv0<|(
m3ep
(Oai
]xn
'fcQ;
+ENzW
g_if
disposing
sO6Q
ac700e14-411d-1d.Resources.resources
:Dz$L
.%)IAx
86[2
{KBK6x
GetTypeFromHandle
c^d?
Q}0s
S=.)RA
<2G[r
&=Nl
*;q|
Sqr;
<L|1
Installer
c3bL
;#HS
ieT>
agNQ
pbZt
y(Xb
0wi:W
(`4
4SJo
- Ut
V`8iu
r0$m
jQs*>@
vQG.wxB
S}Tc
43Lw
] }
H},~
'2,d- /
&%H*
"X+L
7d^He
Fnlw
~fAD
f[7(#
qpm
2Zd%
v4t,
d!=w ,
1]S
pbLE
CH7H
&|xJc
-U]V
7http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
paYT
wk<
N]"L
n3]ua
Wy=_9Raa
5Wr^
*Q\!FG
|G{
7>G^8
4 >l
qO"iI
^{r
9s;N
PFK
k=*
g0eL
y1a3
f|'_
+~q_
!BceA
,,sd
'x}*k
_? K
!w g
wNUr
2+#s
FMOg5Z
9 <?
dXMe
.4iy[
f2Aux
"(4e
~t96
y*/i
-w!H
)W70S
RJn'
DboZG}
P!nqC
r.cP
.t9;
Q!r9Z>
5u="}
A[rP
dNCup
PqeJ
%2:8Y
2t u
SCuv{
}Z+F
C\*0
/9 fe
7P?F
P7M
Nc5ztSk
ApOyf
ede
x%_8
061110000000Z
Kvl3
v?~g
/L5/{
:y$wBj
5`J=
|)2s,0
=>}GVy
Xl)-
`%`.
`a$]<g
S]\;
M [!
0 12
-bVZ
UUUS
C~4c
_"JZ
0Tf
$_%k
ph"q
d>I0
P|L7
!(Vm
UJq
Z^j[
BK`4QHZ[
E\Fc
Y 8T
J!qx
!=;z
)G?9p
X3''
`G(q
|uBt
00&41i
^(}.
/http://crl3.digicert.com/sha2-assured-cs-g1.crl05
C:S7
Ql`'?
c05L
It w&
A
zj^<^
gk
\O*
>Z*Z
2m:$
$;6^
Q/9M
u:nA
Hb
zNNG
!wk
W vw; xy
MPW4o
r|_w
+@CV
.V;B=
}e_g
n+ER
Ds aGL
B}(=:
:jl;
IDisposable
UO2E<
I"vq
\hMom
#U{O
AY +
h=1/
Installer1
^}9
,qD;
!!!^
K !Z
/ac
ta+i
##y
$wlM
GO 3H
G/BA
'FA`.G
A2T=6
;;>
l&[5
Gy2),
NmB<d
B\@"
WJW"+<9
th>l
@ u
Po<7
$UUUP
~T g7r
h]! .B
fuSC
J]o`
29h<
, !k8
(lTO<
i ,
5\,?U
|c?+z
Wz7y
>}R5
!*dU[
@R;pl)V
f Mm),
DigiCert Assured ID Root CA0
qu7I#
IZ fG
+
)=Q:
#Blob
241022000000Z0G10
zI/N9
wc 1P
=sxg
&a+2
Ri4Th
:j@+
KB%$
M50DB
l~C>)
ZF|!
HOc|
emMs{%
!`m%
9j|)
c4$Lk
f#uD
=5 F
k(4P&
IMoj^
5UUU
>kC6
e=
B!A}
@JWy
-~'
Ob#C
zD7l
xO^p
ImrC
U33
"n,c
h_Eh
<Z!{
J^s?u
{2/Aw
WriteLine
S);c
1o"<v
B8Rv
*CpfW
b {%r
S~Zc
rI_Y
>!W
39ED166B09C1C9A7668A5E5AC83C0B0C3470E897
Ewl".
Iq ?
HTyy
oq<R0
]~<|
CvGD
GMJ
E1 o
)*
<Ec*
fKgX
V.{B|
#GUID
Z2Hv<
1O6a
vkb
s(zv
6LUn
D E
Nf6
!@J-=
R_vz
*m1/
un:p
N>:
qIDAThC
!W*
Z(r5p+
4dV:b
lW|
s(zU
8`d[
|S;C
S+~`B
gmV.
d~`_:
O0$.
;)e
/
yS#
410AA75E49419D09DB3FF821805126CA1AFD8D01
3x>n
g}p,WR
6yAtK
<O;L
YIn:
P&y2
l 7L
j'nb
.la6
}zX7
dQ$o
|jJ bN
pz0=V
{cCL
t|;3;
'bQ!
Fk
H0F08
[^bl
\>hY7
1&`g/
`AY,
c`'
9!Ht
B sC
Y+p|
",ko
|UDI
+p qrst
'm%y
+WmC
U4`y
"W\%b
lVF.<
=UOx
[/.2
[q8A
P"K~
stE#f
f[:=
$a"Y
JepI
3>U2
H@_
nr7Hai
~w&zt
LwY.
jd>.
E$x
khGP
l$y.
e f
|V0c
1X"|
CgN4
zIq"
@i24
N O
lf1
I$j0"
(bi qV
]Mw
s| -@h
V5|q
5UUUUUUU0
Oe|j
G^E+
A1>f
`nt~n
\ofcT}
*E z
7ovsq`p
qPVSG
ET<J-
cL3D
X6P#
tYI
~S0pm
pl1T
?`VuO1
6$MnXQn0:
~o=l)wC;!
ra e
EUUU@
,>6xd
z~(e
>4c4
0:F
=p9n
N`e/B
yue
^y5A
_>xK#_
+s,s
1tKZ^
3C4
`x{h
#Li
4/1w
z<'s
UUUTEUUUU@
UserControl1
zBFU7
vn@"
7GYqX)
JfP?
pF]a'
w^6(
6-$G
2?cV
{5,?
