MalScore
100/100

francis.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 36/67 Related 2061
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 280.00 KB (286720 bytes)
Compile time: 2018-07-16 01:37:45
MD5: 9ddea84ff363e29818899bca5c963057
SHA1: a19baf60e6eb058cff4da724c7354a428e23f145
SHA256: 88be93cc1df6e58239fd0c7a9c98da8326d30e38f4c4957856654f6823dddcdd
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-07-16 20:51:02
Last submission: 2018-07-16 20:51:02
Filename detected: - francis.exe (1)
URL file hosting
hXXp://novomet.bg/doors/brochures/apps/francis.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-07-16 03:58:45 [36/67] VirusTotal
PE Sections 3 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0x325e4 208896 a65a49d41d669a61e881d9bb8ed89b05 08242075c39e5c55fe021775b498b6f0e0767aed
.rsrc 0x36000 0x10b58 69632 0a3a0f16cde5b67916b93f6fd2113ae8 4a32886ccb244af00cb82c590d9bef2dd8966f63
.reloc 0x48000 0xc 4096 73aa7de8e1bea74762ce21cf97702346 86f1914a5c50a239169d0e1cf3445f9c535158c0
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x360e8 67624 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x46910 20 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_VERSION 0x46924 563 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
No Meta found in this file
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Library
USER32.dll
mscoree.dll
IP Found
9.15.2.14
URL(s)
No URL found
String too long
1 VERSIONINFO FILEVERSION 1,0,0,3 PRODUCTVERSION 1,0,0,3 FILEOS 0x4 FILETYPE 0x2 { BLOCK "StringFileInfo" { BLOCK "040904B0" { VALUE "CompanyName", "EZB Systems, Inc." VALUE "FileDescription", "ISOShell" VALUE "FileVersion", "1, 0, 0, 3" VALUE "InternalName", "ISOShell" VALUE "LegalCopyright", "Copyright (c) 2006-2008 EZB Systems, Inc." VALUE "OriginalFilename", "ISOShell.DLL" VALUE "ProductName", "ISOShell" VALUE "ProductVersion", "1, 0, 0, 3" } } BLOCK "VarFileInfo" { VALUE "Translation", 0x0409 0x04B0 } } PPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX
 
