MalScore
100/100

Timeflies.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 44/67 Related 2697
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 255.00 KB (261120 bytes)
Compile time: 2017-04-22 01:02:24
MD5: bba3bf70677f130212bef8b54f7f94fc
SHA1: 53484acf32116964c34d751ee060096825860554
SHA256: 65194eaf81925db2413ac1170fc013fc4eff1f1bbf86810cccde8130dcfc443d
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 5 nq!$nKo9 .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-02-12 20:05:33
Last submission: 2018-02-12 20:05:33
Filename detected: - Timeflies.exe (1)
URL file hosting
hXXp://[www].wesleymedsupply.com/Geek/Timeflies.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-02-05 22:39:30 [44/67] VirusTotal
PE Sections 3 suspicious
Name VAddress VSize Size MD5 SHA1
nq!$nKo9 0x2000 0x3b3e0 242688 d1e9331626cbd3af4a3e64c8073587d3 0b88e6193c1fc7d964d633b8c44e3369791ad4af
.text 0x3e000 0x3a60 15360 34d08d384d79c8788a93b1e17a2f1fe2 bf892fd8db63e8e7b8f4aa69df8a581d4b3ea574
.rsrc 0x42000 0x248 1024 4525dfe2a4b297be7e04a7090870b78e 55811bd305b31713d341e80b84130a7c2d7dfecf
.reloc 0x44000 0xc 512 380d0b774731f70627ad921c0bedaea8 f9f74e6be17c0e8b76286d014a5500de6d1fba63
0x46000 0x10 512 e84aff82c7bf31c6aebe19d03099d723 cbc1f30f380a966bbc323aca38628d980c65d18a
PE Resources
Name Offset Size Language Sublanguage Data
RT_MANIFEST 0x42058 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
No Meta found in this file
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
No packers found for this file
File found
FIle type: Library
KERNEL32.dll
mscoree.dll
IP Found
No IP detected
URL(s)
No URL found
92h
96v
eIT
96r
5'L
52h
5-X
5.^
96y
9.^
94k
94p
I6|
9(P
9#F
1 =j
s=nTw
At|p
f'|>(
"jF)
g >(
{B2B\
un42F
/_FC
GetHINSTANCE
GNdA
h2lh#
?g/y
RTf
BBNWV
X.,?
M|Tn
.BeU
_MethodInfo
"=%r
.7S9
}3/Y;+
%UB*"
eS1C
~AAo
g@t\&
N~mi
G*u$y<9n
Xgh\
DCz8
Char
l!<<BKjWG!<3rGZ\S W1&D:N"
1cku)
i8MF|_*(6J>;dQR?Wz7dI1$x(
BNuG
v.n2
k Zu
=oI
ZHuzhaexaexyhy.Resources.resources
^~AtH
u"Q(((mUP)WJ'[a`e>M-3 $j-
: f4h=
f*'0
z;e.=
kA\
\zA>
GtNpLt-'YrZm]R/%C71gSqtl!
`06Up
|8P$
}dW-
$&^a
W#
F&H_
u ue
9:&,x9
9qrZ
!j8J
Vq03p
V:ii
se+,H8
.]ip
I`3p
J'hz
gq'kD
m)~Y6
_R].U
z jT
S'g3O
A;cqvlXE@X9SZ3+"mV gNYt,!
G<S7
KVC:
k8/
W+;z
v\+l
5Zre
]@;$
Yx4l
5I9+
y0FeD
J"v!
R#<h
:Y3a
>LHJ1
SabL q!<"
#K).