`sX9
{]S^Th+
E
*^QQf
y=5I)
QH<
CR&t]
i'++
[NF;
System.ComponentModel
oq
?U {
C3<J
31RbL
7Bo"exh
k9 T
k
Sib1
{O7'
.l 5
x(3:YvS
)v[x
uo0-
T{Xi
HggA
BYb7
?}*D$
<P6
Tw.gf?
o >3>
:7P@
ibnr
Ok-"
Tjgo
mscoree.dll
{=z
{={
3vb[e
0=VT
@ ,&
2%*;
J0xc
*keb
mrv#
Ej_?
B(o$sa
,9+D,O
{BZ=
(Cy-
<UAQ
@:MQ
us(u
k"t4
uuNd-
w0" lm
nRt
7\]^_
2Ffu
epBr
p_@
3,p3u
Y1N
$JWK;;q
vA-j
7"*7
8cfV;_
s jR
System.Collections.Generic
d,w
8;5m
l6`zW
_c>R
8&^Sg
49+U
\u?N
FEaJ
mB;oq^V
ZBCT
4Ynv
;0907
2)\
1OAMC a
G;@+
9"Q.
System.Windows.Forms
>'fa
>+{f
{_x o
r><J=
BW}.
yB$Z
%lqf
8 EE?
I? lf
geIIL
<K[
r'25
eXl
K!"t
UrTaw}0
System.Drawing.Bitmap
x1V1
VTmN@;
Iu4V
R;)hi
bDb.
zI9;v)
zRP`
*D&8W
tc #
oH&8x
(
F+tv^$Z
StringBuilder
|uo9
j4D0
lIMF
rzvU2RS
sicc
nZle
] Un6b
qw5/
\6Q#
PCH4
K&.Qa
d4
"$eg
$WJ[ h
y?fjd
W X
b$3{8
5~W+s
ZZ]']
_aeb
E
Y R]
<Z3:#
DXo$h
P,<Y
.".f
KPe
*O"4R
4;ph
DjVZv
dv f+
I-ifdr
T\i3
Qc81
QC
f\h
#p=6
"~4?b4C
iP)I
e>ys
RM{b
5 0/
6+j-
MKtE
Behavior analysis details | |||||
---|---|---|---|---|---|
Machine name | Machine label | Machine manager | Started | Ended | Duration |
Seven05b_64 | Seven05b_64 | VirtualBox | 2018-02-09 13:38:14 | 2018-02-09 13:41:08 | 174 |
11 Behaviors detected by system signatures
Crashed cuckoomon during analysis. Report this error to the Github repo.
Severity: High
Confidence: Very High
- pid: 2584
- message: Exception reported at offset 0x12410 in cuckoomon itself while accessing 0x40 from hook RtlDispatchException
Attempts to remove evidence of file being downloaded from the Internet
Severity: High
Confidence: Very High
- file: C:\Users\Seven01\AppData\Local\Temp\PurchaseOrdersigned.exe:Zone.Identifier
The binary likely contains encrypted or compressed data.
Severity: Medium
Confidence: Very High
- section: name: .text, entropy: 7.93, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00045000, virtual_size: 0x00044e54
Unconventionial language used in binary resources: Oriya
Severity: Medium
Confidence: Very High
Performs some HTTP requests
Severity: Medium
Confidence: Low
- url: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt
- url: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- url: http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D
- url: http://ocsp.digicert.com/
- url: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl
- url: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl
- url: http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEATdwdwubyOrVguJJz1Doxw%3D
- url: http://crl3.digicert.com/sha2-assured-cs-g1.crl
- url: http://crl4.digicert.com/sha2-assured-cs-g1.crl
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Severity: Medium
Confidence: Low
- post_no_referer: HTTP traffic contains a POST request with no referer header
- suspicious_request: http://ocsp.digicert.com/
- suspicious_request: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl
- suspicious_request: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl
- suspicious_request: http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEATdwdwubyOrVguJJz1Doxw%3D
- suspicious_request: http://crl3.digicert.com/sha2-assured-cs-g1.crl
- suspicious_request: http://crl4.digicert.com/sha2-assured-cs-g1.crl
A process created a hidden window
Severity: Medium
Confidence: Very High
- Process: PurchaseOrdersigned.exe -> C:\Users\Seven01\AppData\Local\Temp\PurchaseOrdersigned.exe
At least one IP Address, Domain, or File Name was found in a crypto call
Severity: Medium
Confidence: Very High
- ioc: www.digicert.com1
- ioc: http://www.digicert.com/ssl-cps-repository.htm0
- ioc: http://ocsp.digicert.com0C
- ioc: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
- ioc: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
- ioc: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
- ioc: https://www.digicert.com/CPS0
- ioc: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
- ioc: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
- ioc: http://ocsp.digicert.com0A
- ioc: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt
Creates RWX memory
Severity: Medium
Confidence: Medium
Presents an Authenticode digital signature
Severity: Low
Confidence: Low
- md5_fingerprint: 8ad7fe12af4316cc4784bee7485580ce
- sha1_fingerprint: 2f8914d8af13049ac5cc2cb57856bc2cbc04004b
- cn: NV Access Limited
- sn: 6468341538495787969245994484324606748
Attempts to connect to a dead IP:Port (1 unique times)
Severity: Low
Confidence: Very High
- IP: 192.168.56.1:80
Behavior analysis details | |||||
---|---|---|---|---|---|
Machine name | Machine label | Machine manager | Started | Ended | Duration |
Seven05b_64 | Seven05b_64 | VirtualBox | 2018-02-09 13:38:14 | 2018-02-09 13:41:08 | 174 |
10 Summary items with data
Files
C:\Windows\System32\MSCOREE.DLL.local C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll C:\Windows\Microsoft.NET\Framework\* C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll C:\Users\Seven01\AppData\Local\Temp\PurchaseOrdersigned.exe.config C:\Users\Seven01\AppData\Local\Temp\PurchaseOrdersigned.exe C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll C:\Users\Seven01\AppData\Local\Temp\PurchaseOrdersigned.exe.Local\ C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll C:\Windows C:\Windows\winsxs C:\Windows\Microsoft.NET\Framework\v4.0.30319 C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI C:\Users C:\Users\Seven01 C:\Users\Seven01\AppData C:\Users\Seven01\AppData\Local C:\Users\Seven01\AppData\Local\Temp C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll C:\Windows\System32\p2pcollab.dll C:\Windows\System32\qagentrt.dll C:\Windows\System32\dnsapi.dll C:\Users\Seven01\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\* C:\Users\Seven01\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\* C:\Users\Seven01\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\* C:\Users\Seven01\AppData\LocalLow C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_* C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_AB5EAAA21DF673505B87D680AC76B6E1 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_AB5EAAA21DF673505B87D680AC76B6E1 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\782D7E2BFB036A849A99FFA65C652D39 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\782D7E2BFB036A849A99FFA65C652D39 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\616AD1AB067CFD351D6C0EF6F3E12F40 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\616AD1AB067CFD351D6C0EF6F3E12F40 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_* C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_410FB3CF6B8F188A93483A1CA77D2A26 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_410FB3CF6B8F188A93483A1CA77D2A26 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_4E02E99C0438E960214C3F76FEECCCFC C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_4E02E99C0438E960214C3F76FEECCCFC C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E506CEBBC8B162CFB2D72DB4891DCAE C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E506CEBBC8B162CFB2D72DB4891DCAE