ToArray
CreateDecryptor
Read
pbK.Resources
Create
TransformFinalBlock
GetObject
Length
Write
Close
Copy
System.Security.Cryptography.Rijndael
S
-We
rm5
Jx>g
2S
.
KV4}
xdV5g
vI_\
Rn$ws
dm98
p[%[
+9{M
0{ec=/
Int32
PNi;
=.O.
'9E&0
6%r3:
L1dDJ
,9HM
WebServices
@?_J4l
wB3h
)+b.N4
2^:t
GetInstance
fKfh
S.zNR
Gt@}
WIKjxq XrC
C\(?
pt(i$
* _@
b@7sQ
BN/>
Y(P
!-gEV0
w(
N)SZ]X;7D
T5yL
+_(p+"
);:]
|i:8
B.(
U3)b
?EB0
_Zp9od[Z&
LateCall
'i}q
3hXw
TU9zb
T6"e
dU}
.R!%
+.y
!OB
w9%g
?Q=K
d^*W
q.WM
W(TH9
%n=L
}4j0'0
%}/Hx
V(Yi
r'I=
Create__Instance__
yg!2
=1$\
6~`S
DSo.A
_QpG
System
I_K
5L|
AssemblyTitleAttribute
]$\G
~,Iu
3'|v~
7E}3lK!Q
U	`y
Marshal
.cctor
-KG
Cd
d3
RpT4
y|)
fmSK
Ys&F
1
\UU0:A(
@P84f
!4*p
g_+
iJ6i
op_Explicit
{b{a9
/z{R
fE[s
%/5!p
wKi=
7=bc
g/
V
zt-Q
)86o
QTIE:
kernel32
nv~h
?Avt
KP$w
A4v
'h~$
Khyp<
FQk^
%xxM
Qz!\
Z~x?U
9JNb'
E?kP(
}>iw4
ilJ1Da
OdN
v(qs/
q.eP
XxeC
l)"F
AW
H(W
p1I
]RsH
s)y9
y8dbt\E
$B z
AssemblyCompanyAttribute
dva
3Ze9 C
av&C
r[R
"
)o
Hv):
6O^T
get_Computer
r^US
Y)*{q
Uk#s
i %SD
-$$CMH
4<C;
9qw4k
-E
UC,6
n\r0z
sZ&@9!
\][v?z?
DxnH
zj#
kbEy
Tq6r
wknN
B$IA
Z0Zm
ErmA
0
$Vp
'=iu&u
Iq]B
VNbA
mX9PYQ$
%i0@
>D<J.
H]p4u
k;*e
sOU1
an"{#
d`r
,5P
rFW
XJ:s
4z2BF
/0nE
L,1r
<QyU&!
#AxT
;84ro&%
PD{
get_Application
Qm!o
*j"~
;\RZ
"#ZEvi
N$x2V#
%vP:
g]=8P
w@i$
,|
@#|O
\*v ~
)d@+
SVqJ
yMY<-
pU*V
C\t2^
LpPFqL?
a&YC
zy84
p1`	<>
rY5B
d%?g
2CekWya*
}xaRr
o7C[
k+/i
#Blob
ul3c8/
Geha
T.B)
ZNkL
l&VN6
Z_0*
8^um
)4)Z
1[jK4A
SwQ-WpC
M:%`
s~oc6
WF<@
!kF)
3d6
[S
0cB(
Ny<
QCquG
nY"&r
AssemblyFileVersionAttribute
^TyeJR
Y*]1
G?(e
0[Ng
Pa=x
uD
Q
<ogTx
]/ey
Type
a^	I
rr;
T/GW
^#"n0
a-m'x
VZ(O{
kSVK
_S:y+
}
S^
BI> 7
HelpKeywordAttribute
-zoq
,DY
.1?a%
B"'l*
%=Is
Y"Pi6
bjB;
PLx/
#D7
ownld
@d`@
`/yZ
Xa^z
m ~`m
,.BT
M+_XEL
tFV,]
^n<Y
n@3\k
7qoD2
@]b
<qj0\
UF2Q5p
<-wz
s8YY7
bS`4
X;E_
B![N$,
Dn~Q
XPb
EDDPZ
O'Zm
Y_Vei
'@
n
Kn8 s
A4[]\
W|_5
]	 /tM
Uw\;
S%=K
=bWI
iJBA
&*5O
p
">
e>Oo2:>
d$GR
]6l	b
w'o0
1NDm
6.)7
Q\B~
OO"<N
(n
+@
8!5/
:C28
:3ze
(*@O
Jt[A
Drq1Z
h g9
yp
nV6
"
pl
k#Y
yW
WX~
cU:w/
r4xHq
P3wz
|2w,
l
o:<
StandardModuleAttribute
(
%BO
WrapNonExceptionThrows
o![M
JLM"
.text
TGZg
@9Mpk
nGT6!
X^0?
,_O:_
?1M6
Convert
Di *
n"lX
A:t`
r&E@4
OfTV
I48;T=(
MyApplication
6 k2
`b$IP
"U&eT
,0G
4System.Web.Services.Protocols.SoapHttpClientProtocol
(JYM
;MqECN)
5Vjp
+KA6j
Oi~b
wW	(
@uMG
-(c) 2016 John Hancock Financial Services Inc.
:|6:
uC5)z
\6l0n/
jyJlr'
zJ<}
V`P9`
NnT$D
e.WGg
0}Po
&C?X
4zpX
u8B:
-dK2
q
Z)S7o
,ko
dI[
J+@u
Q;Pk5
<\Jg
!>pG
bm,Z
-7KU
mTN EZ
_k2s
G
vL
%03E
Sj<
*VR5
:x\N
']6v
7)-3 W
h`/j
OceanEnergyInc
-~$w
Y6O3
Conversions
]'&A
1Wx:
lNs`
u
'gm
kK/p
jVwA
+`nI
8g`	d
`.rsrc
<D2
'\?
>;yZ
e4_
SH#c
&=#
UeWd4
'<<
DhfJ9
98=
$^p1
_pFO
C1`0
1v$}
mx>G
+kB@+0
dG ?
<7b_
D/Ce
0@H
}*;_|
(Fr>
><$$
FzL*
T>N/
NQ@a
L6H
M+yc
_]Z|	g
o'}
_JhB
4l;F
JY1l
^ldS
WN,}bc
[g0EH
}mg*
Drh$
7L5t
P8&%
Zf$
s%Z/
v}D-
ch"A
2ZVE
TRBB'
h@/|
*ic_m
4+'1
;P<eo*
Sex~q%
$,R3
E2I
)Ktk
tM5V
XKso
:D/>?
*A62}
@'$'
xl\
m_MyWebServicesObjectProvider
jf#WR
"HY+
)Mp(
v&+>9
[!{
U*|z|
^5Jp
>^IH
+;ADv
JKxc8qQ
|OR
F+,a
q+s`
qns~
K:p_
2K>F
+}Qg!
QYo
[,=Z
"]sG
ThreadSafeObjectProvider`1
^Bf
nU$Qb
?3Ka
rXy_
2/d'
/+,vQ
<R|;
v{IyA
HgD7
z"{B
U!
|0
@}`a
g&#(
^6w&
21Zo
~:3z
#?Bm
8'0#
y#cK^g
qfsV@
1{o{
8&
L
B6Pz
GhU`(
?F$
9tkn
;Chlm]:
bz|3
486>k'
4X3}T
vUgE`h
6Op7
X#fu
;fFH
HJ5Qn
|L!{
Qc[82
d%O:
)EH[b:
KI#q=$
UoVL
_|4
_"7Z
,/ty4
_?*f
qQ6\S5{
%@
/^]
It&g
UKw
(K@kX!
$jyT
Ds:[.
@;$#
mVz+N
2 Z
L3V
i852	Al<
s	
	R
System.IO
M}Q5
O(Z)
J2pv
user32.dll
V:CA
kZ~vsy
-;/)
W^&wL
N%m '
$+2>g
/1$r
6s
3
M4GMl-+
,*d_
xl}H@
n;v|
LV;[
$Z+
AuQC
T.J/
_buffer
instance
tj>]`^
i]{t
I5ZX
#q1]
||y2
SX]&X
>M5
=m3
1$T.I
EE	Z'
ulq}
I3PMD?*
<XdF3
2c4
MS
8`
*">6
)zVZ'
L`2X
?v9V
Cbu)CicY{
.>q]
Q'V_
O^1g3l
Q4H"8
wv<-
@`7v4
?$1P
}SDS
#De_^
KX;
S*6u7
pQy]
!|vdU
bWq
]41*f
%Qu
`^/3
j]K
ZFcm
!a9C<
E:hL
4-
GetObjectValue
Tb<`R
+ky
O%'
)j:.
)_2v
TexasIndustriesInc
^_+HY
IZ
n
!BUe#
M1ov
pWYb
nh2>
}NO_V
2pg?;<
;z	q"
moF.
\|iO
n86R
4O]_8q
TlhY
NationalCommerceFinancialCorporation
>'zy
8dPF
tB#+GYF
*vxE
U%La
x~Y&S@
HNCa
6-J^r
,ldh
Ea>9
r+pk
BxxF
,N x
[|3:=
3aR=
pT/
|:lyT)
#S
U"
dqC%
_+Dh
francis.exe
'#W]
D)J
@G}$9
2@.U
)o,Cn
y'3/
X?K?
tae5$5
=m
O`
aK;;
?J1?
n\%RHy
qcPMo
:mu}
!!PW
5PO7
Pk{m
i:}&
=7y
+f_t`
{io0n
$!/y
nPG9
Application
15r-
GetType
StringToHGlobalUni
End$
EDvA
YB{6a
ThreadStaticAttribute
a:`A
B0T#
Hux!K]
;)Fi
d@x8
k&{b
$44>
/|B^"f
B#G4q
Activator
Y|(:
{m#{
<:\o+3b
QRhQ=
@(ez
F[#n's,
8;=p
(s
+5Fd@
}qY'
LV$;
r(){
iST<d
ai`3U
d-!o
m/vO;
[e<6
'G|Y
SiT>
{j}X
A qU
2}ka
jr4(
`bX-@
'Tl@#
?i9-
r0$:
0e2)
N!1Y
l/=@
/A0I
8.0.0.0
a<37
dgk
7Tco
<Ub0
WJ/sZ
S)
(
G411
Ac|y
YDd^/6
2f6y7
RCc+
KT
&%6
Tc]_;
.`HB
EE|D
ag~{
,Z)g
kU>bB
y)h`
F	J&
|Pv{^s
ygH7
)@
;M1o`.fu
get_User
'Z<5v
5luXm
mDg
U=&
5tT=
wx?t&
K*-(
-yV
Q!N"
System.Runtime.InteropServices
!}`1
$John Hancock Financial Services Inc.
TC;
y?Cg
H3BR
TlE{
'zI
v3hX8
#"#JM
Ne%
Q_[1q
U^az
E_f~J
;cd/0
4&>4
kp	K
vzEf
;W_K
vMfI
i\Ma
QKV&^
KC+r
'}j
FahD
X4~C
%5[a
~	;f9q
+-^<M
`:Ibkb*A
H*Q][
Q0Z{
l&9>
%POz
X0wKm
~u=G
Ln+n
/<'RV
(?Lt
I
Fjt&l?
C>u~c(
&'z89S
CreateInstance
UcjF
}a<s
XdY]
qkfa
:7B "
ti/qg.
tZNv
[n~
ChangeType
J!~`
uPo=F
,7q
Nfd2