M*|8
(
g5f^1
} Q]wX<
S_%4
plO
r_dN
aUhd
w f~i
nl[z
BC3.L
k. O
czXY"
IdGn
N\n/
_5>F
>`2b0%HgL6`^{U5O[&P}{0Y9*
/ pO%V C
jU7{
{;l
hcz%
vLuX
Jc+r
t$Dc
LY86v2v
&#=-~/
oz[IO/
1j.e
%2RX
%uR|I
"Z@1w
VB);2
V{13
)Z,S
|eLhyi
/60M|Q
;{&h Y
zU8q>
l 9c
RuntimeFieldHandle
rJd8
System.Security
6/e_UB_,6%>O`7a&_+Fk4:Yd#
h3W~
KOa&b
"4!U
:rMZ
G59U
Bic(
}LEsT
NU*D
|&B>S
Rb<&
|(D/
{FYbc
pA{:
pWz pjy
<tyhe
]%%7
_5u
X\(J
50_A
[##mHX[t~>`X(}oH[s6UyJg_$
n4\F#
Hi<5
HFwHU
t*"q
KIQ=
%EK\
-U/
b`Oc E
]c<7
V;eaq
J*=>
?P(W
! AlK'
,Qej
Write
U] "oY
6\%:
Concat
#2e
\PFp
hFmvY-
^d_^x
oE G
$+Kl
1$uW&
`1YWK
Rf>:
8:nd>
KBL
R^-.W
@x]u ,>}6s=Az(s6O/$BD:6N'
"l<d
^tse
get_FullyQualifiedName
V$JU x5
IO{A
zs.}
RK#QV
#)Qp
~f4=
9zEjE
yW44MDfmZ{%Rdjc|CJ,Un)En&
.n$:|
$AX:
pS{;
^n0~
YN "
:9QI
8J<x
d8&T
e8.HLu
@su5a
.LY_
}8@E8
Enumerable
:)L)Z5
-d[GI
"fHN
{3h
bW J
0QVq
v/jo
#'eg
rb8=n
e :,K
WQL
9x2{^
O<N%
Installer
OnPaint
v@%\ PRT
"1bP
pW)_>e
get_CurrentDomain
6q>
LkbRSi
\A!6
Lr3}
wKo
V21K
3#1=K
Kk5$E
w+WC
jDjDoSf XqC%9\FY$7dsAY1}&
bc%
Do^W
1qkJ
IContainer
_eAWqe
E)h7
:$ kL
Q[BS5xtM+fI_AJGp'W89T,Ny!
pK\&
t7m<c\P)S+w
zs&b6y7Ei:pWJ34=!x&q0Xw-$
|R>j
5{NJnMI=&< ^/)NP]b0[9nM+"
wH|9
y;\N
i9S'
xV,Iu
_5)"$
%+|@
wg;&
0,eAcO
Pdjq
a*')
W'D>
r]=J
kqSY0
wmHDy
B7'9
A3Ik
}VbXw
P1'pp^h: Lcu?4f{H?8T/|C7!
_ex]
CwlSZ
OR!}
UTEg
F&v57
r` -
!*#[
{]2Z
kdlr
|:]
^bC|`D
F yy@
-o T
!JQ
MxrD
(~YA
h]s
gi0X
'N7T
+-8}:
dHP/
Control
:|UO
Copy
8 U
H^/@
COq|]
\$(D
I^Y28n"
j|b+}
Q Q8
vA
7^5n)k2'w\3W!Q+"~Z$8Ct48!
@B6}u
iE0 of"
SetY
~3~k
*9\W!
#=-\J
sN2J
1_KK
k1k#
:<#[n
B9BB5ABDDF7D5A07991F6CD10A42D3C64A6342EE
WSMVc
>t_W
>eF
M8 %
PA#l#
QAn8
.24qD
:t)'
Wn;}
63 &
Type
oRgh~
Y6a(sO 5
-suw&,$q^kk,"];bU;!vmL9y'
pP-f
'1k.r
*@! a!
` ~!
S;C
k"7,
og"#
q/h$
Bx^xZ^pb
dc^$@bm@Va=;>r}0)AQ0mHZ?!
@&O
h" 7
L;Kx
D9Q8\G
9|C2
W.8ay5
=( g=
tdy~
98cf_3RHc-kEwXd1?zjPd)\k
jc_A
ahJlyr
>@HfRrvlPhaOd<rode$:()QQ
U/ d
2018
@UdV
Lr{7
jcjHoi
(\Zh(>
5>Kvs
Qt2vm
l?;y
v)9]
Q>]UQ
66?+
4ot$=nV/amTaB}LEK;os)e34#
;)`W
fvUc
k R
*${u
ZULBoZJ'
Z;j+
N<n1
e#[!.po
\p_
NKf~
SYQSl
W* :
=?9;q
#k<h
|+VS
aU0;g
1^<?SD"
Wn-I
E<u
1 #r
Q 4G
U8>.F
7d'R
z\39
)wzM
y[:q
]HUo{
RPC_<
{aYe
DK.
GTZ~#be
C2a//1
*zLf
AM N
R!hfZ#g}7&Kr]P+go}PeqY"r!
9I6_
C#'zz
1Z>F
'5cC
@%'s
gKb=
&Arf_\CalVFJHVVqoSh42U+M!
sX,mz
af!Ci
Kyi_
P)J[
>jcC
>xBJ
$fc0f13a2-7edc-4dd3-84b1-5272cbcd4681
Ha3H
Li_i
hl*: [XI
TWc)
*!sB
/e4/
sQFU:
C*& Il1gj3
m6 js
$v;C
F.\!