C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F4EA555947766F67C3BB52DEDFD509C5 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F4EA555947766F67C3BB52DEDFD509C5 C:\Users\Seven01\AppData\Local\Temp\Cab22E4.tmp C:\Users\Seven01\AppData\Local\Temp\Tar22E5.tmp C:\Users\Seven01\AppData\Local\Temp\ C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll C:\Users\Seven01\AppData\Local\Temp\PurchaseOrdersigned.config C:\Users\Seven01\AppData\Local\Temp\PurchaseOrdersigned.INI C:\Windows\System32\l_intl.nls C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll C:\Windows\assembly\pubpol23.dat C:\Windows\assembly\GAC\PublisherPolicy.tme C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll C:\Windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.INI C:\Users\Seven01\AppData\Local\Temp\3afef41f-7364-4f66-8276-47900296bd98.dll C:\Users\Seven01\AppData\Local\Temp\3afef41f-7364-4f66-8276-47900296bd98\3afef41f-7364-4f66-8276-47900296bd98.dll C:\Users\Seven01\AppData\Local\Temp\3afef41f-7364-4f66-8276-47900296bd98.exe C:\Users\Seven01\AppData\Local\Temp\3afef41f-7364-4f66-8276-47900296bd98\3afef41f-7364-4f66-8276-47900296bd98.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll C:\Windows\Globalization\it-it.nlp C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\f02737c83305687a68c088927a6c5a98\System.Configuration.Install.ni.dll C:\Windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.INI C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll C:\Windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.INI C:\Users\Seven01\AppData\Local\Temp\PurchaseOrdersigned.exe:Zone.Identifier C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp C:\Users\Seven01\AppData\Local\Temp\it-IT\Project1.resources.dll C:\Users\Seven01\AppData\Local\Temp\it-IT\Project1.resources\Project1.resources.dll C:\Users\Seven01\AppData\Local\Temp\it-IT\Project1.resources.exe C:\Users\Seven01\AppData\Local\Temp\it-IT\Project1.resources\Project1.resources.exe C:\Windows\Globalization\it.nlp C:\Users\Seven01\AppData\Local\Temp\it\Project1.resources.dll C:\Users\Seven01\AppData\Local\Temp\it\Project1.resources\Project1.resources.dll C:\Users\Seven01\AppData\Local\Temp\it\Project1.resources.exe C:\Users\Seven01\AppData\Local\Temp\it\Project1.resources\Project1.resources.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80 C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll C:\Windows\Globalization\en-us.nlp C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089 C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089 C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089 C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.dll C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.dll C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.exe C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.exe C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089 C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089 C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2584.19273687 C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2584.19273687 C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2584.19273718
Read Files
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll C:\Users\Seven01\AppData\Local\Temp\PurchaseOrdersigned.exe.config C:\Users\Seven01\AppData\Local\Temp\PurchaseOrdersigned.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_AB5EAAA21DF673505B87D680AC76B6E1 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_AB5EAAA21DF673505B87D680AC76B6E1 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\782D7E2BFB036A849A99FFA65C652D39 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\782D7E2BFB036A849A99FFA65C652D39 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\616AD1AB067CFD351D6C0EF6F3E12F40 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\616AD1AB067CFD351D6C0EF6F3E12F40 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_410FB3CF6B8F188A93483A1CA77D2A26 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_410FB3CF6B8F188A93483A1CA77D2A26 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_4E02E99C0438E960214C3F76FEECCCFC C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_4E02E99C0438E960214C3F76FEECCCFC C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E506CEBBC8B162CFB2D72DB4891DCAE C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E506CEBBC8B162CFB2D72DB4891DCAE C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F4EA555947766F67C3BB52DEDFD509C5 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F4EA555947766F67C3BB52DEDFD509C5 C:\Users\Seven01\AppData\Local\Temp\Cab22E4.tmp C:\Users\Seven01\AppData\Local\Temp\Tar22E5.tmp C:\Windows\System32\l_intl.nls C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll C:\Windows\assembly\pubpol23.dat C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\f02737c83305687a68c088927a6c5a98\System.Configuration.Install.ni.dll C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
Write Files
C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_AB5EAAA21DF673505B87D680AC76B6E1 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_AB5EAAA21DF673505B87D680AC76B6E1 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\782D7E2BFB036A849A99FFA65C652D39 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\782D7E2BFB036A849A99FFA65C652D39 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\616AD1AB067CFD351D6C0EF6F3E12F40 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\616AD1AB067CFD351D6C0EF6F3E12F40 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_410FB3CF6B8F188A93483A1CA77D2A26 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_410FB3CF6B8F188A93483A1CA77D2A26 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_4E02E99C0438E960214C3F76FEECCCFC C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_4E02E99C0438E960214C3F76FEECCCFC C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E506CEBBC8B162CFB2D72DB4891DCAE C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E506CEBBC8B162CFB2D72DB4891DCAE C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F4EA555947766F67C3BB52DEDFD509C5 C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F4EA555947766F67C3BB52DEDFD509C5 C:\Users\Seven01\AppData\Local\Temp\Cab22E4.tmp
Delete Files
C:\Users\Seven01\AppData\Local\Temp\Cab22E4.tmp C:\Users\Seven01\AppData\Local\Temp\Tar22E5.tmp C:\Users\Seven01\AppData\Local\Temp\PurchaseOrdersigned.exe:Zone.Identifier C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2584.19273687 C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2584.19273687 C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2584.19273718
Keys