t4
#
24M?
={-
K#U4A
n,O3
x:IR
jkQH
Voja>
AILM9
zyET
9E*u
DTF<
nu.+
>Weu
./!5
{5,N20
{d96
etkK
a}i~
^.W#&
]+ PG
o0k.{P
EOr?
iHsJ
%Ug{>/
n,Y0
x^^F
=3&
e#B)
<k.!
&[C/
H(MY+
>I-9f
r_&~&
>6`
jp
,
p8=,
spK~
Z@x>q
6hhhD
_Vgx
UO!x
fRg`
Rc@R;
88P\
GetEntryAssembly
^uu "
EOVD
>/pl
'pR[
uAj^
>'8G
~ok7
oJ8Q
['-$e
:g2.o
?jyh
VkI
\)T7
?}	A
W[Xz
N@4p
W=(h
System.CodeDom.Compiler
4
,
'G2`R
|U45
u|BW
=dFN
js_W
GW0Z
&|L
yU'l
LpzZ]
0G`i
tN-c
#q5	9
0b(3
kz7"[
[Ehr
koqv
E`-
)vOB5
I:(@
gQE7%\~
.John Hancock Financial Services Inc. Hiipo Rea
uv*{;
[q/N
w"Yo$#
|j^c
-GD%
\#&}
Kmm.
EdvR
sH!qbW
Uj{a5
L@R*L
aM^lT*
CvIj$
@Uy!
:d)'
eVv
ch
8{
\~`0 yzx
j Op
.^4R
zrz#
]%B(
AC{f
;9(P
;bYy
9I?Prq
j:&e
+vsHhG
\4ix
vG[p
c@fAy\
W^=i2
Yshw
g_!c
"`=aR
8PYh
dU/
S6)C
q\'^
K[&:).
X)RP
EditorBrowsableAttribute
L{zz=t
<f"5
ToString
]#[b;
%l9Lv
tD4/
!LiH
</hH
Q%&Xz
|Cd
~e0Q
(pW'k
(YW-d
i`WXh
jl+
Zm1p
G
a
,YKP
(*3\8
--PX
3HDf
WlbD
GIY?ME
$86U
M]gT^K
5w[?P
kFQP
}yWqqu
lLf
QvOEP
]G=&
Glu
DebuggerHiddenAttribute
$LP'I
rVcCz&
cF+Dz
yIz#
fnQ4
v'ZH
I
ipQ}_O*
) N`
SNS\
DP d
3dx$ybv
p(QP
=p:;f
MW
bJ!-
Xz33]
. ~I
=
yO
5
aN
knpC
! IP
=J/6f
1$$
x/
F
Hqb>fq*H)e
<9oz
=<?l
Td
-
}	,4
pLPE\`
Rxw(
q&](
w1B"
%O}zn
~cVW
w)2@
@+kl
?
@UKhR
K<me
<2g:>
GypA
yhlo
ow#<
GvY1
h,ZG$/G&=
WvF0
Flc
H Y
`
$m?:@
bY*OS?O/
z{6j!
XdT
{aw:y
_@Fe;
xM)+
9qt
M\)V&6
UO_.
ee\u
*5fUk
MVL;
mylNr
h<lr
ziU^
r0C+
ap]=j
#Strings
f9BRzB
331x
:}y(
2=^t
!uki]
.ctor
O1z|
\%`N
McDj
84' <*
Kfx{
|2^Z
jQ0
c>%%
Vs@9
oAd#P(
qxds
sHb[
Ah9Rf
zpg_i
gP7{Hl
Main
@CWB
1ph3vmD
1
M7
tL7s
%cxu
z"T2
(;1`z
System.IO.Compression
Wk{
NsK'A
Or\s
WN)Fi
r=0Is
_BT
04"P
WX4=z
A},B
[wZ1i
'k;k
0jt=>
M)}=&#~
VG{
'SlM
DRZSE
R!!9"
w=WZ
\z9@
(p[R
=|
^cvA!
!6C@
0n9:kg
rDeE
tC&
$	z0
xhYE
S!bo#z
J3^>R,
@.reloc
l9x&
^,+8|
&UnX]
)Txj
9DS=D
=lCj
XhE)K
_YV4-R
2O3s
drr
9dP=~
Bk'h|M
dq
{
QceW
mVuf
v^[cMe
,;pm#
X$m,y
Byte
}j|z
}n|
R#7V
e|}lDa
C}~[>
~}plB
59KD1e
dmDo9
_4W[
w>34
U-M^P,
eBJ;
{&[E
[o>T
_~HL!	0
ve\=
<uzI
@u#
Lz6(
45T`
System.Diagnostics
)a>y
~`ZW
NL9(
57z1
8#vv
D#Ft
n)@}#n
C
>QwE
E8,w
J0
S{K{sX
zD.z
T-;Ze>
7V<}
?mJ5C
b iH6
-?G
VycQ
fl`
e
no
H2IDE]
get_Location
d&
&s
-NYi%
g=1O
/)\e
*iW@
h^3t
= {
K.^/
b-x5
i3d1q
LoewsCorporation
Bxd/t:
?GqfH\!ct!
wEr4
WV]%
Z<c/F
irG
GtfD8
k[sV
YorkInternationalCorp
g;=*
0ALW
c413^`
jkk
2\1R/
'^n.U
uhz$
;N(D
S }d
UTVE
TXoK
;=Dm
I1Y;
RuntimeCompatibilityAttribute
!6&Y
ju#
|
.rZ
vl9_l
ZI\%"
6rjT
!si/
KIjS
TUG
Assembly
#
yE
`/Xs
\Tgjt
Y50
'<x[g
q	<e
<3%n
'p)J
T?:`
P2@R
F3ol
!GpD
#FW_
V=$4>W7W
eSzK
UVp_
O|WH
`Je4
lR5N7DS
K'^
Z!lS
mRj
)2L{
-CiNEO
eh|xO
*R&gE
{GBy
4>)UN5
1<I@
%VSf
zyFk3
StaffLeasingInc
A*i1
#!C
,uQXR=
!ba
#[]J
,_;
xvZ6
ORlP[
2@q%
[l*j
9rj[
F2/V
{
,n5
.]j+
|UR()u@
.k*#k
e
uE
U
\@Yk
8P^6i
%hqz
g>N
HDi
My.WebServices
P,d
=QV7
zf$
]O{9
+"pg
}_O%OF
Y1hy
PE9F
):q
j'.\
+jH$
UhI
(C6l
8ci"
T'NL
a(0v
@nA&sE
2`@d
ToInt32
7F?J
7smD
1gC%1tu
H'7
zQA%
3ZG[
^G#x y
,H|S
ProvidentFinancialGroup
9+:H
7iZ
Et2KBe
-m(
_O|T*
n**B
bj&o^#P
Vdq3O$*
7(b
Fn]E/Ti
{3O^
(:b+
{K /N
b>|y
U-Rb
XC-B{
'GIT
GXB?
>=WW
/RN$
J1gaGPi
d;:!
Sx\-&=
n3
2ybT
@,&|
v~Xi
/C^<
T[nb9
ResourceManager
&Rv!
fb1i
8
="s){
%G}b
(
	<A
jvnO
Q[>l
>Re/
4y	H
)2RI
J6P{M
;`2xhB
Pk
w-"H
pKl&
#n<)
MPLl$`5g+
Lt~7N
a",i
89LX
d{')J
}yjTIB
gKyed
MyGroupCollectionAttribute
hH/$
u!i
[D)2
System.Resources
B@)FY
2~t\
m9',
JDdlr
ayqR`uS
!Pt
tx6M
mdnh:
)pyV*]
+i\qbU
xN4hf
-N/
".lN
WX\GNsrH
francis
;.On
T*x7
4R$hzW
H,QBD|
.&F/
_,f-'
>;L6;J
AssemblyCopyrightAttribute
@L |
$5~G7
O
9ZX8
}q\R
irf<Z
VG@gZ
`#h$
$R!-
o3(9
w7A-
Equals
b6z
}o3f
AE]}
Q*gc'
abJ619
Nu'
!AW6
ljU3
MyComputer
E>H=
Operators
jl{eO-
TCh
JS@*,
ROfJu
{@9Sx
VZ}&
^
C/
up71_
VC@,yM
N3"4
-Rvl2
r3_G
<u;[H
nrf4
Sct1
`pP5 I'
fNn[$
es5
#fdZ
*k^A
BwStH
vH-?y
a(k5
kay9
J1":
Wwy&<
pvV
bEcG$
+CJa
$Fz
.Gl3
WCsk
g@B}+
n_"K
6@B:
Va
~
90l
BSJB
`4	C
(W7s
7H-$
rm
W\#Y
Computer
{!&@+
l<q$
mT<xO
p6M
qaCI
Wnx[
;O?
6q;d
l0&P
?ptl
#"jHA(
-'1"SJZf
lg0H
<muz9f
My.User
OFD3c
S _JkD
Uq~m
sF4=#I
1IeG'=
8bnap
Lsq1
#ybMC
qw*f
"}[.
EW'Q&
qxD";
ykp?4Q
X8[<l
gx n
}yoK
~rvRO
Takt
c$2E}
D=<@
aU}R
fKmX
[Gk0
@5{?
"r	C
)#lr
[	?z
|7sH
$)	muz
(NnYW
v+ZXr
%[Q.6
K9ZHH>
mscorlib
l{8?
-,M7
9{-5U
Ql-'|z
'xSh!
K[rsv5
nR[F
Uql(
on|9
bn@G
=%t
BgwM4i6
E,W*
*H1+
!vsY
q&Mg9
;dF
TC2J
U1d?*h
m_UserObjectProvider
X%7S!
'=$CP
\xi)
#J	7
5=;e
IpeG4j
}5K!
4:a^
gg@Xt
R4{2
]%s#
0J$
Ixbi
idj0
4-	I
P|(n
W%1.qn
.W+@
.-ql
System.Reflection
n!reW
]sW[
>uO$G5
RuntimeTypeHandle
G=.;
89=.
-#V->C
\;}Au
(O]h
ktx~\4
K!3s=
>/
R
i3ip|r
P` z
m_b*2!33
zl"b|
|(64'
!}_]
@k!|
{
p,U
#z?K
F&>}
Z*F
%.~7r6
54V+
B>}
EXLv
-6wT
s{n!
pq+#
zp3|
klAP
+ ^x
!js1
nTg
wR*f
T!k!
}T6
<%2a;
`
_[e
KiR?
Bg=x
y~sg
EX5z
wz7
#Dwe
Kh/W
u
Vtb1
irEh
v._N
&*d#L
)EPG
4nrV
=^zv
8
AssemblyDescriptionAttribute
9z/\[
IntPtr
)Babx
RQAo
;&9z#T&
[b
Ib
jvTw?
Rr;6
Pfh
534u
L[9(
$. AiG
,\n^
z?YV
O]Y0
a#I,
V>m:
~?|7+E
*5Q/
jaFi
J>= cmD
0"|
tn
8b
5CHI
9m5wF
\H
V
AQ/u_
@
z!ua
#6ey
dOPQuA
*>5
pb
CFZ;
$;?
A5lL
j	$zh
9!%6-H
>6	d
<G]2V
i8%{
&-	Wv
n'qU
\tue
M=bE<
(lW1.
cfMZ
pmO
zgRe~
9nst
NRP)
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
U_HD:
G;.3
l5"cF
XK`=i#
Q*l$
~ YmbWU
4aQh
l[)G
p*XC
^|bC;
n79R
jxX
mscoree.dll
!This program cannot be run in DOS mode.

