MalScore
100/100
MalFamily
Malicious

jtforce_signed.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 26/68 Related 2690
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 594.67 KB (608944 bytes)
Compile time: 2017-04-29 04:12:53
MD5: 8796ec107b2edc3a02f94909f4404d99
SHA1: c92b6348f7e525b39c99ee0168b2d6719a9afb02
SHA256: e505734d48d6217bb7d09c68ae1724b15272613593e39621ed952d43f550abda
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 4 import resource relocation security
First submission: 2018-02-09 13:36:04
Last submission: 2018-02-09 17:04:23
Filename detected: - jtforce_signed.exe (2)
URL file hosting
hXXp://sepprod.com/jtforce_signed.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-02-07 01:42:07 [26/68] VirusTotal
PE Sections 2 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0x44c44 282112 cf77d7e1984bc7c13383e1aa80720087 9a4bcb5485603923dd472c2467077eee099c22c7
.rsrc 0x48000 0x4e34e 320512 b27e80f58de464af79ea087d03861063 c42332d2e81c7191aaa62840ba3085958b998e60
.reloc 0x98000 0xc 512 f2041c4143e31bba93005c95e2695863 cd10b48d36a615239a5b0d48b15f454a1daac636
PE Resources
Name Offset Size Language Sublanguage Data
RT_CURSOR 0x4accc 308 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_BITMAP 0x4aec0 108 LANG_ENGLISH SUBLANG_ENGLISH_UK
RT_ICON 0x95800 296 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_MENU 0x95928 180 LANG_ENGLISH SUBLANG_ENGLISH_UK
RT_GROUP_CURSOR 0x95a90 20 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x95d98 34 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_VERSION 0x95dbc 936 LANG_ENGLISH SUBLANG_ENGLISH_UK
RT_MANIFEST 0x96164 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
LegalCopyright: Copyright \xa9 2017. All rights reserved.
InternalName: Audacity
FileVersion: 2,2,1,0
CompanyName: Audacity Team
ProductVersion: 2,2,1,0
FileDescription: Audacity\xae Cross-Platform Sound Editor
LegalTrademarks: Audacity\xae is a registered trademark of Dominic Mazzoni.
Translation: 0x0409 0x04b0
OriginalFilename: Audacity.exe
ProductName: Audacity
XOR
No XOR informations found in this file.
Signature
MD5: 36ec60c75d7af70a65950184f2001837
SHA1: 565d2148fb6a069d13701dab41db01c9e928e07a
Block Size: 5296
Virtual Address: 603648
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Library
mscoree.dll
IP Found
No IP detected
URL(s)
http://repository.certum.pl/cscasha2.cer0
http://repository.certum.pl/ctnca.cer09
https://www.certum.pl/CPS0
http://repository.certum.pl/ctnca.cer0@
http://www.certum.pl/CPS0
http://subca.ocsp-certum.com01
http://crl.certum.pl/cscasha2.crl0q
http://cscasha2.ocsp-certum.com04
http://crl.certum.pl/ctnca.crl0k
Tile &Vertically
WXICON_SMALL_FLOPPY
WXICON_SMALL_DRIVE
is a registered trademark of Dominic Mazzoni.
InternalName
AUDACITYLOGO
Translation
&Arrange Icons
LegalCopyright
eecd9d11-500e-c828
&Cascade
&Window
Audacity Team
WXCURSOR_PRIGHT
VarFileInfo
Audacity.exe
WXCURSOR_CROSS
eecd9d11-500e-c821
WXICON_SMALL_FILE
ssPP
eecd9d11-500e-c816
eecd9d11-500e-c817
eecd9d11-500e-c814
eecd9d11-500e-c815
eecd9d11-500e-c812
eecd9d11-500e-c813
eecd9d11-500e-c810
eecd9d11-500e-c811
2d90650d-be67-c0
eecd9d11-500e-c818
eecd9d11-500e-c819
2,2,1,0
Tile &Horizontally
WXCURSOR_BULLSEYE
WXICON_SMALL_CLOSED_FOLDER
LegalTrademarks
ProductName
WXWINDOWMENU
CSQUERY
WXCURSOR_PENCIL
eecd9d11-500e-c838
eecd9d11-500e-c839
eecd9d11-500e-c830
eecd9d11-500e-c831
eecd9d11-500e-c832
eecd9d11-500e-c833
eecd9d11-500e-c834
eecd9d11-500e-c835
eecd9d11-500e-c836
eecd9d11-500e-c837
WXICON_SMALL_REMOVEABLE
eecd9d11-500e-c88
eecd9d11-500e-c89
eecd9d11-500e-c84
eecd9d11-500e-c85
eecd9d11-500e-c86
eecd9d11-500e-c87
eecd9d11-500e-c80
eecd9d11-500e-c81
eecd9d11-500e-c82
eecd9d11-500e-c83
VS_VERSION_INFO
040904b0
WXICON_SMALL_OPEN_FOLDER
Audacity
1s%P
WXICON_SMALL_COMPUTER
eecd9d11-500e-c829
CompanyName
eecd9d11-500e-c827
eecd9d11-500e-c826
eecd9d11-500e-c825
eecd9d11-500e-c824
eecd9d11-500e-c823
eecd9d11-500e-c822
bsJP2
eecd9d11-500e-c820
WXICON_SMALL_CDROM
2017. All rights reserved.
WXCURSOR_PLEFT
WXCURSOR_BLANK
WXCURSOR_HAND
eecd9d11-500e-c841
eecd9d11-500e-c840
eecd9d11-500e-c843
eecd9d11-500e-c842
eecd9d11-500e-c845
eecd9d11-500e-c844
WXCURSOR_PBRUSH
Cross-Platform Sound Editor
@@@@@@@@@@
StringFileInfo
WXCURSOR_ROLLER
Js2P
FileVersion
WXCURSOR_MAGNIFIER
&Next
Copyright
ProductVersion
WXICON_AAA
FileDescription
WXBITMAP_STD_COLOURS
OriginalFilename
&
i ~4-b.CF
Rybm
!y K
O??q
W~[8{
mC!
hU1t
IGHvB&
j-Q9 8<
Zpkx
|bde
'bPo
xmxw
FzJ
d*hn
=!5m
Qs8w
\HIM
PNG
>2
WsI6F
:+pq
jn/
Certum Certification Authority1$0"
r$:
m^ZobKKNRW\d
|!,F#
0JLm
hIt
O<SP
an<\3`
1a9q
Zihll{+|
<bXFg
KU#Wel
bM7(
"B7
hRCs
;A\gD
Eg!L
#I"F
=HnTKg
n oZ~
X!Jw
ResolveEventHandler
-Q`.;"
I+O
RR#.ROMPQRR
Certum Code Signing CA SHA20
2P!J
/TWEn
<
P,J{
wMUc
,+}u
K0yE1
d$l>
UUUUUU
{#^W
c;J@1
kJX@9
`[~~
:w;%
jO<N\
pe!
2#j/
, j"
mA9l
,#Me
9ujo
<PrivateImplementationDetails>
iWSA
/nw!_~h
{V9c
05M%
> y/zb
ig?
+Ofj
MarshalByRefObject
[bK>
O (J~S
fl7M
T~GZ]K
.:..
bF%Z
X x
7}]h
WwuR`
Y>mG
`
g<_Q
{-B G
Nh8%
`a\E
fC7@D
I6*#
+ud
`{CY
jsS RS
/p*CH
`gX
U[UU[[UU
lN0 $:J0
v|xN
YzDs
UXUU
@ u
?-+d
{Bnj}16
o NB=
D;N0
"~!G
YdPg
cPIlu=
0QzD^.!_
| V[
)fLg-
i1dKT
UUUU[UUUUUUUU
^gZ'$
cjDgA
g$x{4
9Y(({
*2)R`r
L(SO
JVB4Uz
1?' P
/ ~^D
;J <
~(g$
aTaTT
z0Opr
]XkY
32>%
377n
|Eq \
.cctor
S_^
1ip|
F$M*"
LOww
"_YSf
d #
OsT6C
.aRR
>s _
r[EB
jlU~
1{o|7&
jU9R
:2E}W
,sNC:
"WM%
http://crl.certum.pl/ctnca.crl0k
i:xJ
S52sW
tJ<z
oNuu
RuntimeFieldHandle
M[Vk
-;-D
!V]@
System.Security
HSEHHe
'`no
nk {2
Y O
> 0d
vvvv
[:5C
&SP
_/EX
mscorlib
|CK]Sl
=n b
TJS9
:.b*
A^A [
iwo8GT
xbG5zFm
DagP
Hfl<
/>U[
b)>Ko
D >J
270609113029Z0
Zo/_
YCu%"
D4XV
qOc.,
jaaaa
UUUUUUUUUUU
1X+:[
zm.1
"2-z
S]YGwu
rsxL
1|MU
?+g8
t qhd
3
( ["n
;HDKG?!
=:F;
(j .
ot-A
3ZFS
c^Rd'
~Z9M
,9TE
tj%Yxu
~#&n
c1B4
>YK`Du
EY1)
mzBm
***'))(*
SSQI1
)4UM5q.
!r k Q
"(T#u
rp]6
LV_}ZA,
Bikw
W4uypydprmux5\
]aCd
zA0x,
q\uW
6aY5
4b:L
9}'a
4SsE '9A
].{z
{ 7
*sO`
MFs
)7 Q
:3 *b
J9R(
NDBD
))^%
IME
<l W
t,F|%
M`|
lYRk6
^;-y
<NCb
AH7e
++!+!+!+++++++++3333333;3;;;;;EEy
*OOw
Rj"M
vklM
C9hA
HxuU
dz*a
U[[U[[UUUU[[U
0qsi}
n,$bP
^X.
x3 )]
] VZ
(]F`
/\- {
VWf:
`
/69293
~Rcp
eY"
171206153906Z0/
fKA}
+H7
<5k6
Ob^V
AppDomain
)"j*
,irU
PLTi
8l*f
t9^/
b? D
fJRz
@cg~l
!w k
)Tw2
4KFIDHN02
^ECmix
\ynE[>
<u"lu
get_CurrentDomain
r^ ,zn
i*6/
ww;E
@A0
+ t64
~*K@Z1
+#F
|6re
7 XB
$^
%e:8Mx
('p'
oy+[
^ww.s!
55%h
XoC=f
t<x
:%;r
}P};&
Wg.I}
"pD+l
u6Y-
%v;D
|vx&
tYy%
g`:QI)
mBhcP
; k
AssemblyTrademarkAttribute
wwwwxx
50b,
5T7!
mmHN
@ #m
c:OM
HG)6
G=qp
zgfC
% YY
#"_k
<4b{gg
C@on
@UFX
JP-i
{[x}r
*w%!
f&^c6
::P>
a"nUFF:
?)<&v
)Zpppp
(-Z*L
z#n[
=
qr!
(d5dSY
2Lll
=
Pv@"
```````
x|Qx$
0a|Z
^G K
3 $7\&
Y&@RV9
! y
-R| P
@O:x/
rnf1
FrBY
[@e@
gi' @
llW"
*%ui^J,p
eHHHH
T 6
RRRRRRRRRRRRRR
_evm
w[>LG>D2
dgS$
cOYX1
9';!
U2^
E#6i
gN}]
I:'v
26M"j
U(e_`
JlE>

Certum Certification Authority1
x}0/
[UU[U[U[UU[U[U
4P
VKY\\
UU[U[UU
AssemblyFileVersionAttribute
?EQ!
XSDj
&X6O
j6t'
aNKK
GtuQ
V.Z(
3dJj
mo A
>H1HH
,EQq
j@S!
q&m8.
VAoxy
/hG :
lf1Fh
C&5t
8O<;
H&@I
,`F&
hDX*
8:,f
53@BE=Z;
e%-K<
+_G<
#a 4
C;@4
L5]E[
_^R
+fp.}$
3-.&
0l{OY
oTda
e.Wb`
;.#?
BdI:
VpfQ
666v
wcyfx
OcH+
RM~
vs}
AS `
]Ha
y -4
y'Nh
MNn(
7Uq .b
(CEM
4V5S
7V 3L
;JCJ
N)s$*VC
ws
An~2;H
1@~eJ
GWl(
O =
o{[
{OhMP
(GXcqoooqc;
SR{
x.%f]
)X1d
]Br
nCaF
;:?3
}ss !`
Char
#%``
hn&`;h
m(tUK
py\c2
3[[+
?NN{
^H#@
5=/#
4kpF
=&A,
F{_LZ
F k
IM{q
)/C>
] g8
t/Rr
Or0 Go
xP|iw
mV(l
g=sF
...9.
L ZF
[\s!