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\ HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0 HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir HKEY_CURRENT_USER\Software\Microsoft\.NETFramework HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR Policy\Standards HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PurchaseOrdersigned.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB HKEY_CURRENT_USER\Software\Microsoft\Fusion HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000 HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\crypt32 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DebugHeapFlags HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\msasn1 HKEY_CURRENT_USER HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Certificate\{31D1ADC1-D329-11D1-8ED8-0080C76516C6} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{31D1ADC1-D329-11D1-8ED8-0080C76516C6} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Initialization\{31D1ADC1-D329-11D1-8ED8-0080C76516C6} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Message\{31D1ADC1-D329-11D1-8ED8-0080C76516C6} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Signature\{31D1ADC1-D329-11D1-8ED8-0080C76516C6} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\CertCheck\{31D1ADC1-D329-11D1-8ED8-0080C76516C6} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy\{31D1ADC1-D329-11D1-8ED8-0080C76516C6} HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Cleanup\{31D1ADC1-D329-11D1-8ED8-0080C76516C6} HKEY_USERS\S-1-5-21-1822907384-1282624486-319450072-1000 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\State HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security\Safety Warning Level HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Safer HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Safer HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\TrustedPublisher\Safer HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagLevel HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagMatchAnyMask HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Wintrust\Config HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0 HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{000C10F1-0000-0000-C000-000000000046} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{BA08A66F-113B-4D58-9329-A1B37AF30F0E} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptSIPDllPutSignedDataMsg HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{000C10F1-0000-0000-C000-000000000046} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{BA08A66F-113B-4D58-9329-A1B37AF30F0E} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptSIPDllGetSignedDataMsg HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7 HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7\Name HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MUI\StringCacheSettings HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\StringCacheSettings\StringCacheGeneration HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4b\7F06864B HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\LanguageList HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\p2pcollab.dll,-8042 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7 HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7\Name HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7 HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7\Name HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\dnsapi.dll,-103 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\#16 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\Ldap HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CertDllOpenStoreProv HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{000C10F1-0000-0000-C000-000000000046} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{06C9E010-38CE-11D4-A2A3-00104BD35090} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{1A610570-38CE-11D4-A2A3-00104BD35090} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{603BCC1F-4B59-4E08-B724-D2C6297EF351} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{BA08A66F-113B-4D58-9329-A1B37AF30F0E} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB8-8E78-11D0-8C47-00C04FC295EE} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB9-8E78-11D0-8C47-00C04FC295EE} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AABA-8E78-11D0-8C47-00C04FC295EE} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{DE351A42-8E59-11D0-8C47-00C04FC295EE} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{DE351A43-8E59-11D0-8C47-00C04FC295EE} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptSIPDllVerifyIndirectData HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllEncodeObjectEx HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.1.1 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.1 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.11 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.12 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.2 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.3 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.4 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllEncodeObject HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2000 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2001 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2002 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2003 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2004 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2005 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2006 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2007 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2008 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2009 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2130 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2221 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2222 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.1 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.2 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.1.1 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.4 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.10 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.11 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.12 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.15 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.20 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.25 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.26 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.27 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.28 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.30 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.4 HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\ChainEngine\Config HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableMandatoryBasicConstraints HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableCANameConstraints HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableUnsupportedCriticalExtensions HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlCountInCert HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalCountPerChain HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxUrlRetrievalByteCount HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalByteCount HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalCertCount HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\CryptnetPreFetchTriggerPeriodSeconds HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\EnableWeakSignatureFlags HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainCacheResyncFiletime HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\My\PhysicalStores HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\My HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000\ProfileImagePath HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\My\ HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\My\Certificates HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\My\CRLs HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\My\CTLs HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\My\Keys HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\CA\PhysicalStores HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\CA HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\CA\ HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\CA\Certificates HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\CA\CRLs HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\CA\CTLs HKEY_CURRENT_USER\ HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA\Certificates HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA\CRLs HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA\CTLs HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\CA\PhysicalStores HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\CA HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D559A586669B08F46A30A133F8A9ED3D038E2EA8 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D559A586669B08F46A30A133F8A9ED3D038E2EA8\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs\A377D1B1C0538833035211F4083D00FECC414DAB HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs\A377D1B1C0538833035211F4083D00FECC414DAB\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\CA HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\CA\PhysicalStores HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\CA HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\CRLs HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\CTLs HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Disallowed\PhysicalStores HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Disallowed HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Disallowed\ HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Disallowed\Certificates HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Disallowed\CRLs HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Disallowed\CTLs HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\Disallowed HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\Disallowed\PhysicalStores HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\Disallowed HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\7D7F4414CCEF168ADF6BF40753B5BECD78375931 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\7D7F4414CCEF168ADF6BF40753B5BECD78375931\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\Disallowed HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\Disallowed\PhysicalStores HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\Disallowed HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\Certificates HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\CRLs HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\CTLs HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\PhysicalStores HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\ProtectedRoots HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\ HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\CRLs HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\CTLs HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\ProtectedRoots\Certificates HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\Root\PhysicalStores HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\Root HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\CRLs HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\CTLs HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4F65566336DB6598581D584A596C87934D5F2AB4 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4F65566336DB6598581D584A596C87934D5F2AB4\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\627F8D7827656399D27D7F9044C9FEB3F33EFA9A HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\627F8D7827656399D27D7F9044C9FEB3F33EFA9A\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85371CA6E550143DCE2803471BDE3A09E8F8770F HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85371CA6E550143DCE2803471BDE3A09E8F8770F\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97817950D81C9670CC34D809CF794431367EF474 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97817950D81C9670CC34D809CF794431367EF474\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97E2E99636A547554F838FBA38B82E74F89A830A HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97E2E99636A547554F838FBA38B82E74F89A830A\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D23209AD23D314232174E40D7F9D62139786633A HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D23209AD23D314232174E40D7F9D62139786633A\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DE28F4A4FFE5B92FA3C503D1A349A7F9962A8212 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DE28F4A4FFE5B92FA3C503D1A349A7F9962A8212\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CTLs HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\Root HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\CRLs HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\CTLs HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\Root\PhysicalStores HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\Root HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\CRLs HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\CTLs HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\SmartCardRoot HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\SmartCardRoot HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\SmartCardRoot\ HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPeople\PhysicalStores HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPeople HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPeople\ HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\TrustedPeople HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\TrustedPeople\PhysicalStores HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\TrustedPeople HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\TrustedPeople HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\TrustedPeople\PhysicalStores HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\TrustedPeople HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople\ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople\Certificates HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople\CRLs HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople\CTLs HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\trust\PhysicalStores HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\trust HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\trust\ HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\trust\Certificates HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\trust\CRLs HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\trust\CTLs HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\trust HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\trust\Certificates HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\trust\CRLs HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\trust\CTLs HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\trust\PhysicalStores HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\trust HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust\ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\trust HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\trust\PhysicalStores HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\trust HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust\ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust\Certificates HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust\CRLs HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust\CTLs HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Diagnostics HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserenvDebugLevel HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\GpSvcDebugLevel HKEY_LOCAL_MACHINE\System\Setup HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllVerifyEncodedSignature HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllVerifyEncodedSignature HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllImportPublicKeyInfoEx2 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllImportPublicKeyInfoEx2 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllVerifyRevocation HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CertDllVerifyRevocation HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CertDllVerifyRevocation\DEFAULT HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\TimeValidDllGetObject HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\TimeValidDllGetObject HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\UrlDllGetObjectUrl HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\UrlDllGetObjectUrl HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\CryptnetCachedOcspSwitchToCrlCount HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\CryptnetMaxCachedOcspPerCrlCount HKEY_USERS\S-1-5-21-1822907384-1282624486-319450072-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DebugFlags HKEY_LOCAL_MACHINE\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\EnableInetUnknownAuth HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\AuthRoot HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\AutoUpdate HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\Escalation HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\WMR HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledProcesses\ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\985B100B HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledSessions\ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5df0b8\6103278 HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.ServiceProcess__b03f5f7f11d50a3a HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration.Install__b03f5f7f11d50a3a HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\ConfigMask HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\ConfigString HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\MVID HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\EvalationData HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\ILDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\NIDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\MissingDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.5.System.Core__b77a5c561934e089 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\221f0fd0\e71afdf HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|PurchaseOrdersigned.exe HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|PurchaseOrdersigned.exe HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|PurchaseOrdersigned.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\221f0fd0\1ff796d9 HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681} HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Namespaces HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
Read Keys
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DebugHeapFlags HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\State HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security\Safety Warning Level HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagLevel HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagMatchAnyMask HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7\Name HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\StringCacheSettings\StringCacheGeneration HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\p2pcollab.dll,-8042 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7\Name HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7\Name HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\@%SystemRoot%\system32\dnsapi.dll,-103 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableMandatoryBasicConstraints HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableCANameConstraints HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableUnsupportedCriticalExtensions HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlCountInCert HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalCountPerChain HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxUrlRetrievalByteCount HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalByteCount HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalCertCount HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\CryptnetPreFetchTriggerPeriodSeconds HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\EnableWeakSignatureFlags HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainCacheResyncFiletime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000\ProfileImagePath HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D559A586669B08F46A30A133F8A9ED3D038E2EA8\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs\A377D1B1C0538833035211F4083D00FECC414DAB\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\7D7F4414CCEF168ADF6BF40753B5BECD78375931\Blob HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\ProtectedRoots\Certificates HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4F65566336DB6598581D584A596C87934D5F2AB4\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\627F8D7827656399D27D7F9044C9FEB3F33EFA9A\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85371CA6E550143DCE2803471BDE3A09E8F8770F\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97817950D81C9670CC34D809CF794431367EF474\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97E2E99636A547554F838FBA38B82E74F89A830A\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D23209AD23D314232174E40D7F9D62139786633A\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DE28F4A4FFE5B92FA3C503D1A349A7F9962A8212\Blob HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserenvDebugLevel HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\GpSvcDebugLevel HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\CryptnetCachedOcspSwitchToCrlCount HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\CryptnetMaxCachedOcspPerCrlCount HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DebugFlags HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\EnableInetUnknownAuth HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\985B100B HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\ConfigMask HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\ConfigString HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\MVID HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\EvalationData HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\ILDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\NIDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\MissingDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
Write Keys
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4B\7F06864B\LanguageList
Delete Keys
Nothing to display
Mutexes
Global\CLR_CASOFF_MUTEX
Resolved APIs
advapi32.dll.RegOpenKeyExW advapi32.dll.RegQueryInfoKeyW advapi32.dll.RegEnumKeyExW advapi32.dll.RegEnumValueW advapi32.dll.RegCloseKey advapi32.dll.RegQueryValueExW kernel32.dll.FlsAlloc kernel32.dll.FlsFree kernel32.dll.FlsGetValue kernel32.dll.FlsSetValue kernel32.dll.InitializeCriticalSectionEx kernel32.dll.CreateEventExW kernel32.dll.CreateSemaphoreExW kernel32.dll.SetThreadStackGuarantee kernel32.dll.CreateThreadpoolTimer kernel32.dll.SetThreadpoolTimer kernel32.dll.WaitForThreadpoolTimerCallbacks kernel32.dll.CloseThreadpoolTimer kernel32.dll.CreateThreadpoolWait kernel32.dll.SetThreadpoolWait kernel32.dll.CloseThreadpoolWait kernel32.dll.FlushProcessWriteBuffers kernel32.dll.FreeLibraryWhenCallbackReturns kernel32.dll.GetCurrentProcessorNumber kernel32.dll.GetLogicalProcessorInformation kernel32.dll.CreateSymbolicLinkW kernel32.dll.EnumSystemLocalesEx kernel32.dll.CompareStringEx kernel32.dll.GetDateFormatEx kernel32.dll.GetLocaleInfoEx kernel32.dll.GetTimeFormatEx kernel32.dll.GetUserDefaultLocaleName kernel32.dll.IsValidLocaleName kernel32.dll.LCMapStringEx kernel32.dll.GetTickCount64 advapi32.dll.EventRegister mscoree.dll.#142 mscoreei.dll.RegisterShimImplCallback mscoreei.dll.OnShimDllMainCalled mscoreei.dll._CorExeMain shlwapi.dll.UrlIsW version.dll.GetFileVersionInfoSizeW version.dll.GetFileVersionInfoW version.dll.VerQueryValueW kernel32.dll.InitializeCriticalSectionAndSpinCount kernel32.dll.IsProcessorFeaturePresent msvcrt.dll._set_error_mode msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z kernel32.dll.FindActCtxSectionStringW kernel32.dll.GetSystemWindowsDirectoryW mscoree.dll.GetProcessExecutableHeap mscoreei.dll.GetProcessExecutableHeap mscorwks.dll._CorExeMain mscorwks.dll.GetCLRFunction advapi32.dll.RegisterTraceGuidsW advapi32.dll.UnregisterTraceGuids advapi32.dll.GetTraceLoggerHandle advapi32.dll.GetTraceEnableLevel advapi32.dll.GetTraceEnableFlags advapi32.dll.TraceEvent mscoree.dll.IEE mscoreei.dll.IEE mscorwks.dll.IEE mscoree.dll.GetStartupFlags mscoreei.dll.GetStartupFlags mscoree.dll.GetHostConfigurationFile mscoreei.dll.GetHostConfigurationFile mscoreei.dll.GetCORVersion mscoree.dll.GetCORSystemDirectory mscoreei.dll.GetCORSystemDirectory_RetAddr mscoreei.dll.CreateConfigStream ntdll.dll.RtlUnwind kernel32.dll.IsWow64Process advapi32.dll.AllocateAndInitializeSid advapi32.dll.OpenProcessToken advapi32.dll.GetTokenInformation advapi32.dll.InitializeAcl advapi32.dll.AddAccessAllowedAce advapi32.dll.FreeSid kernel32.dll.AddVectoredContinueHandler kernel32.dll.RemoveVectoredContinueHandler advapi32.dll.ConvertSidToStringSidW shell32.dll.SHGetFolderPathW kernel32.dll.GetWriteWatch kernel32.dll.ResetWriteWatch kernel32.dll.CreateMemoryResourceNotification kernel32.dll.QueryMemoryResourceNotification kernelbase.dll.InitializeCriticalSectionAndSpinCount kernel32.dll.ProcessIdToSessionId imm32.dll.ImmCreateContext imm32.dll.ImmDestroyContext imm32.dll.ImmNotifyIME imm32.dll.ImmAssociateContext imm32.dll.ImmReleaseContext imm32.dll.ImmGetContext imm32.dll.ImmGetCompositionStringA imm32.dll.ImmSetCompositionStringA imm32.dll.ImmGetCompositionStringW imm32.dll.ImmSetCompositionStringW imm32.dll.ImmSetCandidateWindow mscorsec.dll.GetPublisher mscoree.dll.CoInitializeEE mscoreei.dll.CoInitializeEE mscorwks.dll.CoInitializeEE wintrust.dll.WintrustCertificateTrust mscorsec.dll.CORPolicyEE wintrust.dll.SoftpubInitialize wintrust.dll.SoftpubLoadMessage wintrust.dll.SoftpubLoadSignature wintrust.dll.SoftpubCheckCert cryptsp.dll.CryptAcquireContextA wintrust.dll.CryptSIPPutSignedDataMsg wintrust.dll.CryptSIPGetSignedDataMsg imagehlp.dll.ImageGetCertificateData user32.dll.LoadStringW ncrypt.dll.BCryptOpenAlgorithmProvider bcryptprimitives.dll.GetHashInterface ncrypt.dll.BCryptGetProperty ncrypt.dll.BCryptCreateHash ncrypt.dll.BCryptHashData wintrust.dll.CryptSIPVerifyIndirectData bcrypt.dll.BCryptOpenAlgorithmProvider bcrypt.dll.BCryptGetProperty bcrypt.dll.BCryptCreateHash bcrypt.dll.BCryptHashData bcrypt.dll.BCryptFinishHash bcrypt.dll.BCryptDestroyHash bcrypt.dll.BCryptCloseAlgorithmProvider ncrypt.dll.BCryptFinishHash cryptsp.dll.CryptCreateHash cryptsp.dll.CryptSetHashParam cryptsp.dll.CryptVerifySignatureA cryptsp.dll.CryptDestroyKey cryptsp.dll.CryptDestroyHash ncrypt.dll.BCryptDestroyHash userenv.dll.GetUserProfileDirectoryW sechost.dll.ConvertSidToStringSidW sechost.dll.ConvertStringSidToSidW userenv.dll.RegisterGPNotification gpapi.dll.RegisterGPNotificationInternal sechost.dll.OpenSCManagerW sechost.dll.OpenServiceW sechost.dll.CloseServiceHandle sechost.dll.QueryServiceConfigW cryptsp.dll.CryptHashData bcryptprimitives.dll.GetAsymmetricEncryptionInterface ncrypt.dll.BCryptImportKeyPair ncrypt.dll.BCryptVerifySignature ncrypt.dll.BCryptDestroyKey cryptnet.dll.CertDllVerifyRevocation profapi.dll.#104 sensapi.dll.IsNetworkAlive rpcrt4.dll.RpcBindingFromStringBindingW rpcrt4.dll.RpcBindingSetAuthInfoExW rpcrt4.dll.NdrClientCall2 winhttp.dll.WinHttpOpen winhttp.dll.WinHttpSetTimeouts winhttp.dll.WinHttpSetOption winhttp.dll.WinHttpCrackUrl shlwapi.dll.StrCmpNW winhttp.dll.WinHttpConnect winhttp.dll.WinHttpOpenRequest winhttp.dll.WinHttpGetDefaultProxyConfiguration winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser winhttp.dll.WinHttpSendRequest ws2_32.dll.GetAddrInfoW ws2_32.dll.WSASocketW ws2_32.dll.