$
ZlUJBG
/^.i
v0N9u(
aFu~
qT]N1
0"f~x
nTvx
\1O]
V."
'Bo&
T]ASzk
gO
b
Dispose
ci&mJ
W\k&XW
Cw}C
GetHashCode
^f;0
`]N4
{Jw&;n
[H6S
aX2/
$CQ
=P0/ "
xJ-
l9.!
D"at
Q|B;
eF}eX
~"sIb"
.xs_i
yN
V
mzx	V
K
:2~t
,@7U
/lM`p
LateSetComplex
F
?-
qv6( 2l
v3-
]^9cY
LateGet
Sv"4
h ({
BH<eR
1_yWf
get_GetInstance
[:
vD%\
?QY'
YcR
&DbDq
[n|qj
R
pJb
A-	2
~ljse
:KW)
3`;s
,0/UMVJ
-F=n
1&d$
|sjj
<}:
R`@%C
'l']
(<l{
K(' Y
{/j6
n
Nq
$!!up=t
d2)5
S)k|
Rm4f5
f3VV
Hg0
1qIf
1MaG
]s*Jv
(BU3+4
$5{T
10A?0
20B/
jrjh
'LVz
U6>
.)3a^/
;&?N7
jMbb
w/SS(1
j`o
2J-4
5Zw%2
)E]te
\a7JrN
}$\
+{7s
\#zd
mat
/,`N!
T'x?{
fEhW
mPv(
w^
xX?6
{TI7
]7'P
#h 6v
8<h}
c(~2
{XV1nA5mm.Qa
ZBS'UTI
GLl=
zPu'
AP-+
c1h0
uX]G
J5l8
&O>0Z
kv
O	D\
STAThreadAttribute
?T)D
Ol?
WGBr
Ocq(
73q}j
/zQ^
!FdX)
YX1qv
Usm7
GK<=
;8'k|K=
E$|=
wY0
R7Vo
Se	NA
,[F55
dY9+
X>
"
/=n	L
8#mD
J:LA
X6*R
HH8
;tH8
;HL,
;w<x
E)JqH7
f
v%;p
.e0fv
C
P!z
^ngQo
uc
p
Hp1r
{d]Ag
YUFD
z5jK
NKJc
D;2`vC~
}lSN^*
FLt)
C2cP
dEUI
K] e
%>0=
9Lc4
a^,bk
R+{8
2A=O
Ud?q
?<84
QarJ
2Nv=
Mjo?4
DxF@
1RP,
UxHJF
[	k8
s/l9
&E
T
k.\(
jlQQ
=_G
"s:7
).4@
m{<:
=LcB
Boolean
O9aJ>
.ApuhP
vhxO
hH}?
='eIX
o8`^-
'RBj\W
XB2C
LN