[UUU
->F,
!xjWk
ESH;;y
h{&oC
zn[E=d
;jJi];
F Me
*%V 9
np$2
P/Ay
{<8s%
>g4j
q 4-
~f k
270530131043Z0w1 0
gVo`
{ z]
r!M4
$Ddv
Z 4/
lKMNu`Yc
JF!<
z^dzh
t;ufr
5-#S
'Vi>S7
"]$ Jt
9qMVV
/n -
\LTA
(:2
7ehCW
jaaajaTTTTBTBB
kWYZN59
V9B
5j[z ]
z#rUg
_CorExeMain
mj`f
z kp
rAC*UJ
S_RB
H=Gm
qFu2
Hc2'3
Y6E'|
@`K<_
h8>P
'y u
,QG\h
[[[[[A
f0kb
Afe50
Hsl4
qE7cKv]
s)>r
Of]~Fe?]
qmY4l
,GIdGud
*GZG9
#ME~
\3W
u'zw
xYCLDW
. r^
e;;;;;;
,p:aQ
E H
=kGi
<%=x
J&0zb~6
.w m
ON J>S$
.text
+3x
TTTTT
%KgnVK(y
Y bG
Pq3s
V jD
1Y6`
5U#m9'F
T{kc!TYQ
AM7!
t7c
Yvx3
c-D-
g[ M\
~f1u
TTTTB
k<aW
AHC3~ls
fc_@
"UUU
p 3mI
r%4 "
%R,>
< ]/
':>t
q+++++
QEhm
_x~{
q9@s
|yTuU
ILlj
'
%4GQ
b~{D
o`IwH
\erxO
j$b\
({^{
mQCg
I5W1
$P$O
E`y/

..IW
g^ <O
maja
Q;dxN
(ht9
& U
Q3QWW
n1tm,
WF:g
q'V!
7VvsB
OOOOO@
Nf@
oG|`
pWNgb
o$bRr!
N)W9
8@hz
1`````````````````````````````````````
V'PI
5KvH
Dzisp
Certum EV TSA SHA20
&ey $
Ghgc
<V Q
Load
QjF
"/w",
e\{~
C`5s
;7mb87
NRZM
UUU[UUUU[[[U
V{LJ
t Sb
-SU\
4c2uh
lKY>
f^2A
tIDAThC
9t
I>r x
na#
(rVl
1 k4?yC

= 8n
)[e>
U&%7
1[u
_i{.
@_5I
e0c0+
U=c*
c+GL
UT+]h
x~`$
~M.@
RuntimeTypeHandle
9k l
5P&k
].zf
EJA;
S2n:
0A9N
JaP o
5}te
i4$b7C6
F zy
Q L
~jE{
wWfTY
Vx+1]
<+]'
<1_an=\
X~11{
]nD!
%
w@h:
`.rsrc
EWu!
G0W3
U/rmW3
/o$;
$gV^
61y1fs
s'!:G
ty?bw
$kxt Fs .
OqYB
@AVw
]V7S
o0$K
(XQY
Tj C.
CE&S
~Ye!%
z:{B
,9=U
imoil-
9abj
U {Y
iLK+&
B@_<
k <#
%8/X
-;D7
yTTTS
^017
;b/
rnE(eY
N^}=
U1PC
i-#F=[
HN;4P
0}i`
Y9a|
8q:G
0~RZ{
2q,}
f}tXI
O#mTNR.
H4{A
?{t
O %%
b)K6
|)\$
b$ zK
CsuQ
+M!XY +
,0(xn
Zsw
!w z
UU[[U
{=Z1j
y%O$
+ 7s
UK\V
*cp$
a:FO+
lgC^B.f
ieHj
*t3
Kpm
yI|4Dw(1
4)*rQe
XQsK
X(}z
,-Z@
~CNG
`\.g
54
C$P @
u2t#t%t
w..]
FP2)w
uU-
u,Kf
VG"<
B4^`
vP|yn
d aaO
*"v
<0=6i
M k
*0<SQL?
qzzO
9
=,.*8}
C73Q
z2,6~
Zr o
IIDAT
P1m
]4$;
%w|C
k
l6`zW
20jPKQ
; w(aR !
o)yJ{
^w(k
x2Vvfv
<4,%
C |V
*w&VN
W0Fg
+fy.v
kKgA
fQm'
$95'_
\+f'
rXd]
(3WR
qx@0
bP _]
<K[
" ?
-izj
__-%
WhUp
lDoL
[g{H12N
:v(,
%R=
Ov[V
=[+7&
T^1uE
t|_A
vS,KI}a
U2+u%
z: D
|LR?
`-j5
+hez
~ z a
%WPMYP^69
9 ^
fDLo
>GJW
zn~$fiu
WCC&
,/q|
sldY
JbL
D-Sf
)JXV
g%w%
XOV j
;FT.
n98Q %
KBLT
S[/_
B,ue
x 7
e[Q[[[[e[ererrr|
V`u9

= %
T\>7J
nd)]S
U[qJ_U
v-E7d
F{Ca
reee[[
tiJj
^rO2
c4v3
}5^l
P}*5
EEqP
~L9#|
X?UD
trh<
E$qQ
c>;c.
VY +
oE=ae;ma
6D
get_Assembly
{"X
DC)e
dS'W
?SvA
nz C
Z M;
x14 `
)s,5
CW(
&0G{
A:+{
v< BSm:
KKN*
iEt*
,..3
HIHh3P0H
@wh}LI
k:)G
cSmA
+pbdh/
6>1&
uCrf
'z u
R } I
J~i z
_wYf
^v/\
x#>G
Q ;'
`r [Z
%Tu*
Yd=/
mrU^cj+
$0; d
sIDAThC
=bH2
7efd
B!Bze
>I!]
;8 r
U[[U
Append
*E~RX
*:Qi
.jd8&
(? e
]{j `
*i39j
;;;;;;;;;E;;E;;;;;;y;EEEEEEEEHEHSeSS
c]thv
Console
cA6UVB
5f $
Kz{Y8
jEK`
fSVP
qs_5
B!_w
X}m\
1Ik$
M_Jr
<~@&)
M0_Hu!
^icN|A
aaq4
zgkan&
:9a1
(3wzv
kh6IS
4 D.9
d^O
8uXI
#.\%Wf
\_mH
W 3|
kX__F
6[2>~
e&S
jS&0H
(k .
cAKj
0@U'
zi:5
\/
z^z8
3xXn
67cnn
)"zv
x@}3u
3<~
,Yhr6_b
IHDR
"[ "
AWT(
aBB1
x]Q
Vu%~'
<#pF
TC5$
N7Sh
b~nW
*******
gw?
{zlE
ofZ2
/ gL
j&mA
cZpd4
ppppx
G6Gz
K=/F
/(M3O
&*8l
S,jkXQ
&*8h
1|j;M
&*8j
N 5n
Af%Z
<PS:
@7 N
srO/
8r({
Fz!au
s,..
r=)n
{l@?
&?M @
@Jj
_W:~
<#\W
g0r*
6Q*x=
a6RkIhBFDGPR7\
yvL-,
:]V6
Ih^a
h)'Z
-jX:
_MWU
Y
33333+3
#}O+
35>8.
)H6K<
4w k
1O?Au
WNS
G+b:
w^t>
vw1X
IKp7
Lym(&
'sdw jb
KV)pDA
k!|n
#ofpu
____y
)AqP`
&mAW
?c<}
2+W(
Y#G9If1
#wj}
F5b'5t9Tr
]o|tO
}VM(h~/
[[[[U[[U
6r&>i
?-st?$
OFw=

QXQn
^]N
#Strings
wwxp
_____
)RRRRR(RRR
f=:)
uN;`
X4-J
<v<OW
C+~?dv
6w l
z%Pc#
I=64uLK+
~gXP
57RA
>0<0
g1(V
!s(Y
~U I
/"%h
.rmO
4,d^
f:LT
8f{7C
+p-&F
_w:E
nzVX
S3 r
"f4
y&D >
Yw
WoI &
yw_|
/v@O
$q?Y:
A0CT
mUYpjz2w
8A[Qt
Xxm(
-]Y'G
k!9fN
`9)J
9H A
L1 ->
1lNJc.
$l7O
E!O=
x!N
=
!s7 aK
,t
get_EntryPoint
EEEEE
mro%'
[UUUUU
-7{
)1*wi~
r'xD
};H$a
c> dj
jjjjjjmmm
JWH:D
Y
E$'HG
sGv
\rvSU
(qc|7
System
L-{
$U "[
&rJ9
dqCm
A4 $
O6}z
ORNB
gQ)k
+.u|
Hsyid
{Fr%
qVPdPR
~;;J
"R2jN
p.$s
k#[U
'L\
v:3XL
Wu$k
Hb0+
add_AssemblyResolve
s]U~~%:[{G
$59?83W[!e
+ )^
t^;
T9Z;
vQu U&!:\
\h{k
oc<\P(.
X[[UUUUUUXU
L-s:
f kk6
AssemblyDescriptionAttribute
q1@:S
`h{=
Q /(
h3mN
!})K
!pIM
+@ E
qvCo
DDD
|[h6
3 0i41
9uS|
%x/q
=
8$ %
qV:w
5eI\
! wB
}#f:
M[Go
2t1
[(<4
#;bA
'pAT
1@BN
$h~m
FPf`
S:&L
wU~I
+N,W0
Wc
bBgL/2
1R{}
I-wh
-)u,
_>8`
Mo`8O
!d [+
G ux
ky< Ha
*7ro[
LDa#
rrrreeee[
`%7=
[pg=~
w+lKc
jlBK
d.Y7O
S^ R^
System.Collections.Generic
.)s}
|RU|ql
kJ\[;
|n*V
SHSHS
@:<r
[V(1
K!BA
v#K8!
|9@"z}
vD4Q
zg16
yCJQc}%E@
[UUU[UU
s_+KrK
P}x
2H{hq
S/X\
+Bl=j
%3P
S9#7
N{f`
D 5>
vv x
)=0 G_:
A1 2
}_qP
~D`D
Yl@k|
J0<@
A<Ua
v6c4
3dbJ
Or-g
YrT
Z&L.
O=u+
!!m1
`#e<
jjjx
$/@*
N33
7
yr*w8N
T'o{
x-+"
,zQ$!
[U[UUU[[
v
^I.Hr
uRG(L
,Y),
HSSSSq
! :+ze
System.Runtime.InteropServices
.csF
u4:n
0!0
?OgI
Nk"8
` &s
U<S>
\ G
>~u
5F~|
Bt\2
{P0T
\} Nn
3{yr
@]v]q
!] o-O
**********
"Q____
7VW]
WF<Ci

%GH.
5\D\
,jNu
0FSS
Yzs<
w%n~c:
;l
`C;v
Y ,L
iacM0
!wik3
G?Gx
yR@
e52=
kPGl@x
T[j
95ziEVs
|1%k
Rgdp
- @k
=7!p
4>\BV(
1H N
~u=n
F]W6
r< C
V&|*
ZjJF
+!x)
^YBJ"
+\>/
Oo^}r
%0->
O '
B1_F
KrI
"GB&
qiMWg#
0n<H
Do>7
L:NO
K0{/
LI!\@"
Bf6=
h-}>
K `iz
E z
Sg "
r5f"
o0<a
9=,ur
#h?G
!FeyH=
`#:P
8b
[ rx
3} r
+cVL
cjSe<h
frL7
vv xyxy
).oKQ
|*.RY
7LY &
&0$Y
>AT6h
MH? r
iY@HC
%& o
;u !
E Q
JYJu
|+~C
vra D
I6 Gc
IfFc
E!0>@
@~fh
dVA0
151029113029Z
H `
/ TA
$]8x
X Zn
lg?9
*UpW
BWw
|r|rr||r
+ZB:
4&,
u)
?`og
Rt0$
-sr@
Aqrg
6f?bl
HFJ&
AssemblyCompanyAttribute
5 %X
q`j3
u.Z94
|% a
Sch8[
RunInstallerAttribute
pXc)
KQLM
XTz
whIjz
oIDAThC
XtKp

jg`m/
(zd
Q*jnS
>~wol
*E'2
MethodBase
_?}
@N2t
)c'}
& A
g#&|"
{ SU
HM m
)Pzu
jxjm
|'~R
~fAD
^jJ
jw&4
4]CN~2
MHW@
dkK
7rgo
oc"B`c
at
t"VR
2- $
{oFF
_}|
k`}AH
Byte
mV?~
~$MQ
Wr:$
ggui
1E|^
Y:*8[
_U3-
aF0%
0'0%
SlSx
78.Xh
QQ+KS}
! `
l?
xvS
VvG]
_iow
ld$Fe
,2y*K
0yM'
Y -@
1 t8
,s11
?s P
|{xp
~E3b
sA(
vnW&w
)nxxxx
PU4cG
%jCu
&1#l
V |H&dv
IEvidenceFactory
l;6dP
sP2e
x?u_5
l P
+]Ss?>
%UUU
" X
fnkXO
v/?k
^Bx|
t(dBB
ValueType
I, '
`rH$
'':[
tI8~2
GuidAttribute
^q=@Hr
* DFt
B^ {
;qpU~
$0`6G
Dpdx+
J@YSs
Q{:Kgi"|5
9&xd
1ebd
9 1p
Unizeto Technologies S.A.1'0%
dlN\
/m K
p<]upQ
Project1.exe
G dI
Sh2
>oR!