Gxd2
iC0(
!rki
, LPEa{
LTR.U
ss":
dy#"
y9,%K+
Q8IP
6An&
7C3|
h'}u%
'DaV
'Tv|
_"w{F
d90"
WrapNonExceptionThrows
B)Q G
wo(
8:~O
@%U=
6!E8
yl@"
=CSrD
.text
zHQr s
dEpG
T0_>
_Ya%
{/0K
_j1P
8^K^@
E D
Ah)S
y "s
ODq-
-?[
/j=!
G&JC
,5Qw
4}b?3
xo]_
-|sF
972E5B7A81D57777C26EA850B403977F079C7032
@{j4
34*F
8N="
CaiB.\Z3
&I-@
t5n?0
h5A"
b|17
R|Dk|'P6,7q/?Fo}b"+F>1Ec$
|wm#Oy
wjeo:
LQ5f
*@WI@]
*)}L
(kfz
|%!V
F?x^
trYU
m|eWM:"pq>~<XW>lr%qCS"t4
5b&=<ABI FQ - 80diyOBi-Y$
W^'!]5j]`:E0rr*d(C7Q#x?L&
v?$k
M;m
cG 5
Bb*vo)/+CK#'";^]a^GDpM P#
aiN
|*Fo
j_+T
x-x(
# O/
3BT)g
}ZHq
IsLogging
L6a=>
+j`?
Hv2Mn((G~3h;i&u_*6%>-S8P%
vaM
Cfw
rCFN
t~6-;`
GIxc
{,[kA
<,qD
10!p
d!>g/u6
Q_14
w^c(Ph
#/UV8
}dHq
hhhJ4
^"9|~<Z
C=R($*
trO5
veZ.L
- /}S
[$EI
'd.xmb
#Blob
gEw}
ojU/
xqH]
Gd*!
1ScJ[
9QES
-ynw$JM-(maK{eAdSD?MI"M,+
30<K
`) k
}?xz
YDE#
q69NL_
@5=0OD
lml)
XJ$e?N
`.rsrc
D4k%
6 |h
' Th)
hwIcLGdi
lRlT"4y]|O{3|De=UP'Uw$'W
8T= 9
r7Mq4
pHL-cMFKn&5?9!']Pvo>9 KG,
wv1z&
"7Q2
kp/TjN4
N}z,
>qHr
v4G
D"Q$Brp
kernel32.dll
xMeI
!b;f7E
%sky\
8Q$r
MbG
oB 8
}M,b
QgXk
utbN
&e`N
Yr?^
p>)$
bF1L?
EJ d
F U~2l
?wRU
4JSw
"?z-M[
_5
)\6R~}ZfFj|`%/"Pt%eo%?)J
f~5PW
+uF
Z7AG
s>m3
c][
r+yN
HD #(
set_IsBackground
ZX ,
I)D
CB@6
9@D,9
]W>c
w&Y2u=\(LA[#9p9*YMtQ[~SL"
Q)z|
|g>7
( i<a
.EL6V
ygdj
0W@Ds
hoEs
M,8
zMFr
|jJJ
@UR-D
~,=x
y2OJ
= .z`1
QO"JcK"
@1Q1(
a2I<~
Ru^<a
fumatul Ucide.exe
-N`,J
RPm
bkF<C
r wg
^01YA
35P9O
t-U
kA%N
)S9T
jf:d{
X])#:
(1jb=
rY U
Marshal
-I082C
ufmkY
e>C
$1G
k@}6
q]$N
E+ %Z
oICHz
>J0E;
%:2q
kLkG
%W'X=d
&hO}
*)EZ
J6ays6
y^TD
E#h%
J\*f
Qlv4
J"Y%6
QExE
Z/Vnx
#^~:
&--&
$pNwNg(
xTnr
pTh
]6l~i
1,~~ H
8fi8=
](sg
}?k<Jd
9BqJ
4der
b$]A
f*B^
9V"!
q3#35
chF
}$]J
:zyP
!b&5
9P*r
h+lS
(Zgn
1t/g
)( `
.7_O
nz9
HK#?
c6PT
ngnJ
6F?=
Tyk)
?~D(
[4(0
1)@F
` J[
6 )F5
#U`s
jJfg
::c
+k[}
!m@
l+ULZvF
System.Reflection
y WD
Q/ +
System.IO
$1;@v&?Frw]'8^R2Uqjg+)Gl
C
r=;OP&K
U;g c
fCXR
,cO3\OL8Rv\AD o?98216>s[+
0'<2
X;P-ST
u27nr8^1qa`q;7vA?fN3=*VC#
UPD#%?5
-,T3
t'! <
'QRt
w2wY
.5LT\
6/^Bn7
M'r&
P7t@4
Ry@P`
~"zI
}K=N&
p O
2\`!4
YYn.