3
T|0|J
bUr|>
5H!8hHa
\%@h
@2Z8
T!v>
kUB%
,?]3}
mkQS
bc)]
G&U
CompilationRelaxationsAttribute
get_WebServices
mN^:
3q
E
]d9~)
?2}F;4
-55W
V\&
58w=
o74*h
#\sY
NPK(
h$v
c	af
%C	j
B<B25l6F
-hRR
LBc;
< 3!
m;d!R0
o/haU*
pl
4
R&q
x3
xy\o`k6dN
I
]F
"'oM
1QG`UN
pCL3
E(Bd/k
68I;
%Jt~c
bytes
laET
B<BXa
.RTc
7(ZH
ZX,s
39C{s
%84V
H|'K9
)D'N
S"FF
8$'HHo
\g
w
y:[Y-
4n?e&Kw
J'/
+-E^
y$ 9
cEoOr
6rp
B
d0Yx
l!&7%
P9:
HideModuleNameAttribute
z@
-YB"gq
X/j!F
JQZY
{\3Z
6.^N&
Microsoft.VisualBasic
y$o|"
T3fw
!pmYd
XD+}"
DS|=
IP<Z|
##*;Z
dqM:
+4o%
IO4.
]IL5
,HMK
*l(&
*,+(
abyV
Ab?m
o	]I
]Q~A
RT@u
su"E$
$+rx
nP*"
]TWl(