I0Uw
O"zH?N
~p-{+p
a um hs
/{*O
aF?9!<
G3C-*
?`59OI
&`z:
l
U+{6m
Ho V
s`%>Y
C"(*Bt
/E+zW
}7~X
HHHHHS
5Pq$?
0zqB
6Q6fmn
System.Runtime.Remoting
}Y&;E
b,KPpC
Fu3h
mY ]
![E;
{!tO5
8{La
=.!E
/]'|
}O_Mi
Zu/_
@^7L&
E;&)
Hv? I]
fYawE
IEquatable`1
ToArray
@OIb
jVVB
<K7zfU
m)SA
Hjhq
@4Sn
s`mx\dt!5
T oj
SuppressIldasmAttribute
%http://repository.certum.pl/ctnca.cer09
s;<:
r9E~
K]i\j
%wdWP;
G&k4
ixlh7
q *I
um;/
!v p
%w e
gX5`
F5j
KQP2
zVC2
+uP2;
8DJn
]sTm
%:Q%C
emP:i
>a7s
X{G&w
.0Q5
pIDAThC
)`~ER
hcm=
d~ `_:
jTTjTBBBB
ToString
..BY
MOTXSXV'lB
<Ag1
=d~ /
rsOF
:,/f
a~<#?i
E$x
#r''uy
=8@k
Enumerable
^ fA4b3:
b\Za\
|v`E
P2{TY
Ig36n yNe_&
d"V@@7G
8Krm
Ur?0@
U[UU
0&XoLT
(?Xq
h:oa>+
"2|{
Qy%4
/0o
%
5~q >
VFypB
p^ #
ServiceBase
ObDm
PL1"0
MKjA@
@TxO
ddDG
| T(
F~Xzwh
/dLN
:*u\
,Nom)
_ IA
:Jo g
j<
s=;i.
|VOso
!w kG
WRS2
:JRK
x%G98
Certum Trusted Network CA0
0c`e[CJ
R7;f
Rr*I
!{0l
f=_cQ
U%)5
_'v
cvg-
[>p{
`\t@+
W%Z
Q0 F
AssemblyTitleAttribute
A
h4{~c
'pNV
,
g
j~5O
iJUC
vvv y
"DVEb
CEkz$
ow~ k
?V*^
1:|
px I
A0#oA_
TZX|x
<yX_
e`Y^KL!
qPVSG
8
p}7?
Np",
K5L},
9} 7$
F*AN
w4/c
;;;;;;
mG#/)
9} k0
7MlO
[=C)
X"nM
h/N"3
(/:D
H+ K
!v -
hW\~#
>uCL
{HD
[ Y2
:OL)!
d ur
ctjH2
`xqpw#
9#%?
jgoj
gK%&
aaaaa
p<h?
<r#%4
[q<C
8,~G
R*?R
Q[+a
}!>*
wiqrA
~U-ru
:EhY
tHPg
D)[6
mRH"76
^q
UUX[U
lFC^pQ!
Ot!/sC!
;'JT
=_=]A
@W_sm;
Fr?Gr+Uf
9 N5
RN~
Data
[UUUU
v^1
J\;2
`w*}UBk
]e2 D!
)y>$
@#8d
4td*]
8d
w_N+
OUf
S(8
s"$S"f
X4 &
8rd?SS7
`gNx1
IxO:=
exE&
eHb%
mdU KA
~C]H
M&H
pHYs
|3Jv5
wDu2
toA
```````````````````````````````````BJ[U][V\``=````
e'Bs
yHH\
1xz
HKJIH
!qrt
I3f!
_1&"
#8qB
get_Message
Container
=
5@x
F F {
xpxx
e=
;+G;
_dK!bt
=-gm
sgX]g
)w1Vj
P}nJ
plHf
Ld"WO
Y]T^
5G}&
[,4y
imw=m:
K4lG!
mr'Oo
urUS
u,G|
i!OA
+:m
1TTq4
disposing
R=ch
@L"z[D
x^k
Ho(>
mTe
V 8/
-\Fr
&3kS0
I~p,
xxxxxy
H?65
r/^u8-
z#=sm
dJ%<
ybfs
3z&~=
plH3
I[aKy
V4mh-
7F<=
2#ut\
T8*l
I4lK!D
GYSf
M%{|HuK$
`L||
ren0
InvalidOperationException
='1$
qlr|
``
c'`M
sWuA
*;N&
t$3`
[3UX kE
gfBP
aQ qE
;v(Q
WTuu
DLf/w
p@x:
6qSk
7~"E9
c9;o
%AG\
=#hE
6;|Q
]9iL'/nKE
s:\$ bP
160308131043Z
Ir>"
+0)0'
hN 8
q2RnI
8p&r
zlN
zAA!l
GAO"
a#8n
^(}.
Y %
zWcfS
@.reloc
mh
hd +
gq^g
6-">
mZQ$G
Hs:1
;> 9
U[UUUUUUU[U[UUU
Z(8E
RW>
M s`B
%B?
$t :
\;K"
(J1&
I]K!
p k
A9_"Q1
&@Ua*
=U -Y!dt
Q{i 3
cgMK
;|=~n
3CN8
k\Ts
8/vm
?\2c${
D|oz
eg[I
8m26
mIDAThC
aM* 'tK]?
U+9W?Aci
~P.vE
x{c
8nL
`1wQ
\_~hoL
wS2N
_&t
(N} ({
]1gZ
~jm{e
.DDh
JIjAM$r
5
>'"<
Nh(U4
\co7
su^$
vf,Y
+ROg{
n)!r
_Ci?
mPql
)*ZC+x
(;RA
-n/9M{
+nx'
Kp# A
j_BY
[C?Z
.ctor
"6$9
TR!M
1etkbhg
U!Y-#
Z[ik
_oQ
0o/b0T=#a
Y.cc
<
3BCj
V wB=
()x8
`i|ntwQ
vnyL
XhW
9A^G
5 z91
c1Go
\h;J^6
{d?(U
cn.aee
`7t;
C1k98
[sV
FZ>G
D|:0XW6
E)S_E
90705
%d$3F
7/p7
i|e/
NDQi
'x5@Z
!w k
3bO x
RZ*M
^bH
UE|0Uk4
h ^5f
LLcLPYVY~^jp
//55
Project1.Controls
9l"pLT
aO FS
DDDDDD@
(xJ<r
3 M'
}3%l
2fu}
>R`$X
DDDDD@
YF;M
)l!w
J~xK,
r|_w
d+cD
\ a]
rnUW
4F873A0CBD3C31E7FC18409F879DD9377F7C3086
D0B0
Okbs
3MrY*w
nPY}
#JJUV
get_FullName
ZgP4
L@z9Pd
s s|J
8IwM
'Wf>
~ Oe
0%U[w
JH1c
vsM>
- }
Z2iW
````````
E;;;;H
_SnYp
2{;;
m:$,
HL-u
7|{pygk[
&9|;N
O %
RuntimeCompatibilityAttribute
.oMa
(5Mb
P8c`
/jT>
"$F E.U&@
A*+/
G)kD
lb:B
_8Z8\8
+dr%RvI
JbK=^
Assembly
D]l}#
9 p4'b
r\
Z@s&
U[[[U
Copyright
V |N
V l .
E>2U
9'y&
{_d8
SZ<2
vV[Nl
kL]S
M@-6
fD,U
4GU5
'1v_
!@p@Jg
M;EPw^
cGD*
\ ss!
!exA>I
\fE:
[[[UXU[U
4 \!
.|(|)
7 #Y
u-~r
aTaaajx
=$CR
" {5
6-_V
ZUgIOy@5
ZChOs-f
dB$P/
IA>5w
\W>RUq
[UU[U
7tDF<
C]SuO
7kUZ
]x f
"6.Yg
H#q-
<g+U
K"5 B
RZ]m
M ]l
G$}W:
%http://repository.certum.pl/ctnca.cer0@
=AyA
E tR%
ah**
! k
By[v
>Xa%
1 0
^cYV
Z{WI`
.|~V
H5 NO
S>~,
a!#nL
gD
K$f)Uc
=3w{
?*Vr
9ma
p qp
y_p__
Mxc~_
`<Z5
http://cscasha2.ocsp-certum.com04
|~MA
ADBnZ
f :e
CF4
&noYY
_$L25
_v,L
gk6@x
iS=[|TQ
m.8cV
;r|u
s* o
171006055510Z
Qq>_
EmzV
0'A]
loxY
m(Nu
'@nc
Gj'e[
CVFU
qp:cI
https://www.certum.pl/CPS0
nz (<
b~Ef
"3;vlG
IContainer
.36*n
u Xoe
q7OEhO
!.\8g?
6jTn
g4*n
2sa|
1R\ZC
DDD@
FqM 9
GtBHq
0} dM9
u} -g
/'
8tLfFh>
urf8
!- P
jO.0~cC
IwGo
I}
;gw;O
j 5X
O3W
%%%
[v6
/k=T
C.0R
v
N(da
O/.
=Ar3Wj
&-p4
DW3H7gi4r
LI@+
u8?a
^g41
ISerializable
"p~N
j }e
m:hWd)R
E, 3=
f7%9
' +~
ZQ)_
;~C&-5
`````````#
uo0-
EXs+
'G]
Z$32
`~y~
QR;T
a>%@z;
-Z/jT
oha4
bxnC
^L!1
t/DM
PMfz[
e'v.
i k
0idu.|;Bx
zK@R
,ZKQ]^
Z<I|
.~nN
`Z&v
mfMS
)7kg
P,@K
;gV-(
37#N
.k6
tLn6
|5Zr@kE
\u]7_
v<]$
lcZy
!u k
~mSC
u Y
;(
=
gnns
]*&<
.9urj
.L&
SY>g
http://www.certum.pl/CPS0
%'Uz
OZl
U~U]
RPWK
_dIa6
OHp
z),$M
?j+x5
w(O 4
eyVqK
,x4.
)KU0
:Y9>
eN,@F6
>{^
ET.N
{ o6
! 1
+M'2
y 5(|@
q__ey
LW,XQ!
K]jGT
\ );
E9 z
ContainerControl
#}QJ
^M_a
{/>sT
~vw+V+
!L(/
t*2
i41^
n'*o
?TUE~k
Spr <m(
GU0C
v"A]
m##
H{cx
7} i
^|Q|^
"^56
XQBJ<
s(U1
Gzo
wUUZV
M-zZ
$B \33l
CD\(
t$*MV
BhmE
"N]2
I;A(bZI
4a&
3~ 7X
Oz$\
g;iq
aZv-
a 9x
@y;+ms
=uFi.;
v%9D
hj*f
5+:p
Pe a
ukHL
aG0Z
B yd
NEp>
2[qH
<3mc
=Oc
_ gayI
&^<9%
_&Lg
!eSe"
= Uq
V1*J
yoMN:
U[[[[
@vab
gALLl
G{q*
Edx|!
m W@
Xw[U
w8 w
r9Uj
r@ B~s
VT9
jz5F
UkPk
j39g_
E; ^
7M?Ko
cOcMN
AssemblyCopyrightAttribute
0%QZ
_C1p
^ cT
PhN"
4>=,
\Q(H
kmO7|
Project1
9^ D
|tn1
,;_8
Pe S
kzI3V
c323
Y 8<
-2Rt
w;mn
iDSc&
R%qN
?wp7!
jjtZ
et(;B_')
_0]0(
p' Q
j=EqHv39
7Ux@L
> |gm_
~ kc
"v ?
^QN#
''].
jf HH
%8\b
Z+ZF
;Y^_ B
feD
uNRT
Yn7\
D~[
mY}I
r&_P
E~v
g _if
DDDD@
,.=AU^
|;"(
.@(NB
#/bLz
RVL'
y Zv
RuntimeHelpers
1^%
7_JQ Bk#n@Q1
I^$mK
Y 8q
sr-M
X:2&
1%76
W7|+
.VVn
||rrrrr
d[@3
iZ)~
0{5]\
Of=|D+A
<Module>
Y 8d
1n
Type
*E.zS
%w k
12/_
)] J
`6Mb
''H{
e7[T
vXG|d9.R
"ehx;i.
O# I
?wU6
5~[g
5_X2
qi-4e|
v+v{
8q={sd
D!ta
xPV?
[e/l%
,y$}
pH y*9
%**&
4A u
a'P~
zI+oP
_ b3
O~aGSr
*UUU
}ssi
m{g~
a vw
Z<1$
] }V?
*E4zZ
p]az'
-H {
= e{
'U ?
km3:8
++k
N&uU
}!ST
g k
c*lN
3Kro
q+dge
/#4T
CSZ?