#2 ws2_32.dll.#21 ws2_32.dll.#9 ws2_32.dll.WSAIoctl ws2_32.dll.FreeAddrInfoW ws2_32.dll.#6 ws2_32.dll.#5 ws2_32.dll.WSARecv ws2_32.dll.WSASend winhttp.dll.WinHttpReceiveResponse winhttp.dll.WinHttpQueryHeaders winhttp.dll.WinHttpQueryDataAvailable ws2_32.dll.#22 winhttp.dll.WinHttpReadData ws2_32.dll.#3 winhttp.dll.WinHttpCloseHandle rpcrt4.dll.RpcBindingFree cryptnet.dll.I_CryptNetGetConnectivity cryptnet.dll.CryptRetrieveObjectByUrlW setupapi.dll.SetupIterateCabinetW kernel32.dll.RegOpenKeyExW kernel32.dll.RegCloseKey cabinet.dll.#20 cabinet.dll.#22 cabinet.dll.#23 sechost.dll.QueryServiceConfigA sechost.dll.QueryServiceStatus rpcrt4.dll.RpcStringBindingComposeA rpcrt4.dll.RpcBindingFromStringBindingA rpcrt4.dll.RpcEpResolveBinding sechost.dll.LookupAccountSidLocalW sechost.dll.LookupAccountNameLocalW rpcrt4.dll.RpcStringFreeA wintrust.dll.SoftpubAuthenticode wintrust.dll.SoftpubCleanup ole32.dll.CoTaskMemAlloc cryptsp.dll.CryptReleaseContext mscoree.dll.CoUninitializeEE mscoreei.dll.CoUninitializeEE mscorwks.dll.CoUninitializeEE ole32.dll.CoTaskMemFree kernel32.dll.QueryActCtxW ole32.dll.CoInitializeEx cryptbase.dll.SystemFunction036 ole32.dll.CoGetContextToken kernel32.dll.GetFullPathNameW kernel32.dll.GetVersionExW advapi32.dll.CryptAcquireContextA advapi32.dll.CryptReleaseContext advapi32.dll.CryptCreateHash advapi32.dll.CryptDestroyHash advapi32.dll.CryptHashData advapi32.dll.CryptGetHashParam advapi32.dll.CryptImportKey advapi32.dll.CryptExportKey advapi32.dll.CryptGenKey advapi32.dll.CryptGetKeyParam advapi32.dll.CryptDestroyKey advapi32.dll.CryptVerifySignatureA advapi32.dll.CryptSignHashA advapi32.dll.CryptGetProvParam advapi32.dll.CryptGetUserKey advapi32.dll.CryptEnumProvidersA mscoree.dll.GetMetaDataInternalInterface mscoreei.dll.GetMetaDataInternalInterface mscorwks.dll.GetMetaDataInternalInterface mscorjit.dll.getJit ole32.dll.CoCreateGuid kernel32.dll.GetUserDefaultUILanguage mscoreei.dll.LoadLibraryShim culture.dll.ConvertLangIdToCultureName kernel32.dll.GetStdHandle kernel32.dll.CloseHandle kernel32.dll.DeleteFileW kernel32.dll.GetCurrentProcessId advapi32.dll.LookupPrivilegeValueW kernel32.dll.GetCurrentProcess advapi32.dll.AdjustTokenPrivileges kernel32.dll.OpenProcess psapi.dll.EnumProcessModules psapi.dll.GetModuleInformation psapi.dll.GetModuleBaseNameW psapi.dll.GetModuleFileNameExW kernel32.dll.lstrlen kernel32.dll.lstrlenW mscoree.dll.ND_RI4 mscoreei.dll.ND_RI4 kernel32.dll.SetErrorMode kernel32.dll.GetFileAttributesExW kernel32.dll.FindAtomW kernel32.dll.AddAtomW mscoree.dll.LoadLibraryShim gdiplus.dll.GdiplusStartup user32.dll.GetWindowInfo user32.dll.GetAncestor user32.dll.GetMonitorInfoA user32.dll.EnumDisplayMonitors user32.dll.EnumDisplayDevicesA gdi32.dll.ExtTextOutW gdi32.dll.GdiIsMetaPrintDC gdiplus.dll.GdipLoadImageFromStream windowscodecs.dll.DllGetClassObject kernel32.dll.WerRegisterMemoryBlock gdiplus.dll.GdipImageForceValidation gdiplus.dll.GdipGetImageType gdiplus.dll.GdipGetImageRawFormat gdiplus.dll.GdipGetImageWidth gdiplus.dll.GdipGetImageHeight gdiplus.dll.GdipGetImageEncodersSize kernel32.dll.LocalAlloc gdiplus.dll.GdipGetImageEncoders kernel32.dll.RtlMoveMemory kernel32.dll.LocalFree gdiplus.dll.GdipSaveImageToStream oleaut32.dll.#8 oleaut32.dll.#9 oleaut32.dll.#10 gdiplus.dll.GdipCreateBitmapFromStream gdiplus.dll.GdipBitmapLockBits gdiplus.dll.GdipBitmapUnlockBits kernel32.dll.GetProcAddress kernel32.dll.CreateProcessW ntdll.dll.NtAlertResumeThread kernel32.dll.SwitchToThread gdiplus.dll.GdipDisposeImage ntdll.dll.NtGetContextThread ntdll.dll.NtReadVirtualMemory ntdll.dll.NtSetContextThread ntdll.dll.NtWriteVirtualMemory kernel32.dll.VirtualAllocEx kernel32.dll.VirtualFreeEx kernel32.dll.VirtualProtectEx kernel32.dll.Wow64GetThreadContext kernel32.dll.Wow64SetThreadContext ntdll.dll.ZwUnmapViewOfSection kernel32.dll.DeleteAtom ole32.dll.CoUninitialize oleaut32.dll.#500 kernel32.dll.CreateActCtxW kernel32.dll.AddRefActCtx kernel32.dll.ReleaseActCtx kernel32.dll.ActivateActCtx kernel32.dll.DeactivateActCtx kernel32.dll.GetCurrentActCtx advapi32.dll.EventUnregister
Execute Commands
"C:\Users\Seven01\AppData\Local\Temp\PurchaseOrdersigned.exe"
Started Services
Nothing to display
Created Services
Nothing to display
Behavior analysis details | |||||
---|---|---|---|---|---|
Machine name | Machine label | Machine manager | Started | Ended | Duration |
Seven05b_64 | Seven05b_64 | VirtualBox | 2018-02-09 13:38:14 | 2018-02-09 13:41:08 | 174 |
9 HTTP Request(s) detected
http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt
- Hostname: cacerts.digicert.com
- IP Address: 104.16.240.184
- Port: 80
- Count: 1
GET /DigiCertAssuredIDRootCA.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- Hostname: www.download.windowsupdate.com
- IP Address: 93.184.221.240
- Port: 80
- Count: 2
GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1 Cache-Control: max-age = 86400 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: www.download.windowsupdate.com
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D
- Hostname: ocsp.digicert.com
- IP Address: 93.184.220.29
- Port: 80
- Count: 2
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com
http://ocsp.digicert.com/
- Hostname: ocsp.digicert.com
- IP Address: 93.184.220.29
- Port: 80
- Count: 4
POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/ocsp-request Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Content-Length: 83 Host: ocsp.digicert.com
http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl
- Hostname: crl4.digicert.com
- IP Address: 66.225.197.197
- Port: 80
- Count: 2
GET /DigiCertAssuredIDRootCA.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl4.digicert.com
http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl
- Hostname: crl3.digicert.com
- IP Address: 93.184.220.29
- Port: 80
- Count: 2
GET /DigiCertAssuredIDRootCA.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl3.digicert.com
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEATdwdwubyOrVguJJz1Doxw%3D
- Hostname: ocsp.digicert.com
- IP Address: 93.184.220.29
- Port: 80
- Count: 2
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEATdwdwubyOrVguJJz1Doxw%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com
http://crl3.digicert.com/sha2-assured-cs-g1.crl
- Hostname: crl3.digicert.com
- IP Address: 93.184.220.29
- Port: 80
- Count: 2
GET /sha2-assured-cs-g1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl3.digicert.com
http://crl4.digicert.com/sha2-assured-cs-g1.crl
- Hostname: crl4.digicert.com
- IP Address: 66.225.197.197
- Port: 80
- Count: 2
GET /sha2-assured-cs-g1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl4.digicert.com
#infosec #automation
TheSystem Itself @ 2018-02-09 13:39:20