y>?U]s
"XYt
fsR
V 22Z
@Ni
dZbvE
a<X#g
n2?j
c&n[A
o8lrw
He1c
W3vr
p][
g/su
3Rt*
~+
:
6	ZM
\KxR%i
<;6Z
5.*1
BrzW
fGu$p
R=L
;Y/'
1}<A
F3GRR
#zd=
EEW
D}7Y
j0^+
Jc(Os
Xct
lI7
RQt~
hz9B
y5HO
CompilerGeneratedAttribute
rHyS
Sk`D
ro	%
JE0.
?yE
H'{A
U[hB7
<MHt
t~3&
n{PR
cm-;n
mg=6
1 VERSIONINFO
FILEVERSION 1,0,0,3
PRODUCTVERSION 1,0,0,3
FILEOS 0x4
FILETYPE 0x2
{
BLOCK "StringFileInfo"
{
	BLOCK "040904B0"
	{
		VALUE "CompanyName", "EZB Systems, Inc."
		VALUE "FileDescription", "ISOShell"
		VALUE "FileVersion", "1, 0, 0, 3"
		VALUE "InternalName", "ISOShell"
		VALUE "LegalCopyright", "Copyright (c) 2006-2008 EZB Systems, Inc."
		VALUE "OriginalFilename", "ISOShell.DLL"
		VALUE "ProductName", "ISOShell"
		VALUE "ProductVersion", "1, 0, 0, 3"
	}
}