_a~u
&KVB
k+ [
MQ|k
uYQ{
~Om6,
,y$D
9wdlK
,o #N
J/cj
^vSt
gr
cM/K
JbacV
l;HS
-@m`
ui<EoZ
mpii)
hI;0
n9f~
#yy08
!9JX
MSx9
!, k
o$ME
(lM{
%EC"(
#p[c
8I?H
_ 8>
x[|w
U[A`
KtG
a\ @
W_Gw#L
h]"v 7{=
q$-6)
&~SX}
xxwx
JMQv
@yYk^
wBEcq
Paul Licameli1&0$
,+T)n <f
5u8$
CE1N
gAMA
H"F0&
^mYJB
#WG
Oh!-^?=
':Me
k@?2
@]F3
[m.L
PSaT
****
/:,$Ko
^b$l
> PJ
bK sX
&;7fv
(Bsm
~OB#%
9~'U
671.
eG4d
ggb^Y~YcPPPPVVYY^bbg
'ljD{A
$/1
O3T
C#./
]fB{8
$~zG
`y.C
A.@.d
<4O
9&Wx
d( 2
kN]
bsH?
[t+;
<WKuH
hN&}
"Z_TTSySSSSHqHHHE
E?c*
M}^]z
cCv(
Nd5i +L|{S
yx2e2
1dXg!
eU&I j|
]y{)
)SNNOPY57
YS/1
5 b2
;;;;;
F/_V
ZB=
h=d8\
((.T
^C)n
T@My" ^
iYMH
Iv>^
yZyk
cg ;L
9*<*
i}W|
9'fZ
d\S`
^{fi+
H-(<
:Da<
}c*f
'T "kK
#>7Uh
'c_5
'OLTZ+
)>$b
aTaaj
~N\6
y t_
ti^? YR6F7
q# eU
Bj1/
WMEz
5^Tv
thmn
u7'A
Guid
$}@
o-D
|Ep,
Y8s8'sFL
wW'W6k
Na\?Y
TTTTTBBBB
C'P
T)2d
PJdR
ObjectHandle
{?u&'S
P:R,
6.7s
.2\W
X| U
?xy0
'U!P
xmmx
_2VN
wWHB
qKvb ]
J;/Z
F* |
3_" ~
System.Reflection
WpTfx
9&sR
OBV0)KS
w?EK
c&:.
Xd Ff`?l#
!'ym
AHkl
} t
WrapNonExceptionThrows
?~u
=h1A7
^IkB
`rFAw
F%7p
Paul Licameli1
Zt5JRq
ju I
;2d A%
2V[[
GQ?M
p/7K
j+ @
*FJv
wt!33
i^<m`
.tDe
x:X
fiDi'
L$9N
r!sB&
7<?=
Paa
eSNGoJzm
,)fI
Bb_Y9
Y 3%
WAE1'<
qOQa=
26?*
ca9vO
\Vc\
] OPBA:
e]iC
(0&0$
*t ,F
5}$?
t?]cWF
)kP1
Y DF
EaaD
2h>J
:f9"P
3{E$
] D(?b
& 0"
System.ServiceProcess
}-5
^^%j
= .
Incarcator
3"~2
tIvC
]yW
ng\
@ 0m
K\0tc!F
0g
!!I4
3333333+++++E
[UUUUUUU
?b X
wY_?S
9:M{0,v
Djv'
MqFYW0
!!!
r[Mj
M%_=h+
u1%|
>K3@,T
*C&}W
8zCa
{|k[
:~L=,
4j@lP=
,6qN
`(7
p$ OZ
:I.KT
*CpfW
#@<'
\j.>
,xg8_U
2000.
uYRSU=
j?-/!
</<
qJ\
CcD0*X
q:OO3
`uji
Iq6W
J}uF
[#PO
,q{r
),],5
q;2:
k+ :
i$[p
=an
U)^H8
-9 `
-t7M
x4^P=
3[^b
n ;cM
P1bcn<
kWn m;
hv;bD
/hF
-pqM
+tEbEs
I+{r
VyQ/{
set_AutoScaleMode
^.|^
q`~=
.0{{
!CJ8
MwL3
Ydr}
aaaaaajaajajaj
ZR1j
BSJB
)So*d
8TI:
}Mo
I8? +
<Z,&
N1 :G`F
ZP]:Q
0&0$
cU,W
Ao^AnnS
[U[UUUUUU
*Kb
bcww
xxxx
A" _
N Q1
$<v?
,; x
Kbuo8
>0_)
`I@ 3ZO
jN &Hg
E^Gm
x7X}
DjOK
[Ao
U B2Z#
wcG@
!;&
System.Configuration.Install
)X?2
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
rSyl
I9C\
9D;+
|Yu~o
hJ2
wQ b
w|t/
&l Q
D:M<
&nH
[-e6t
X)ky}
>4V,
V14HIP
rP?Wk
x2$XM
xOP-
; Fu
z kk
Fgp.
z.iPl
] -u
*D+lF
#J|<g
!This program cannot be run in DOS mode. $
*i n
m`'h
*bOz
I}.Re
-#'%"##s
}6In
0 o+*
axXn2>
}* 5-5
))Yw
_}@e
a\VpT
e%,m
]5)-t
.[uQ
:lCC
_.h;
;^^&
Dispose
%3
]]e;
\ }(
mdzn
(cJFp4R
AUS"
1r[<o
^MQ
<|8
RRRR
\Lw&
:nY/
#3F=
=Cf
Do}\
;z t Y
:ZH
n#
6]%`W
tv}f
2RRr
I7"g
`~62
wm~
Z`/\
4VVn^
@TSd<)
~-HQx
t|Srx
`
.^R]
lF{
Kx[t
hh$:
I% '=vZi
m +M
$WVt
:_jN
8J
VWx_
`lN*
TTT_
x+N3
<P?)
H ZcO
=
lz.Q
bmm#t
Y0F{D
w k n
n'oa
8Y
&i|\
xxxxxxxx
>{L
rIDAThC
- JQ
9G<F
+EK}
"0!E
M0_A
<w@0Q
2X?N
WVG`}
| J}
vvvvvvvvvvvvv
=3+|y4N
M j
UU[UU
?#ym
.qCP
O:EG
d>tF
mZNk
PDe)
hbhv
!w s
+Z01t96
RZi.|
< =&%L
;iwh
zRk7i_
Mvd
Q"XR
%%;E"
?oR2
G`(BlQ
&eXN
oW kn
xfpOk
?{R
t5|Is
S14#
=#%
noq8
%<}!
^\yo
Pj^[
13".
WE!P
i8/>
M5lP3
w5ve
+/v
,'Z)"g!
{!X
Ohav
9 h\
G?/
VD5N
W3=m)
$v&QG*t=
lIDAThC
\TgS
pm%0
'f#WUZ
=2YN
9?N^
p___
JB['
sgam
0@1?d
X ^E
BZhg
_^'w|C
`'c3-
<
zk -
BH(am=u
t2*D
U?hl
5QA~[
5 #Y
NX./[
b~f2
p__y
AUAa
|J#b
aEY f@
3qa'
M6 ;q
OJF.
'U0@
gwU9,
b]E!
MGOu
T*"N
w k
p 6L
33;3;;E
3i" %
om @
5c7I
:98%
>&X&
FJeB
@~h\q
xJ@KuP
*1K/G
b\Qv
n
Hjvp
8b4,
VnK|a
$!U<#
G-A{
}(#$
i~vq
(BJPn
%qV@
6SG|$
zh-[
g9oF
@d&
`W)C<upGW
S6KQ
@%-W
5
System.Linq
l XKy
.h|&
2K[
p"@i
~uqa
Y[?[
+,2HAy
4B:=@7
%+3L
LLMb
I zA
a\)D
1wX l^gm
,\oO
iF{~mP
7%H\
U0"@@
o ;|X
#w jZE[
qCgs/
hu-4
'1j O
Q/9M
_Dkh657
ToyU
y]/
)E=D
jm/v
wlHe
CXR<m
OU=a
<Up~63
OVYa
]Pk`
%'Yg
u&9H/
; 0d
SZ:Y
^hu!x
y!h! [
h%`0
af)\
39%4\
PUd
N|2LB
P7'f
&L|*n
$,-t
Ei!yi4R
^M qG
tkFW
f-1{
j6(h
?"k[
p;PW-
Baay
^E3)DE
d%~.
\C/9r?@~
i>Z6
QBVr%
!J]z
)jJ"
4:"[lD#
EF*o!
W-5S
cqa
ML%|
d'~
3_ZLS]]/(
i7j6
& d
?C =
CUKD
TDlz9
T.D-k
:Gy"
n%# H
w[I:
UUU[
x7fUL
^;
T3yTT
S}sR
duA=<
qdL i
___p
=#``
=#`a
o}}*0
h};J
^\^^6
u@0
R6A3
;m8z
"KQz
d'~$
jIDAThC
$EG?ACG-,
DDDD
8 `)
$2x;U
Mw;l
OK&
[U w
oo?B
|CX=
!@J-=
vj :Y`
L(HS
{|ju
a8p_&
1 *x
%%%
c]Qx
8{vw
: `DX
9k!G
0; m:
;O.Z
p:>XMb_Lbc
)wse
R12T
bT3:
3{ej
vv*Lab
SA3%
]WT6G|
FfA'
b"3
i'I%
i 8K
``````
8RO^
yV6=
{rSu
9{ \>
MYyg
PXC
y2%q
R\A#K4
(l)y
E0,Q
j+<
f)rk
cG[=
AOi4
1#f(
($`J
I,f^
y2.Ke
\hKZ&
1*Uf
}{M&
== j
.\VX
h
qNVb
)A9?sb
Fz18
q:m.
>G|
* Hu
4@s]
I^xrn
d| r
MPmP-
}W70
hUC{
IdiL
,e8`
}pP]>i
HEEEEESEEEEEEeEHEEE
#~Os8
geKp
pu$T
Uun*
nFHJI7"
@s?v
3$#rk%
;UTn
~\bw
g2L`r
[[X[U[[
<G;5zH
NPK#
$bO&
ql1k
K%% {
b#]}
9I:uboR
A{My
ResolveEventArgs
NxL>
z.Q"
.WR0dCI
System.Core
+4 E
lvL0
O )
x`D?=
/ vw*
'd4=[
$)M$
Zh-Q
4HHJw3j
GrX
w l
"9R>$y!
p"liv
"J#^
\m!j:0 U-
Certum Code Signing CA SHA2
"r"
Invoke
(FQr
LW_n
`f)
sshEk
^/wsxrrttqy}3S
IDATx
M}5
)%-!
Zle
N-+<
!De3
t>.V
bhBu
[xn1
}/fPon
d<qj
^+*>
?R1|p}
k\a:Y
aw|*
y-7W
a+E
{-kF
3
HWKi
BYMT
~=&E.I
_D!1
Y)yz
od~o
! <2
yTTTT
l[sd
w%N)
"?6TA
jTjTaTTTTTTTTaTaaaaaajjjjjmm
6y0/
!!"
X]F 1F
!*q
i=V2
IEND
|kX[Q.
Bwxk[
XOA8UHL
HrT9
8 {6
ao\`[
;```````
/31i
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD8$+
MYJ"
rc*;
,MGC
k9cq
<BG~
~Ls`
>BXM
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
SSTTe
:U'
R{^>Z
EEEE
y>$M3
=2PCJ
"&9K
o|6N
,a2 &U
X8cu
#0000#
eRM
i<:X
6@/
u oxC
E04C76D90E657BA0402F9D572DE08F8C086C724E
%1"G:
9s.nL}
wxHW/
=/c{
='<I4
3^BFt
IzL0
rLZ!,
0Cx-
M[!E
%Bj%6
>w a~
!!!!
gqh*
G2!=
C#`~n
MQ;G
qjrs!T
TSST
z&P*
R(x/
w'y)
$D'9}m
!http://crl.certum.pl/cscasha2.crl0q
)(<R
f*nn
dqQm- *
UU[U
L!('(
`n}!
Somerville1
i=w>_
M~8V
%fv
uk0g
E+!!+!q+!++++++3+33333
!14(
)S1= |
``RQXT``1!`````
VhOp^
p0IQ
|aw3
"=VL>
v
-[:H7
vUPl
!2x+
$]8sQ
Muwy.
U c
Concat
-NDE2
StLD
/pb8
Ctu}C
't[)`
>Y:z
e=:)
LwY.
So\U
fwG =

4'3LJ
/n 5
0=$/9).]RE
.p\

qe*e
P3M63
&LRI
Nd-
B0g.
'v +
LXdYpwg
slk?
Wr-^~
90}j
n_(-
u.I'
:!'VJu*c
"7 C
N Y
mPy[}
Wb|N>}K
DL2 8
}gT|
)|xx
B$7mlX
GX;Q'dUs'
*p3
UUU
-hq4
%QbI
95bj
.9FX
AGdD8
Xeo=7d
s`gk
3xr.
^TGte?
f &C
X$n=\
8L0H
abS&
yK2&
^weL
vMrn
~'/O(
d%}o
g/o}
T6):
DH,xQ
f2',
j `^E
HNAm
`Vzt6"
lba&}
SJzG(
EEEEEE
W,-+
l!8TY
wwww
664T
FEkz
$Z I>eND
Cet.