BLOCK "VarFileInfo"
{
	VALUE "Translation", 0x0409 0x04B0  
}
}
PPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX
2=SA
x7HH
CCc7
w+E
e
2Bw]	'@
T)|R~s
XE`(
x<TF
Upu3<]R
{.=X
e{`Q
r=.W
J${dQ
@fd&`
*9;
MV!qHnA
hg2F
(;-9
T;RC
8dv2_
FH&'a
qHcI
vq[<
YpaO
u2<Q
{$#*X
Microsoft.VisualBasic.Devices
=!
}hMy
`zY13TMl
,@Q:
mG))
MyTemplate
t+M
$~O*
VcU3K
4&W$
$_2
\System.Object[], mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089PA
/n'?
yop"
=UZ89
-t0f
+#l@
Yo8c
4Ck#
fs{u
{Y2nt
VY40
2M.
" $A
cZ%Z
!Yf
;L
System.IO.MemoryStream
-jO2C
'/o
v]zg82
i-Fth
Sl6N2
L*a/
O.72
TPx=
6YZ
n
4a_l
FKQX
IlGA
w_o
{o<a*
i</}
Gb0#
1V3/
|d'_
N8fk
D_orq
KThnA
FiDd=m^p
.	l8m
GZipStream
)j2l9
dF#
"x7?U
F^Wg
U$_]x
KQd}Pl&
|P7U
{3]P
-2h*
@%9/
$PvM
rsL, Vq:
U7 ZG
#\=u
|KXo
`~:x
[ON%
>Q;Et
Uk0C
U8d}(
kLX
WP+S
u.?pK
n]KJU
Ziuw
q7ga0
|lbL
G{b5
jI9h
<go?
Seai&v
)#0
cY
mY
LateIndexGet
>g1/=?
G@bn&
!Z}
S-QO
R3h?
{bLN
\sq,
D!4$
I`=y
`Gkx9
W9Q6D
k#9Ja
S2
$
`
Q,
z`jJ?XQ
6OA<
-eaiZ
v%Of
z'sQ
>w16
ockV
Microsoft.VisualBasic.CompilerServices
{?T
$()
r<@ra
jAd2
Oywe
_Oze
\E_F
7:O
9wRA
@]SB#
P@&YsN
d@7q2
+mQSQ
:!d^
p?!
hE&
+I9=
AJo>?
SeY=
UQ%)
yc^7
A)=
hUyX
/7}z
L"U}
Va#w
+om@
5Ok$)
_jW&
User
8w>!j
MailWellInc
RNMW&D
7LP;
n=I/
CPr	a
uA3
qGp6]@
5z|xN
;	%
0
u|OlP}
ApplicationBase
d=m{p
66SQ
i:!9
<_b0
F|m:L
pbK.Resources.resources
y_fF
wM
h
[hu2M
##W
[PKi
}7ff
<}0	%
rIGYnF)
oVoB
Jx?@F+*}
}MN`
d
OE
K2B~
8`We
eY'S
/'G?0;
LtV	c+
IGY>
uM28
BA:*
Dispose__Instance__
;[$a.
?yZA
jS"nl%
VUe,
]#H
?rp]6
){Q[H
_"H!
e$_@
|WW
vG
j
lPIWclT
lY!s,^
rjB
#aVe
hjP;
D4Rz
VZ	
=
'lYzg8A
OB48
-vd;
j=lw
p}(6
~7>!L5
RuntimeHelpers
tT~t%F
)S|.
MXpD
frR_
t-7&UHR
+!DV
m_AppObjectProvider
LWS7A
\6WNo
5M.T}j4
jJzu
x~{b
A>Fz
yi@
i\
=
g}7[
QA_L
d,2!
9DV@<#
4'^0-
f.rK
ei6K
vE8EK
Qoa2
Object
W,@Y
YqA\gI
Ud\T
BsI
$o
s
DirY
~H"Y
ComVisibleAttribute
o-4>
>AlAkw
KJy!
V	zG
c8T2C
oq"0+
8R9B
O3fl
huvj
:>C}
yjs0
HNFo
/h8j
`u0*`
6/5r}
-CvT
}3"u
_isOpen
Xwam
AINl!'
7x
kp
j|B
(R9zd
EditorBrowsableState
E<!F
q"qz
+&g
V{d?
1,SY
=o_W
hx_xEhX
YUH-
Gd5m
Dklk
2yHU#
aZ1#
x"gC
Rr%^D
DllImportAttribute
i9h:
j=au
Ej~J
'PB
F}'q
_CorExeMain
R0q=QH
s Q=6
gVg
k'6\}JLy
87a%
i8NG
{6O?jz
;MEN
x5gz5<
_j*u
IBR#
$r{HWd
[5	O
Stream
k_:w
ynU{	=
zcGIn=}B
3!o2
c
Ov
D0Ip
{n[Qm.
;6`WP
h!eI
UZ[4
dK^#)
Q3	0aq
JBtw
cG>nF
59R
=#u8u
=0F&
c}]IF0
'vc?
}@Ut
q/)"
iq{C
D
gp
=C5
JnsU
l
O='7
f>U'
cEp2u<
=<fZ
%3?H
|,j(~
JNb&
17pE
u}_y
-cHQ
gW9
sA9
b}Nz
G#'/
_origin	_position
-
X^
L<W1
0KL@w
8>J.L
>4C"U0
":!(
GY;#
XJeQ
:3gA
,)b/
N=so4
c'`;
Yq
g"R
D8IdJu)
YlSFL%
#d
VL",
:n<=
z\d
'<m?
jcdG
71N'K
xaAT
MemoryStream
'I``2
_W{O
"wK;W)
;jraN#
2X&FG
Im%<
N$2y&
}E)
D
.C
w>cR*A
JbW:
d(!
7;*-
1^<Q
1vj7
e?
KQ)sM
k5!0
C}g9
A!_$
0M8D
|yWZ
3j<;
MC?v1C
d22i
Wi<i R
2'pLN
L$6u8#1u
M}x:
R
}^H
'[zp
;:\V
5'7>
l!\s
.nF!bJ
kbCir
D!-vc
9=[9
dAZ$
ZCyJ
_B;
FrKD
7 P]
<d|%
15#q
Pn"z
Y[E
`KAaix
z%@<
c6Kb
i6
S
zO%&|/
gYzw
&p&\
Y3	EVX
+>>q
_3`G
[5n}
MarshalByRefObject+__identity
U+r'~y[
P/>
+hvr
bXGJ4kw
yy"+%
d4BI!
(x--Y
VH$
jHM/
/M@#
j%^A
}5./)
*@+XA$l
=9'O
0m9&WA6,$
yeD~
Microsoft.VisualBasic.ApplicationServices
!"3'
SztJ
2+$F
XTM%
OWCU1
TG
}
uY>\m:
<o]ht
&n'6P
QyP_
-xR&
2@&u
=(t3
.
a^86
6
;,
.NPs
kL{V
Y~nq
)6ULn
xbrh
1^^D
HWj-A
4by^0
Q!9\
`m,[
@y3C#
8sRz~
&D(sFYPR
v<Ub
B^>!
`4jM
MrncW
5v:KN
$$vZ
.f.`
A-r1
Hhmm
0`?h
A&(1K
6fA
WFJ2y9
&EUJb
My.Computer
&/Wo
bHI=
guH-
Q!+f
l1NA
,)e~
v2.0.50727
:f0F
eSrOi
4`%K
KPr]N'
n3XL
(Y [3
D2,+=
tPHbv
;C;H
bkKO
v2g
4MwX7
GT}`Y
{6lCIL
E@ y
{{(z
UsuW
^2e+:o*
%3/B9
ZZ:q
UgxS
I,:%@
ShMI#Y
,dC-}`
ktt=
q:i-
{5[}
Z#
zl
QZgu`
8/
p!
W,?j:
jU[X{b
d8YP)
_DIC
RN~\
:FSS
VUr9
9.15.2.14
#|<o7
eVTFN
oGts!
p~~:
6lr+
@P|5_
R
-:
$l
u47
%\Po
ConditionalCompareObjectGreater
`]-8
j?!H(T
GetTypeFromHandle
XqHR
vjEeTH
O;iA
L~^;l
zy%V(
8SY/
E#%3
1KTSE
ManorCareInc
KX"F
Zn"
=IgzY
=&N.
z+R
2H_/
']qn
,aGW
*6%A
dp;BF
Qr1kX	~3zD
8-Qg~k
3'GH
LzDc
fau^
V7pk6
v0KjP
~Um\
>}y$eL
xT1j
>d c
o1bM
w9/y
u"9>
DQ?t~k:
fqJ^
YHLr
OCth
60t9Bg
System.ComponentModel.Design
IoNB	rtP
v~(
TC;2
.79
&
L
>tIr?
Q^
_1o
yk`
7i(P
!Zwa
YJ]
`E=3^6=+
]6kk
"8}q{_
OB2M-q
zX[.
d'PP
o{Jt
$G*
;uiZQ
3..k
9ef
JXqu
R!r	|*
]b/O
?O_iV
/yw%
A[rA
&e8z
Q0M0
{V?c
/='_-
Sv%qI
System.Runtime.CompilerServices
`htN
V<fe-m
RjHbp
3O	;
QN#g
$
PB
Vx*wC9
Pe[+s
'+q#
q0suC8
NewLateBinding
fHV>8L:n
&%9c
p8Ng~!
j~wd1
D	Hi
gr+;{
c/0#
FTRR
[cs#
9:se(X
~BQ"
!EP5;O
Sgf
T/fJ
pe3\[
LK9J4s
l,A1
$2
#
m<v
*aE*1
KAm;B+[
bwD
NVRInc
9$a}7
5:O{
i b)P
iAJh
D7pA
(8Tq
zK N
4?>Q
dF?A
[1ouY
g5d
ipn0
IDisposable
PVZ"h
)O.[Uy
x _3e
S4Wz
!6|9'
8Kn"
XQekqM@
nWIe
K o|
)I9t
SunHealthcareGroupInc
W)L
x
)m
q){r$
U;eZ6~
}M5]
S+%v
~7(fXa
H\0=
(*kcLSa
,Z5Z
CompressionMode
My.Application
AEUJ
~
R
F6ty
AssemblyProductAttribute
qtFn
Jf4
*?^qZ
i8J?5\,R
UxI&#
t#s]
GVVm
X
ybo
C
PVj
"B6k/MAC
<Module>
mU V
GGJey~l
9PAu
$]vW
-XwKW
ToysRUsInc
KQ(
Npn}D
smz.
-G`Ds
es[7
2etf
b]q!
S@FI>
=\.A-B
e[vGB
oYx
D"&{
\L'<
#C3>7
_vHN< F
01!3&
\\	L3R
LY/)'
xloo
kqO:6
8#LD
c?&d
g&)m]
^|/0
[Wi$
uT|M
qi1W8
n.;$
pDxc
l?'j
nSKi
|2	{
3oE1<%
}0}I
FDwl
#GUID
q&>Y
gk5I
eG\,
-V x
ILSUF
mRYJ=
KC0B
y
-tCn
4+{XU
VTos	n
Tip;qG
w&TH
6'sP
\vl;
#h
;
WVq{
%l)dLm)
Y)(C
GH}+K
Ur6
2Vk%
m_ComputerObjectProvider
F]4 ~
)<jG)E7
q`U4=Q
q ]
w}	l
7F[V
8g=e<
[E@w
CallWindowProc
y9~V
k1IC
nw1Y
PrH~
0#p*
SoiL~26
:5kmW
C9Z'2
r'Jo
j[m\}/
fsX:r<
:W}|
^@kZ
!I5%
0
rEW
*/<+
W4i.
Nf%&
l*f1My
lE|+
"1*j
|j8w
`*#+
j2
e
pq,2
0T?XY
V;n(
5=BIzE
e`
WorldComInc
BzRB&
&\x&
V1)ZO@
,}"'
G'~E
DO	p
4R%W
Pl;M $t
FSav7
#gR\D
4# +w
hF'T
F``n
>BJMM
P1~
e4dV
!7JOz
bzqx
n3M.
GHE)
amp<
t8>/
M7^t5H
^ld6M
^i'y
C5RD
x 4o
wE%y
Z.eoP
~D?r
%Fznx
^%tc
/dXQ
/S,X
2=ki?
iBI
+/`>
r\_@I
r97
\WHIxpI
}\tbET$
pI,c
2kv6y
;1ar
TIXo/XA
B$Z(
Rf;?
3'JJ
H1`t
!3c_
c]|M
System.ComponentModel
ETOg$L
m_ThreadStaticValue
T=k
E{("
M/]p
c$X4
SouthernCompany
bbc"VC0
;N2*
)N
6
pMu+
mk
MyWebServices
[s|Y
5g~@N
MUie
NAIT;
_6P)
R+hcYn
aiPL
J|Ke
YKOKHO
7r@z3
._c;
.g%O
&Adn
JDh//|
vgGrht]