1 F{
2=?^T
U;m&4
wwwx
vj,qB
`v%_~f
!=MC
D[n@
m A0
System.Text
33333
#h Z
M 3]'
l<Pa
`$Gj
4v #!C
$#&%
7KGw
8nfV
H! ]
Swmkc
\~}D`5&
SSSS
Df1K
_!'^
93P (
?^ N
Pu#'
-UB!m#
$s=c&
}oI;F
*~o
/y l
/{r \
,$_?Dg
oaAG
26&Ta
v m
tX-]
q'SJ
^*V
z$-`
FQ;R
PM%s
^.PK
_yHl
E`k`
CLME
4rn`
% z?
$ZR_
'H $
Tm3K
nr7Hai
`zFN
*[?!
JL$$
Ai 8
?vW"
uL8h
/*~y6a
>BWg
!dAg
Certum Trusted Network CA
YLTf
5u&?t
H 6b
OGN"{
uyHC
/wq^
g_^~q
(S8g R
COGH
eq3K
[4.
~Drd
)=;`
[5~-
xY/Qv
@46{
)&I\
4w j 3
<=P
#Qc,
X.Sj
'BisN
g;`cc
"o"Kw
]@ ?
F `S
mJ?C
-O&@
= 3
wwwwx
e333q33333333333333333;3;;;;;;;EEEEEEy
ce<n
S}G4.
mr:M
9IkjL
~eCv
^`(Mq
DxG%
wwwww
%oZ%
i>O4
uZNu
U(9C
paUc
IiqG
v8~@
R|).^
l?nl*
RRR'RRRRRR5RRR
Y&OQ^
`?8,
<OaJ
u++ J
]1~ram#
@x+@
HOP4
BQ'r
-w!H
^wT/
GQwVQ
BI}
!:iL
[FhY$=
e.|.
5r r
?&Zx
18Uf
=5To
1D0{
Z!!a
|WR.
:<tf
String
=
g([<
:5Rjd$
\:3D
UUUUU
%P<Z
49h
4L0hI
!z j
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
n @5c
gQt02
6~ W}
1DF8993943A4BF66DBD51235236F97F5220C49B3
d;h>
T< Q
T(]e
Evx{
do+?{_
o/9<,
it*Z
%L$o
%D W
m;70c
~bgbbjc
c~>'
_ ={
_ =y
An&H\
InitializeArray
`w9+
M2r?
!jeYs
/{]X
B3mwW?
g k
s| -@h
H?=6
3 t@
X?&|
sc kb
sF4yw
?6#w
VDW<
CEum{]
e-2
xD]5
=s}l
Ev}D+
EU'$e
"6LN
DU&<
,t4
owmk`
i vLQ
CreateInstance
& j}$p
z]+X
[ VK
XNZ
IEnumerable`1
_Xs\z
Ds aGL
2 Knp
G,qc
qa[Mf
u5\}
V%n5
Rk2
(- }
QjTj&
9:ji
erKpX}

&w'
} |_
*|m+
m;;qf?
*Q?a
paul.licameli@gmail.com0
kM-)
Ntwt
15b HW
pP(E
vj&jO
39ED166B09C1C9A7668A5E5AC83C0B0C3470E897
_T_5
&I-p
9CxF
`L=$
aUv<
bqF)
,s'n4
)K A~3
Dmm"
;w;;3f;s_oW
uF_v
3"(@
o@Q6
JB
; V1
ka1|
A 2W
?uT6
H,O$
'h5x
$ +S
_T_T
-Q:
4oL 82
gVBd
y(;0
w]aA.
nn 0
50C
fzPt
Yw8I
p#TI
YTlx
m: u
DLF6]d
-"!'&%&
Mr 7:
? O?
__e__
== l
AMv/
++++++3e3333333
gJ1U+
,-]dy
V#71
;Bde0
}1$"
YC+K
TL(*
Yr+L
Lhv{
YEP`
t$U+
1n)$
@us3r
EkD(
CbpO
^$cp~/
JMi(
t3?![,X
1xi|L
B[^?
oJoK
.-r3
^b)$
WkRW|
=VTB
VEU5
+7(m2
SSSSS
&#uWZ
WL\|
VW-Cm
k4-b
c ./V*
LZNj
:re$
I-lX
@sZmcx9m
} h!
GfvEd
1jXg
:DlJB
.#z8
cD3nac
+ wJR
/@6r
p]n =WP
yX|=`e

8 1,
ukVP
k'N|
_|$I!b}q `F
MD<J
G74Q
8/T>g
`HJyK
L D$
%f1"
@e
ic;F
2H5"W
/]TH
DxV
e me
OOOOOD
vv
&/
Hq !
L| <r
ereeeeeeererrrr||
I1(h
x%q[>
Xeq
:1I
a/ZOnMEEIHOV7S
vkrPE
UserControl
SEtP
b&
oi=K
OXc
C9+
)\zi
+EFoW
iu&u4
e (
qH+n
;3;;;;33333333;3;;;;;;;;;E;EEEEEEHHHy
hv YHn
*:ZwR
-TAe+
3;;;;E;;E
kWGp
Mu]7e
SuM1
28Q^y
s#tNk
A<gP
%DoNI
e;;;;;e
6W"l
P*yU
c h?
#x{y
DZxO@
PuE=
5[T$
=yBi
Object
tLOww
ui_^
TTxaBBTBTBTBTBTTTTTaaaaaajjj
+ |S
6(o%
3D6w %g
2VVVY]
Z2vh9
\+3Y
99999999BBBBBTTTTTaaaaaj
W3@^
#TPoA
_0Ob
}*3u1
=0up5
VE1R~
ComVisibleAttribute
rAN
P&| #
?G5*
]E)_
xxxxxxxx
B~)
/F;=
j2)1C1]
/0Hw
6=mY
2ShI
+O+j
GiP
3Z.W1
i65<
cy!h
=g~4
$_%k
T\PH
@t&t
/e?p
M8Y+
;tis
xG ssi|
Pt%Y
w7Y&#
lq ;`,
RR*+ALIJN>1
`=Ak
9;!WYw
JI9"(
_}-P
"Mmt
& :
`\x4
R2<@
LnT!
%$?|.o/~Y
9 q
-VXuY
H=2V
RoG-
nIDAThC
J)qh
aLXi
lx6 `c
) Y2,4.
MethodInfo
1Wx~
75HS(
^ u
e )v
wwwwwwx
%.Kt2G
u(CQ
T8U'
hd
SlN<
A^^QRN
__T_
]tUt*
1.0.0.0
$6%F
: 4#
hmVa
UserControl1
WjvTl{
v Rmci0
[Mu0SD
IXp]ziG
9-fX
\pbN
v oD
:M~FLP
rTV3
$e"Zq^'
_cl
=
?~t
F-o{
rjx-
wwM:
)zt*}
BnQn
LU]|
e, 5
N? ebNS
Yhh#3
<@g,
>P+&
\T~%y
53"T
B999j9B9BBBBBTTT
jAT3z\0,
>tl~
cH1 .
lHvU
Y 3
8yu.G2
|fo!
c`'
y0r|
P>D|
[@OC
.#l'W
G gZ
UG}/
ea;4
:d F
wM?Sj
UKM!
kIDAThC
;E;EEy
~EV %
+R!l+
j^+N
e, /:
'.MPL
lRKl
Yn8-
[FC\
~)h<
AutoScaleMode
CreateInstanceAndUnwrap
,.xN
|z&7n
>IDG
CompilationRelaxationsAttribute
1jd. $
Z Dm
&T{D
L V
4RZ ia
"weHHHEEEE;E;;;;;S
Znk:
}M9HB
D,/v6
J8K
(*$<I,{m
/kg\
"zDh92M
A fX
BBBB
$q\F
@c d^
Fa&
GOz-'
?L2XF
yUn
[[[U
"44D4
6Fjn
$,>G
E;E;;;
_,
iv O`~
(&N9
<o)/
pppp
K(x@3
m- Y
U &y
a=F\
SSSHHe
?vWh
P[#S
T^ LM
j 3k
}W9 j/
xams
cr1]
:6}TB_?
[+,&
>;?*
]tS1
!!V(
=
SEHEH
9|i
9oGp)+
181006055510Z0z1 0
HU[U
JHV@t
otO@
e6?f
T5!4i_
T%=
:ss}n
do88
"QeT__
yH :i
\f^KN
7Hn
`MT=}
Zlc~
/q6\}
P@Qp
-bK!
iuaJ
[:ra
4w i N
OT7P
rfDy
/D$:
=8K1~f
56R7
c+\&
O[u@mx
X/c3uP2x
G y]j
-q|P6
g-:u|
$!wl
set_ServiceName
qSHSHS
Fs5a Ig

Ch5%)
bIKM
z(h6
2UL1"
>;HE
k &3
e7|{
M4"q
K^QK_7
}#hd
&On%
T^!:
+Ko;
.X<3,
^61F
#Kfu
vp0
xTa
ns;L
u)?g
Certum Certification Authority1"0
-+i7(
! 1P
xWV+
"Zpppp
T sl
.}_`6Xh
#-:
40~"
S;;;;y;EE
.\8g
xFa
~'^
SJm7WQ>
]i!B
TI<5
u!]u
akWf
5%#Y
N khO
;ZH;
>`Kn
++++++++3++3+33333333;3;;;;;E;EEy
xZRk-
AtZQ
6('IRK
mcn\cvs
du6^
/DR1
YWYr
29 9
UswuU
,g8N
2:Bz
S$zW
-L4A
;*xJ
yH;X
z I ;
xmxmmmjjjj
!w g
^fL6
e)yn
f3%Ib
t}Ua
!!!!!!!!!!!!+++++++33333;3;;;;;;y
G6WR
x0V_
S/`n
n0E1[
S yk
*E z
B \_
l^6Q|
I |N
PtJx
)7W\6xKOT
f]o],
\sFCR
X`u8
5%!
>Edp
a'tE"
r ]&
/B gR
(!`a
E)Rb
BS\l,
z32w|
[SXj%
a" Gd
_TTTTy
7ljd
[+W[
A^j
nr u'
mb&(
q3;3;;;
u?!>
K/HB`$}
uq b
K1_5
? YK
33;33
'dJl
Bj -
~)E5
yEEE;;;;3;;333333333+
XwVB
vs5;I
t`+e(vG
vNmmko
UQW J
T)Yo
>'Esfa
TEHH
irkt
Y{Oix
(+QZ .
Q4qy
2zysR|aY
Z|)f
$,Z. m
_jl2
taqx
W)Ls
X_7"
/lcz
o5mFz
Component
O 3
Q[RW[{m
#GJx
t7yN^,6
N&?yh
6*wD_3:
UUUU[UUUU
@Z3#*
0&0$
iG.F\
#:X/
v
4+`@
vPPWD
1yS.
0\cC
j){
$-t
uo|D
0eB<
wfGt
U{:$I
@{Uw4
51+i
~o9r
? IQ
~Eb<|LS
Wg\;
U[UUU
jg^P
jjjj
Y9]Rq
L(wO
FPj
kw.U
)hiA`
HRR)
L?lCm
kMi*&7G3U
'zNV
5U5{
&]1O
F5uD
G"`k
Mb9d
}lz>{
jM[W3
+P}N!
!W%h
s~/B
PY`)W1
i(TH
ArgumentNullException
Jd^`X
SjA"
IDAT)
#.@x
<~Nf
8CCEF<
,|O]e
(http://repository.certum.pl/cscasha2.cer0
hx%2
E3)Zm
liGY
,Upu}
U&3s
HTr f
6543f79f-b295-6a.Resources.resources
.zOpf
qbF^
&>8<'+:*.
%^xb
3DS!
}l!8
)tY7
42@6H
#(SB
eEEEHHHySSSSyyTT
#[{;
v2.0.50727
|==
~Scey
wRMB
q9vI
9+ym
f]rr,
O^`z
nFB1
gjg[Z
EEEEEH
qEEE;E;;;;;;;;3;
HcgJ
$twj
{!J~
bEa
http://subca.ocsp-certum.com01
%?A \
4(K,
kk3y
Qg:I;
yyyyyyy
V'GC*
7-=K
Lv!
O 3
O 3
#RRRR
O3,N
____
n3Uy
E+3Xf
T`wWR
K+Io
1 yM0
~w9/
lXqe7
iM]EnRN\
}LB)
>b`
%
6p!H
[<iu
~2.(
YC{-
PDBa Kn
Exception
!sro
1 (2
=
n
yn4<
}&2j4
-9\=
-lA=
sF9g
hR\MU
GC-+e
X[[q
Mg[A
vC@w
t}yR
J@sf
2 f)
xZqaN
#G<dJ
;8Pz
d4 #
@o8y
uIU"
i4SDN)}
+ENzW
<a{/
0 q
%<7
F I?
ME4<&
>(5?
4MB
<.a<
"O,w
GetTypeFromHandle
[,b*
.%ohf;cK
R(AoD
+ez8
u4Mpl
_Z:
JIIc
E;;;;q
uV\b
Installer
;<_c
E;;;;e
s{Lc][
O5&bn
O-&b
d~0_<9
l^nl_.
y>O
{=kIm
xOu^
[[[reee
E&'/W(
4!iC
x.j2
7M>I
(,FZ
f vPP
Y 8|
',:q
xO^p
$82328750-6e8e-4742-852c-cb6ca806f29c
w kM
,9JX
;;;E
y tx3N
mC]G
S/!9D
Im>-[
'2,d- /
|\;4
L{*[
JhjC
G%k
RL%X
U M6
v3'y
u"q#
sxTrF
cyQZO
.ns=o
( o:
47Fc
.2vS
jaaa
Xepr
P<o1
GolL
System.Runtime.Serialization
*_![
w k<
#{#f
"0TY
{S_C]
C7]
5B<!
UUUUUUU[UUUU
UUUU[U
*s
{w&2
*V`
!@!k/
{v-]
unL7H
w#ge
6{uF
IJC.
?]z
(3 :
,,sd
IDAT
3!p*&
gFI_h~r
aFv3j
6H5m
$rYG
}zWWWW
a8qh
]xn
/xq
UU_v
vuZM
#w|C
LD?O
}vN4
xB999B9BBBBBTBTTTTTaaaajj
a&e`
h6)S
G (82
IQX4
GOJn
"" q
e o6
>-k3
fa `
{X?g
qgcI
@QG)
)&B|?
b~ujj
wwwwwwpwwwwwwwxw
%_'-'
.NuS
$:_f
#f:A
[faJ
}qi'
t k
3mcp
q;33e33+3+++y
System.Runtime.CompilerServices
Npc
~Y4sf
A(~A
ede
sLYb
E333333
q\?h
AM 9
@c: I 3NY
Fs k\
UblTt
u?dR"jb;
H}>i
yU-"
EwzT
v
WNb'
y*J4
b^pYVPH~>77>HHPVY^bb
KPe
rQQ[QQ[[[[ererr|
t^>C
Ov %
uVh
!}&E
:.r'`
h@OI
6J(
y5]*
aaamxj
8#0WC
XXUU
U@ k
NkDS
Pu
v C
otIY=
@bC
O OO
!(Vm
[UU[UU[U
jeOQ
ZrTI&
Mm2a &:Bs
DZ{x
" ;(
cb,:
~OGv
o %l9(X
&~tn
/E
s$db
;y=$D
H|"R
87*C
hF4M
":UA
bF:h9;
a.2<
xnyjpg
c05L
[`Qq
@ZW9
zj^ <^
*#ntRo{
/&}lv
`XBG
2>H*
Pt u
I_'{A
g.v
W 7z
!9eP1
Ip\px
3;E!
!w k
i <
4Br
\k ^
BG&1P
qk"|3
Q%Pc
(,m$
=9 v
*js5
)[p-
|XAQ
G1Yd;
fK8
!w C
IDisposable
1YeW
tG%{
wU&@
3
v{1SU
Installer1
?td p
cL"
6FTD
q8in5
tNws
FGN"
<["?
h7" *UD
d4 L^
jjaaaaaTaTT
s0c
U@J\
$wlM
(oc:Ioo9n
]6F*
7Cf;
SC%!
Mh A
Ea='
0Cn^gc
=
T_Te_
D3&}
3d$j
&Siil
DDDDx
a@~N
1]S
nH8/
.36qe
UY?K
*"\r
u'vPz|
;%>/f
,Z*4m
tI*!
"/ee
GRF"
wEX2
AssemblyProductAttribute
|uha
H!R=
UJ`C-d
um0'S
q$$ol
Vj+S
zhG
$NPdP3
XU?Z?9
h|jPT
u]SM
#Blob
pY(#
W[<w
:j@+
N,a
y____p
-vN[
uZ[:[
`sT4
F!E\
wO$)=
q"gV
SvtbR2S
th,E
G,8o
Cx< []
k(4P&
:%-6
htz
<7i<
>>4
_a@OrU\G
q^EA
L#*$
#=t 3
-04(
?/2
EY hKkgT
p]cj
b^E
pxpx
%]n|
1<q
$"?7t%
pCk?v
cR("
"Kn&|
[|F)
e{ .
HoT!
2018
#Z^i
NewGuid
`yyo
+-8/
yx+M
q+\[
+]{M
WriteLine
`z<~
$9oc
% h
[Pk@@/
p\#C
!&+k
~hf`
1/;>
zR>S
m US|-
lD%7
Cq<-+
DN
t dw
System.Drawing.Bitmap
wou%
HT,;
fx[c
'~6 A
VUHvO/<
PNhY
1mz'5j
pgv :}
U\VDA
Y&Y.
1Lh)
\ K$
5~m~
> `a
($%'Vr
jxaj
]}Xz
tr>$
#GUID
Dd.$wy~#
*],k
`.96
X=az
v kb
S<
Z!v>{L
thcE$
mmjjajaaaaa
DIIAq
J\CD
;1}#
0^TF
c9|r
d R{Q
+l}d
\i"_3
Yq;#
`rkJ
hofEXaFY
;333;3++++++e
qIDAThC
eSa5dI~H,
ho%{
=kbu"
94ow
:Oae
xxxxxxxxv
%N`
RC/8
|S;C
EE_)
B-E'
.o9t
O0$.
q51`3)
sY/ y8
410AA75E49419D09DB3FF821805126CA1AFD8D01
bb*J
q8ZZZ
Q6Q#Q
[[U[[[
EHLgT)Y
'O;>
[U[[
#z O=
rPm0
z S:
G hZp
l }$
=++
cnt>
45aK2k
x'/Nr
&Vom
\DoW
I;BF
ah8j
\\wx
+k]%
utS^
xeNFRF
J[K:
L" j
o}5Bv
___e
>/gt
Kw{Qj>
{|,^
Eia
Bs-
= %
$Sy7
jF/S
d=]M
d_&<
Y)]V_V9
6dTgR
4qxp
E;;;;;S3;3333++3+++3
h-Ih
+S{l
stE#f
hAd}
7;}!,
c0@iFw) !
}*Bl&L
O^6d{gj
'B_3
Natw::
H/iRMP
c6{*
zkv2
L{7$
;cRw
kkk[
l$y.
)5b>
3e&6uY1
~f-J
/VsD
Q&Y
mVB
rdHir
Yni9
AB,?C
n%FQ
4cMLo
4tJ(
N 2
pB}g+
TTSTTe
3xk\
b$`7
Tg}C
X`n$!:
OK r
*E z
9t-L|5
;kll
Z@]A=:
~[Y2>`
_D18
[U[U
P4!
"3VG
aFAW
63FA
X4DO
v-lKC
````@
{I]PE_
5[9dV
9u_h
'6.7
1+Yq
'- ,1L
?&hG
E.(O
{k7D
5g69@
HXv{
{e U
wWq/
J 5b
"neTSHHHHHEHEEEE;
|N_/
oeW0
K:O%
v =
;$V5
&U b8
Pp0h%|NU
m yQ
<.HT
TP$42
>* Ua_h
$,6>0
;m+p
z"jb
e%(\ [
5R"@
?Df/
8) pV
jmjj
6-$G
:%s_TKO
= N?
:[&rR
b0!3
J( $
/)p@
E
^-$c
Gogh0
u"$rI
=4&g
System.ComponentModel
}gdk
J%;~Q
+!!!!!3!!!!+!+++++3333S3;3;;;;;E
&j9%_K
2(*K
3Nq$
^]8=
[T%o
qt>$
~pu.
;YP nKI
h5Cm
)))
[=!c
W\lN}
,\ gG"xan.
>|I;j8
D,&>x24 Z[
qR[
j!->!
2Q7$m
i{.A
````
"4_8h?
B>x/
Tj go
mscoree.dll
urD"d
{ ={
ki t
^b/D
MH<J
?j^|
h*P^s6bs
h 1
%G1p
D(! ca
`42RBJ
{ArQ
TSSS
vHVJ
uuNd-
%%
0~1 0
ZPji
yr/-y
5& v{
cscasha2@certum.pl0
p[xK
7 hm
O =
\MTS
{`;
DA*
gWNa@
=RH>
V& Fg
^N`'F
]C @
_I-"
d, w
EA!
;zPX
Gs~=
sZyY>
fS#%
=Hm.
qt>F
{TW<]
3SKI
zh?5
nr}S
S\YO
%"!;
^h! #
1OAMC a
ep G<Z+6
jIEZ
System.Windows.Forms
>'fa
pa !
x%z*
>+{f
9^X*
ukeg8W2
eAA!
!r^
\4$hh
6IDDDDD
(80-K7
L"u7
V6I
KZNp
[w'0
@/hv2a
'/v
1e
fi'/2
7q3XK
BBBTBmTTTTT
v '5
Hs|dj
/#G{A3t
t(>9
h %
e6T9
K|V'
x1V1
at5Tde
3]"+
$C %
Iu4V
SS>0Or
AssemblyConfigurationAttribute
IDAThCc``
Y
%,`-i
[0d~
Array
*D&8W
u=$|X
0TW
m033
StringBuilder
xxpx
_kS)
]Mw
]S2~
BhPf|
d4
aq75!
e0H]$
]x]Bt*
3l,8j
ZOgg
r=2
kz{
;Q~D
0x/O
h@;j
=
6w,#
O1Q.6
JM!F
'1'&
ZgX
W%Ur
px,A
)72*
36fk
VFRVN
a^B(
" ~4?b4C
#`i
RM{b
TTTT
=mP-
4]DD
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven07_64 Seven07_64 VirtualBox 2018-02-09 13:35:41 2018-02-09 13:38:36 175

12 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven07_64 Seven07_64 VirtualBox 2018-02-09 13:35:41 2018-02-09 13:38:36 175

10 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\jtforce_signed.exe.config
C:\Users\Seven01\AppData\Local\Temp\jtforce_signed.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\jtforce_signed.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll
C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af
C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
C:\Windows\System32\p2pcollab.dll
C:\Windows\System32\qagentrt.dll
C:\Windows\System32\dnsapi.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\*
C:\Users\Seven01\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\*
C:\Users\Seven01\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\*
C:\Users\Seven01\AppData\LocalLow
C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6525274CBC2077D43D7D17A33C868C4F
C:\Users\Seven01\AppData\Local\Temp\CabB536.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB537.tmp
C:\Users\Seven01\AppData\Local\Temp\
C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData
C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content
C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
C:\Users\Seven01\AppData\Local\Temp\CabB5B5.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB5B6.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB5D6.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB5D7.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB627.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB628.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB667.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB668.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB6C7.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB6C8.tmp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
C:\Users\Seven01\AppData\Local\Temp\jtforce_signed.config
C:\Users\Seven01\AppData\Local\Temp\CabB736.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB737.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB786.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB787.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB7A8.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB7A9.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB7F8.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB7F9.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB838.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB839.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB898.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB899.tmp
C:\Users\Seven01\AppData\Local\Temp\jtforce_signed.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol21.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\f02737c83305687a68c088927a6c5a98\System.Configuration.Install.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.INI
C:\Users\Seven01\AppData\Local\Temp\b7035ed1-6a9d-414d-8c99-ef782390225e.dll
C:\Users\Seven01\AppData\Local\Temp\b7035ed1-6a9d-414d-8c99-ef782390225e\b7035ed1-6a9d-414d-8c99-ef782390225e.dll
C:\Users\Seven01\AppData\Local\Temp\b7035ed1-6a9d-414d-8c99-ef782390225e.exe
C:\Users\Seven01\AppData\Local\Temp\b7035ed1-6a9d-414d-8c99-ef782390225e\b7035ed1-6a9d-414d-8c99-ef782390225e.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it-it.nlp
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.INI
C:\Users\Seven01\AppData\Local\Temp\CabBC24.tmp
C:\Users\Seven01\AppData\Local\Temp\TarBC25.tmp
C:\Users\Seven01\AppData\Local\Temp\CabBC74.tmp
C:\Users\Seven01\AppData\Local\Temp\TarBC75.tmp
C:\Users\Seven01\AppData\Local\Temp\CabBC96.tmp
C:\Users\Seven01\AppData\Local\Temp\TarBC97.tmp
C:\Users\Seven01\AppData\Local\Temp\CabBCE6.tmp
C:\Users\Seven01\AppData\Local\Temp\TarBCE7.tmp
C:\Users\Seven01\AppData\Local\Temp\CabBD26.tmp
C:\Users\Seven01\AppData\Local\Temp\TarBD27.tmp
C:\Users\Seven01\AppData\Local\Temp\CabBDA5.tmp
C:\Users\Seven01\AppData\Local\Temp\TarBDA6.tmp
C:\Users\Seven01\AppData\Local\Temp\jtforce_signed.exe:Zone.Identifier
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Users\Seven01\AppData\Local\Temp\it-IT\Project1.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Project1.resources\Project1.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\Project1.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\Project1.resources\Project1.resources.exe
C:\Windows\Globalization\it.nlp
C:\Users\Seven01\AppData\Local\Temp\it\Project1.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Project1.resources\Project1.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\Project1.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\Project1.resources\Project1.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Local\Temp\shell32.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe
\??\MountPointManager
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2512.2446015
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2512.2446015
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2512.2446031
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe.Local\
C:\Users\Seven01\AppData\Roaming
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
C:\Users\Seven01\AppData\Roaming\Microsoft
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu
C:\Users\Seven01\AppData\Local\Temp\CabCAB2.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCAB3.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCB41.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCB42.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCB72.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCB73.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCC00.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCC01.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCC50.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCC51.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCCDF.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCCE0.tmp
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.config
C:\Users\Seven01\AppData\Local\Temp\CabCD3F.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCD40.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCDCD.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCDCE.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCDFE.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCDFF.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCE7D.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCE7E.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCECD.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCECE.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCF4C.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCF4D.tmp
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.INI
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\453aa999-7d17-4584-b73f-a604664d2ca4.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\453aa999-7d17-4584-b73f-a604664d2ca4\453aa999-7d17-4584-b73f-a604664d2ca4.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\453aa999-7d17-4584-b73f-a604664d2ca4.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\453aa999-7d17-4584-b73f-a604664d2ca4\453aa999-7d17-4584-b73f-a604664d2ca4.exe
C:\Users\Seven01\AppData\Local\Temp\CabCFEB.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCFEC.tmp
C:\Users\Seven01\AppData\Local\Temp\CabD079.tmp
C:\Users\Seven01\AppData\Local\Temp\TarD07A.tmp
C:\Users\Seven01\AppData\Local\Temp\CabD09B.tmp
C:\Users\Seven01\AppData\Local\Temp\TarD0AB.tmp
C:\Users\Seven01\AppData\Local\Temp\CabD11A.tmp
C:\Users\Seven01\AppData\Local\Temp\TarD11B.tmp
C:\Users\Seven01\AppData\Local\Temp\CabD189.tmp
C:\Users\Seven01\AppData\Local\Temp\TarD18A.tmp
C:\Users\Seven01\AppData\Local\Temp\CabD208.tmp
C:\Users\Seven01\AppData\Local\Temp\TarD209.tmp
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\it-IT\Project1.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\it-IT\Project1.resources\Project1.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\it-IT\Project1.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\it-IT\Project1.resources\Project1.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\it\Project1.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\it\Project1.resources\Project1.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\it\Project1.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\it\Project1.resources\Project1.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\shell32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2116.2451593
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2116.2451593
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2116.2451593

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\jtforce_signed.exe.config
C:\Users\Seven01\AppData\Local\Temp\jtforce_signed.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll
C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6525274CBC2077D43D7D17A33C868C4F
C:\Users\Seven01\AppData\Local\Temp\CabB536.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB537.tmp
C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
C:\Users\Seven01\AppData\Local\Temp\CabB5B5.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB5B6.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB5D6.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB5D7.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB627.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB628.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB667.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB668.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB6C7.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB6C8.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB736.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB737.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB786.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB787.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB7A8.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB7A9.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB7F8.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB7F9.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB838.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB839.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB898.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB899.tmp
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol21.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\f02737c83305687a68c088927a6c5a98\System.Configuration.Install.ni.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Users\Seven01\AppData\Local\Temp\CabBC24.tmp
C:\Users\Seven01\AppData\Local\Temp\TarBC25.tmp
C:\Users\Seven01\AppData\Local\Temp\CabBC74.tmp
C:\Users\Seven01\AppData\Local\Temp\TarBC75.tmp
C:\Users\Seven01\AppData\Local\Temp\CabBC96.tmp
C:\Users\Seven01\AppData\Local\Temp\TarBC97.tmp
C:\Users\Seven01\AppData\Local\Temp\CabBCE6.tmp
C:\Users\Seven01\AppData\Local\Temp\TarBCE7.tmp
C:\Users\Seven01\AppData\Local\Temp\CabBD26.tmp
C:\Users\Seven01\AppData\Local\Temp\TarBD27.tmp
C:\Users\Seven01\AppData\Local\Temp\CabBDA5.tmp
C:\Users\Seven01\AppData\Local\Temp\TarBDA6.tmp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe.config
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe
C:\Users\Seven01\AppData\Local\Temp\CabCAB2.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCAB3.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCB41.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCB42.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCB72.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCB73.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCC00.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCC01.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCC50.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCC51.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCCDF.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCCE0.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCD3F.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCD40.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCDCD.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCDCE.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCDFE.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCDFF.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCE7D.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCE7E.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCECD.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCECE.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCF4C.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCF4D.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCFEB.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCFEC.tmp