~s>%3g
h~[j
fA[o
-\m4
f_pOq`
- @m
uV22
MyProject
~<8Qz{
PittstonBrinksGroup
5R7
T
BGw*qW
?3.$
u<*|(
*"Wt
p>*N
Xw~
#>|`t
]	Q#
#>.fR
-lW4WS
3R%C
mzoa
|<+
tA4k[
d1F-
o(
[^({
>$K~F
f3tF
f%qq
R
3@}
oQ_{
-p6
TektronixInc
$T5e
_length	_capacity_expandable	_writable
_exposable
}j	(
Ge%"
,	NU
GeneratedCodeAttribute
Hcn9(
_gp>&
;\V#'
+Xh>
CT3f
wFb2
Bo;
`J>X
.#7C
G7B4
CL7J
{:=A
VirtualAlloc
5!x>D(
Gqh%
2/.e
OZjY
@nG
!lehg
/wG
c;q%
J)'w
i1;B
I:EL
v9wvu
V#nWY3
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05b_64 Seven05b_64 VirtualBox 2018-07-16 20:46:02 2018-07-16 20:48:55 173

3 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven05b_64 Seven05b_64 VirtualBox 2018-07-16 20:46:02 2018-07-16 20:48:55 173

7 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\francis.exe.config
C:\Users\Seven01\AppData\Local\Temp\francis.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\francis.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Users\Seven01\AppData\Local\Temp\francis.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\Globalization\it-it.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Users\Seven01\AppData\Local\Temp\it-IT\francis.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\francis.resources\francis.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\francis.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\francis.resources\francis.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it.nlp
C:\Users\Seven01\AppData\Local\Temp\it\francis.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\francis.resources\francis.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\francis.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\francis.resources\francis.resources.exe
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bcrypt.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2520.13273843
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2520.13273843
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2520.13273875

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\francis.exe.config
C:\Users\Seven01\AppData\Local\Temp\francis.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll

Write Files

Nothing to display

Delete Files

C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2520.13273843
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2520.13273843
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2520.13273875

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\francis.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\20852014\4e5b5ba
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.8.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Web__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7d6a992c\6d51251d
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|francis.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|francis.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|francis.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7d6a992c\1ef31b
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Classes\AppID\francis.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE\AppCompat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\DefaultAccessPermission
HKEY_CURRENT_USER\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledProcesses\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\559179E6
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledSessions\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\DefaultAccessPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\559179E6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Write Keys

Nothing to display

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
uxtheme.dll.ThemeInitApiHook
user32.dll.IsProcessDPIAware
kernel32.dll.QueryActCtxW
ole32.dll.CoGetContextToken
kernel32.dll.GetVersionExW
kernel32.dll.GetFullPathNameW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.GetUserDefaultUILanguage
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
bcrypt.dll.BCryptGetFipsAlgorithmMode
kernel32.dll.LocalAlloc
kernel32.dll.RtlMoveMemory
kernel32.dll.VirtualAlloc
user32.dll.CallWindowProcA
ole32.dll.CoWaitForMultipleHandles
sechost.dll.LookupAccountNameLocalW
advapi32.dll.LookupAccountSidW
sechost.dll.LookupAccountSidLocalW
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptGenRandom
ole32.dll.NdrOleInitializeExtension
ole32.dll.CoGetClassObject
ole32.dll.CoGetMarshalSizeMax
ole32.dll.CoMarshalInterface
ole32.dll.CoUnmarshalInterface
ole32.dll.StringFromIID
ole32.dll.CoGetPSClsid
ole32.dll.CoTaskMemAlloc
ole32.dll.CoTaskMemFree
ole32.dll.CoCreateInstance
ole32.dll.CoReleaseMarshalData
ole32.dll.DcomChannelSetHResult
rpcrtremote.dll.I_RpcExtInitializeExtensionPoint
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
cryptsp.dll.CryptReleaseContext
advapi32.dll.EventUnregister

Execute Commands

Nothing to display

Started Services

Nothing to display

Created Services

Nothing to display

#infosec #automation

TheSystem Itself @ 2018-07-16 20:51:05