C:\Users\Seven01\AppData\Local\Temp\CabD079.tmp
C:\Users\Seven01\AppData\Local\Temp\TarD07A.tmp
C:\Users\Seven01\AppData\Local\Temp\CabD09B.tmp
C:\Users\Seven01\AppData\Local\Temp\TarD0AB.tmp
C:\Users\Seven01\AppData\Local\Temp\CabD11A.tmp
C:\Users\Seven01\AppData\Local\Temp\TarD11B.tmp
C:\Users\Seven01\AppData\Local\Temp\CabD189.tmp
C:\Users\Seven01\AppData\Local\Temp\TarD18A.tmp
C:\Users\Seven01\AppData\Local\Temp\CabD208.tmp
C:\Users\Seven01\AppData\Local\Temp\TarD209.tmp
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll

Write Files

C:\Users\Seven01\AppData\Local\Temp\CabB536.tmp
C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
C:\Users\Seven01\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
C:\Users\Seven01\AppData\Local\Temp\CabB5B5.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB5D6.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB627.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB667.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB6C7.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB736.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB786.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB7A8.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB7F8.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB838.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB898.tmp
C:\Users\Seven01\AppData\Local\Temp\CabBC24.tmp
C:\Users\Seven01\AppData\Local\Temp\CabBC74.tmp
C:\Users\Seven01\AppData\Local\Temp\CabBC96.tmp
C:\Users\Seven01\AppData\Local\Temp\CabBCE6.tmp
C:\Users\Seven01\AppData\Local\Temp\CabBD26.tmp
C:\Users\Seven01\AppData\Local\Temp\CabBDA5.tmp
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe
C:\Users\Seven01\AppData\Local\Temp\CabCAB2.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCB41.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCB72.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCC00.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCC50.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCCDF.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCD3F.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCDCD.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCDFE.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCE7D.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCECD.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCF4C.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCFEB.tmp
C:\Users\Seven01\AppData\Local\Temp\CabD079.tmp
C:\Users\Seven01\AppData\Local\Temp\CabD09B.tmp
C:\Users\Seven01\AppData\Local\Temp\CabD11A.tmp
C:\Users\Seven01\AppData\Local\Temp\CabD189.tmp
C:\Users\Seven01\AppData\Local\Temp\CabD208.tmp

Delete Files

C:\Users\Seven01\AppData\Local\Temp\CabB536.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB537.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB5B5.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB5B6.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB5D6.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB5D7.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB627.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB628.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB667.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB668.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB6C7.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB6C8.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB736.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB737.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB786.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB787.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB7A8.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB7A9.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB7F8.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB7F9.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB838.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB839.tmp
C:\Users\Seven01\AppData\Local\Temp\CabB898.tmp
C:\Users\Seven01\AppData\Local\Temp\TarB899.tmp
C:\Users\Seven01\AppData\Local\Temp\CabBC24.tmp
C:\Users\Seven01\AppData\Local\Temp\TarBC25.tmp
C:\Users\Seven01\AppData\Local\Temp\CabBC74.tmp
C:\Users\Seven01\AppData\Local\Temp\TarBC75.tmp
C:\Users\Seven01\AppData\Local\Temp\CabBC96.tmp
C:\Users\Seven01\AppData\Local\Temp\TarBC97.tmp
C:\Users\Seven01\AppData\Local\Temp\CabBCE6.tmp
C:\Users\Seven01\AppData\Local\Temp\TarBCE7.tmp
C:\Users\Seven01\AppData\Local\Temp\CabBD26.tmp
C:\Users\Seven01\AppData\Local\Temp\TarBD27.tmp
C:\Users\Seven01\AppData\Local\Temp\CabBDA5.tmp
C:\Users\Seven01\AppData\Local\Temp\TarBDA6.tmp
C:\Users\Seven01\AppData\Local\Temp\jtforce_signed.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2512.2446015
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2512.2446015
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2512.2446031
C:\Users\Seven01\AppData\Local\Temp\CabCAB2.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCAB3.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCB41.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCB42.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCB72.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCB73.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCC00.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCC01.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCC50.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCC51.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCCDF.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCCE0.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCD3F.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCD40.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCDCD.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCDCE.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCDFE.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCDFF.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCE7D.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCE7E.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCECD.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCECE.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCF4C.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCF4D.tmp
C:\Users\Seven01\AppData\Local\Temp\CabCFEB.tmp
C:\Users\Seven01\AppData\Local\Temp\TarCFEC.tmp
C:\Users\Seven01\AppData\Local\Temp\CabD079.tmp
C:\Users\Seven01\AppData\Local\Temp\TarD07A.tmp
C:\Users\Seven01\AppData\Local\Temp\CabD09B.tmp
C:\Users\Seven01\AppData\Local\Temp\TarD0AB.tmp
C:\Users\Seven01\AppData\Local\Temp\CabD11A.tmp
C:\Users\Seven01\AppData\Local\Temp\TarD11B.tmp
C:\Users\Seven01\AppData\Local\Temp\CabD189.tmp
C:\Users\Seven01\AppData\Local\Temp\TarD18A.tmp
C:\Users\Seven01\AppData\Local\Temp\CabD208.tmp
C:\Users\Seven01\AppData\Local\Temp\TarD209.tmp
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe:Zone.Identifier
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2116.2451593
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2116.2451593
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2116.2451593

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jtforce_signed.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\crypt32
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DebugHeapFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\msasn1
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Certificate\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Initialization\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Message\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Signature\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\CertCheck\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Cleanup\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
HKEY_USERS\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\State
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security\Safety Warning Level
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Safer
HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Safer
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\TrustedPublisher\Safer
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagLevel
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagMatchAnyMask
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Wintrust\Config
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{000C10F1-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{BA08A66F-113B-4D58-9329-A1B37AF30F0E}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptSIPDllPutSignedDataMsg
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{000C10F1-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{BA08A66F-113B-4D58-9329-A1B37AF30F0E}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptSIPDllGetSignedDataMsg
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7\Name
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MUI\StringCacheSettings
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\StringCacheSettings\StringCacheGeneration
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\LanguageList
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\p2pcollab.dll,-8042
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7\Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\dnsapi.dll,-103
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\#16
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\Ldap
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CertDllOpenStoreProv
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{000C10F1-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{06C9E010-38CE-11D4-A2A3-00104BD35090}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{1A610570-38CE-11D4-A2A3-00104BD35090}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{BA08A66F-113B-4D58-9329-A1B37AF30F0E}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptSIPDllVerifyIndirectData
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllEncodeObjectEx
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.1.1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.11
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.12
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.2
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.3
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.4
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllEncodeObject
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2001
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2002
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2003
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2004
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2005
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2006
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2007
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2008
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2009
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2130
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2221
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2222
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.2
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.1.1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.4
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.10
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.11
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.12
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.15
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.20
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.25
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.26
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.27
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.28
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.30
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.4
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllVerifyEncodedSignature
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllVerifyEncodedSignature
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllImportPublicKeyInfoEx2
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllImportPublicKeyInfoEx2
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\ChainEngine\Config
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableMandatoryBasicConstraints
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableCANameConstraints
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableUnsupportedCriticalExtensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlCountInCert
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalCountPerChain
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxUrlRetrievalByteCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalByteCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalCertCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\CryptnetPreFetchTriggerPeriodSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\EnableWeakSignatureFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainCacheResyncFiletime
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\My\PhysicalStores
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\My
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000\ProfileImagePath
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\My\
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\My\Certificates
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\My\CRLs
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\My\CTLs
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\My\Keys
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\CA\PhysicalStores
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\CA
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\CA\
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\CA\Certificates
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\CA\CRLs
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\CA\CTLs
HKEY_CURRENT_USER\
HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA
HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA\Certificates
HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA\CRLs
HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\CA\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\CA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D559A586669B08F46A30A133F8A9ED3D038E2EA8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D559A586669B08F46A30A133F8A9ED3D038E2EA8\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs\A377D1B1C0538833035211F4083D00FECC414DAB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs\A377D1B1C0538833035211F4083D00FECC414DAB\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\CA
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\CA\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\CA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\CTLs
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Disallowed\PhysicalStores
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Disallowed
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Disallowed\
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Disallowed\Certificates
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Disallowed\CRLs
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Disallowed\CTLs
HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\Disallowed
HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates
HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs
HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\Disallowed\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\Disallowed
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\7D7F4414CCEF168ADF6BF40753B5BECD78375931
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\7D7F4414CCEF168ADF6BF40753B5BECD78375931\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\Disallowed
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\Disallowed\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\Disallowed
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\CTLs
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\PhysicalStores
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\ProtectedRoots
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\CRLs
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\CTLs
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\ProtectedRoots\Certificates
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\Root\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\Root
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4F65566336DB6598581D584A596C87934D5F2AB4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4F65566336DB6598581D584A596C87934D5F2AB4\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\627F8D7827656399D27D7F9044C9FEB3F33EFA9A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\627F8D7827656399D27D7F9044C9FEB3F33EFA9A\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85371CA6E550143DCE2803471BDE3A09E8F8770F
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85371CA6E550143DCE2803471BDE3A09E8F8770F\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97817950D81C9670CC34D809CF794431367EF474
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97817950D81C9670CC34D809CF794431367EF474\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97E2E99636A547554F838FBA38B82E74F89A830A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97E2E99636A547554F838FBA38B82E74F89A830A\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D23209AD23D314232174E40D7F9D62139786633A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D23209AD23D314232174E40D7F9D62139786633A\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DE28F4A4FFE5B92FA3C503D1A349A7F9962A8212
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DE28F4A4FFE5B92FA3C503D1A349A7F9962A8212\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CTLs
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\Root
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\Root\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\Root
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\SmartCardRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\SmartCardRoot
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\SmartCardRoot\
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPeople\PhysicalStores
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPeople
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPeople\
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs
HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\TrustedPeople
HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates
HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs
HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\TrustedPeople\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\TrustedPeople
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\TrustedPeople
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\TrustedPeople\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\TrustedPeople
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople\CTLs
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\trust\PhysicalStores
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\trust
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\trust\
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\trust\Certificates
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\trust\CRLs
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\trust\CTLs
HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\trust
HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\trust\Certificates
HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\trust\CRLs
HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\trust\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\trust\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\trust
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\trust
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\trust\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\trust
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Diagnostics
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserenvDebugLevel
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\GpSvcDebugLevel
HKEY_LOCAL_MACHINE\System\Setup
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates
HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\UrlDllGetObjectUrl
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\UrlDllGetObjectUrl
HKEY_LOCAL_MACHINE\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings
HKEY_USERS\S-1-5-21-1822907384-1282624486-319450072-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\EnableInetUnknownAuth
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DebugFlags
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\AuthRoot
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\Escalation
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\WMR
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledProcesses\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\6C9BE634
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledSessions\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5df0b8\6103278
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index21
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.ServiceProcess__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration.Install__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.5.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\221f0fd0\e71afdf
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|jtforce_signed.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|jtforce_signed.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|jtforce_signed.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\221f0fd0\1ff796d9
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Namespaces
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Application
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\app.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\ED4B8E7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Start Menu|Programs|Startup|app.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Start Menu|Programs|Startup|app.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Roaming|Microsoft|Windows|Start Menu|Programs|Startup|app.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DebugHeapFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\State
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security\Safety Warning Level
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagLevel
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagMatchAnyMask
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7\Name
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\StringCacheSettings\StringCacheGeneration
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\p2pcollab.dll,-8042
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7\Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\dnsapi.dll,-103
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableMandatoryBasicConstraints
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableCANameConstraints
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableUnsupportedCriticalExtensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlCountInCert
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalCountPerChain
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxUrlRetrievalByteCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalByteCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalCertCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\CryptnetPreFetchTriggerPeriodSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\EnableWeakSignatureFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainCacheResyncFiletime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000\ProfileImagePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D559A586669B08F46A30A133F8A9ED3D038E2EA8\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs\A377D1B1C0538833035211F4083D00FECC414DAB\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\7D7F4414CCEF168ADF6BF40753B5BECD78375931\Blob
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\ProtectedRoots\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4F65566336DB6598581D584A596C87934D5F2AB4\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\627F8D7827656399D27D7F9044C9FEB3F33EFA9A\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85371CA6E550143DCE2803471BDE3A09E8F8770F\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97817950D81C9670CC34D809CF794431367EF474\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97E2E99636A547554F838FBA38B82E74F89A830A\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D23209AD23D314232174E40D7F9D62139786633A\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DE28F4A4FFE5B92FA3C503D1A349A7F9962A8212\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserenvDebugLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\GpSvcDebugLevel
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\EnableInetUnknownAuth
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DebugFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\6C9BE634
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index21
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3512230a-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122306-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{35122307-fb0b-11e5-b945-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Application
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\ED4B8E7

Write Keys

HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\LanguageList
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Application

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
kernelbase.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.ProcessIdToSessionId
imm32.dll.ImmCreateContext
imm32.dll.ImmDestroyContext
imm32.dll.ImmNotifyIME
imm32.dll.ImmAssociateContext
imm32.dll.ImmReleaseContext
imm32.dll.ImmGetContext
imm32.dll.ImmGetCompositionStringA
imm32.dll.ImmSetCompositionStringA
imm32.dll.ImmGetCompositionStringW
imm32.dll.ImmSetCompositionStringW
imm32.dll.ImmSetCandidateWindow
mscorsec.dll.GetPublisher
mscoree.dll.CoInitializeEE
mscoreei.dll.CoInitializeEE
mscorwks.dll.CoInitializeEE
wintrust.dll.WintrustCertificateTrust
mscorsec.dll.CORPolicyEE
wintrust.dll.SoftpubInitialize
wintrust.dll.SoftpubLoadMessage
wintrust.dll.SoftpubLoadSignature
wintrust.dll.SoftpubCheckCert
cryptsp.dll.CryptAcquireContextA
wintrust.dll.CryptSIPPutSignedDataMsg
wintrust.dll.CryptSIPGetSignedDataMsg
imagehlp.dll.ImageGetCertificateData
user32.dll.LoadStringW
ncrypt.dll.BCryptOpenAlgorithmProvider
bcryptprimitives.dll.GetHashInterface
ncrypt.dll.BCryptGetProperty
ncrypt.dll.BCryptCreateHash
ncrypt.dll.BCryptHashData
wintrust.dll.CryptSIPVerifyIndirectData
bcrypt.dll.BCryptOpenAlgorithmProvider
bcrypt.dll.BCryptGetProperty
bcrypt.dll.BCryptCreateHash
bcrypt.dll.BCryptHashData
bcrypt.dll.BCryptFinishHash
bcrypt.dll.BCryptDestroyHash
bcrypt.dll.BCryptCloseAlgorithmProvider
ncrypt.dll.BCryptFinishHash
bcryptprimitives.dll.GetAsymmetricEncryptionInterface
ncrypt.dll.BCryptImportKeyPair
ncrypt.dll.BCryptVerifySignature
ncrypt.dll.BCryptDestroyKey
ncrypt.dll.BCryptDestroyHash
cryptsp.dll.CryptCreateHash
cryptsp.dll.CryptSetHashParam
cryptsp.dll.CryptVerifySignatureA
cryptsp.dll.CryptDestroyKey
cryptsp.dll.CryptDestroyHash
userenv.dll.GetUserProfileDirectoryW
sechost.dll.ConvertSidToStringSidW
sechost.dll.ConvertStringSidToSidW
userenv.dll.RegisterGPNotification
gpapi.dll.RegisterGPNotificationInternal
sechost.dll.OpenSCManagerW
sechost.dll.OpenServiceW
sechost.dll.CloseServiceHandle
sechost.dll.QueryServiceConfigW
cryptnet.dll.CryptGetObjectUrl
cryptnet.dll.CryptRetrieveObjectByUrlW
cryptnet.dll.I_CryptNetGetConnectivity
sensapi.dll.IsNetworkAlive
rpcrt4.dll.RpcBindingFromStringBindingW
rpcrt4.dll.RpcBindingSetAuthInfoExW
rpcrt4.dll.NdrClientCall2
winhttp.dll.WinHttpOpen
winhttp.dll.WinHttpSetTimeouts
winhttp.dll.WinHttpSetOption
winhttp.dll.WinHttpCrackUrl
shlwapi.dll.StrCmpNW
winhttp.dll.WinHttpConnect
winhttp.dll.WinHttpOpenRequest
winhttp.dll.WinHttpSetStatusCallback
winhttp.dll.WinHttpGetDefaultProxyConfiguration
winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser
winhttp.dll.WinHttpSendRequest
ws2_32.dll.GetAddrInfoW
ws2_32.dll.WSASocketW
ws2_32.dll.#2
ws2_32.dll.#21
ws2_32.dll.#9
ws2_32.dll.WSAIoctl
ws2_32.dll.FreeAddrInfoW
ws2_32.dll.#6
ws2_32.dll.#5
ws2_32.dll.WSARecv
ws2_32.dll.WSASend
winhttp.dll.WinHttpReceiveResponse
winhttp.dll.WinHttpQueryHeaders
winhttp.dll.WinHttpQueryDataAvailable
ws2_32.dll.#22
winhttp.dll.WinHttpReadData
ws2_32.dll.#3
winhttp.dll.WinHttpCloseHandle
rpcrt4.dll.RpcBindingFree
setupapi.dll.SetupIterateCabinetW
kernel32.dll.RegOpenKeyExW
kernel32.dll.RegCloseKey
cabinet.dll.#20
cabinet.dll.#22
cabinet.dll.#23
sechost.dll.QueryServiceConfigA
sechost.dll.QueryServiceStatus
rpcrt4.dll.RpcStringBindingComposeA
rpcrt4.dll.RpcBindingFromStringBindingA
rpcrt4.dll.RpcEpResolveBinding
sechost.dll.LookupAccountSidLocalW
sechost.dll.LookupAccountNameLocalW
rpcrt4.dll.RpcStringFreeA
cryptnet.dll.I_CryptNetSetUrlCacheFlushInfo
wintrust.dll.SoftpubAuthenticode
wintrust.dll.SoftpubCleanup
ole32.dll.CoTaskMemAlloc
cryptsp.dll.CryptReleaseContext
mscoree.dll.CoUninitializeEE
mscoreei.dll.CoUninitializeEE
mscorwks.dll.CoUninitializeEE
ole32.dll.CoTaskMemFree
kernel32.dll.QueryActCtxW
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
kernel32.dll.GetFullPathNameW
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
ole32.dll.CoCreateGuid
kernel32.dll.GetUserDefaultUILanguage
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.GetStdHandle
kernel32.dll.CloseHandle
kernel32.dll.DeleteFileW
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
kernel32.dll.GetCurrentProcess
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
kernel32.dll.WerRegisterMemoryBlock
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipGetImageEncodersSize
kernel32.dll.LocalAlloc
gdiplus.dll.GdipGetImageEncoders
kernel32.dll.RtlMoveMemory
kernel32.dll.LocalFree
gdiplus.dll.GdipSaveImageToStream
oleaut32.dll.#8
oleaut32.dll.#9
oleaut32.dll.#10
gdiplus.dll.GdipCreateBitmapFromStream
gdiplus.dll.GdipBitmapLockBits
gdiplus.dll.GdipBitmapUnlockBits
shfolder.dll.SHGetFolderPathW
kernel32.dll.CopyFileW
kernel32.dll.SwitchToThread
shell32.dll.ShellExecuteEx
shell32.dll.ShellExecuteExW
setupapi.dll.CM_Get_Device_Interface_List_Size_ExW
setupapi.dll.CM_Get_Device_Interface_List_ExW
comctl32.dll.#386
ole32.dll.CoUninitialize
ole32.dll.CoRevokeInitializeSpy
comctl32.dll.#388
oleaut32.dll.#500
advapi32.dll.RegSetValueExW
kernel32.dll.DeleteAtom
comctl32.dll.#321
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
advapi32.dll.EventUnregister
kernel32.dll.GetProcAddress
kernel32.dll.CreateProcessW
ntdll.dll.NtAlertResumeThread
gdiplus.dll.GdipDisposeImage
ntdll.dll.NtGetContextThread
ntdll.dll.NtReadVirtualMemory
ntdll.dll.NtSetContextThread
ntdll.dll.NtWriteVirtualMemory
kernel32.dll.VirtualAllocEx
kernel32.dll.VirtualFreeEx
kernel32.dll.VirtualProtectEx
kernel32.dll.Wow64GetThreadContext
kernel32.dll.Wow64SetThreadContext
ntdll.dll.ZwUnmapViewOfSection

Execute Commands

C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe 
"C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe"

Started Services

Nothing to display

Created Services

Nothing to display
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven07_64 Seven07_64 VirtualBox 2018-02-09 13:35:41 2018-02-09 13:38:36 175

3 HTTP Request(s) detected

http://repository.certum.pl/ctnca.cer
  • Hostname: repository.certum.pl
  • IP Address: 23.111.11.204
  • Port: 80
  • Count: 14

GET /ctnca.cer HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: repository.certum.pl

http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
  • Hostname: www.download.windowsupdate.com
  • IP Address: 67.26.75.254
  • Port: 80
  • Count: 14

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1
Cache-Control: max-age = 86400
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: www.download.windowsupdate.com

http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
  • Hostname: www.download.windowsupdate.com
  • IP Address: 67.26.75.254
  • Port: 80
  • Count: 7

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1
Cache-Control: max-age = 86401
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: www.download.windowsupdate.com

#infosec #automation

TheSystem Itself @ 2018-02-09 13:36:19

Detected family: #Malicious

TheSystem Itself @ 2018-02-09 13:42:03