<%<
XrWJ
2DCTL
,UiV
op_Explicit
PSg}
&OL[
0QTn
DOLz
>d|G~ {
R }?
t4zw
mdTHq
pPYw
"oP_
V,:K
$c`x-
>c_a3G
N@RA
x]!:
~c=6q
0?<^
$-wZ
nbD8m
Q%#4q
Ok"sc
_%[e~8L!"D7oU(%ronM@mCK\!
Yfg]QF4;d5a>QTW&60o~Tk?+(
Pn5[
(GG"OS
System.ServiceProcess
ifY2
VB>Fl
7T;c
+RnoK
N0M'lU
DS-s
xdOl
3<snj
SDn&
+{-
s1|K~
23eMmg,>#2,S))8A):GbaM[1#
-;K
Z4T9~I
%[Xn*
Wsh`
tS0Q
!ZJc
:Qw 4,
-6ox
0D_m=ES5 0!
"QdE[
System
i 5l*z
UVc b
+'Gg{
4pELlFL2*#HCmZB-(>e(oGvH$
JQRc
1H!
D>Lj
H:\K
`Hf<
0XnEU
\:SOD,YCnF"x/#\lbe9NkUs%(
IK1Y!g
X 9W
P#w|w@\J#&?*/oj" 0Ag7|g\"
s .
#GUID
I!v;j
?`5[
O"(1
QpA oL5p
jlHfU
fCe#
< I9
Yo!i
CreateInstance
bs58
'w\n]>
N`FcW
(8S*9$>
T,sIR
b!k_beX
<kP M
MethodBase
'K3z_m
C;pW
<Ew
JkaZ
TAE4
2&oR
2h O
B&{'
G:8h
?SjQ
n]O-
5x@c
KIwT
e
@AkXZ[}$sISMIo,HUA]BF!^@
0Uyg
na>':X
V874{
p]R
m]]5
Ad$Rm
D[_JK
gjmZ
Environment
';NMt
~e~C
dMk
VirtualProtect
f;Vg
z+U:=?
#7d"
=gO$
L}Y{g&
L2oX
Rq>B(
Fe)C
e$9}
sZzSs
q| u
` 8Fz
Tcod
| Ei
5y2y
WC]i
qpw8?S)#Xr%J1rM|$"_h0ktS#
$4F <
9LNq
lzZb
<p,c
3_;}lC]F~,d+z#[-PPV?(v$#
jyW
m4b;
Fs2V{
^@g)
A_9yg
)E2h
3 I9
-zm*
nR:3
Nzl4^
Wkc%Z"
iN'
5n~%
System.Diagnostics
+PKD
WQ53
*YA(9
.^6 M
QI Fo
<(-5#d9
OQG54
p9L=t
8\{^
"/"P
qOSg/
Wi]
.1 J
/CfD5=
*>j|
g+G[
99S"
g; f
8c_r
Yul!t
DPn;
j\ i
|$QQ=
GMQ
P3' z`7
hO2*ej9_j 07,]c!zLKZ&'`8"
|! !f+7^oc!r-siYVc(_V\U$+
(zd&DQWQv`kq ! qT^-6U|P!!
<':OH
~6V=
Adoh
!`&a
>)^i;
?Gwc
EDGg<G:~=n3J0dejG]]|?{E}"
mr]~
Ve O
X 4[
wF.%
jgXTw
]%EE
Lp}<
dNvKaXUwe
1yz5
-C AJ
16vK
ehd'G6
qt}U
0 ?S
n_.{
ic$
H07OiAQ
^-R2
,Ecp
Mt+e
I$Ch+
P&sN
S mB
L:]k
LsE*
3xyk
i1=FY
n/m9o4YW,e+e-Upz}Qwd<%qO
Y+ R!n
wvl`4
*QnW;W
IGU^<
'*b{*
Intern
J7dJ
?Xly
c'%\
"X2k
|# J5A
U3;: wh8_
q)x}
iSfbQ
<5zo
h0qM$
~ ;x
-CD;d
*egoi
get_UTF8
k;>V4
+KBI$?m'cO,pOS>d /Rtp2pj
r<4M
?/O6
d fZj
o>{~
4KMZ-
m Tb
e*i?C
"K3{
1csH
j\:w
*rU=
oI,
4"Cq
WVrVZ
`RQ1u'x
tG:x
cpOv
3!b0O
uHt O
0X$3
k:L7
!|[S
FI`M
XAOs:
:q;YW
QH<E7
Gf D
/3~Q
{)6L|
j&I5:
X<Gr
!2 [
Da
R{gb
yLu #-
[im j
\r_s
5\- 'H
DM>F
$*h\
H 5W
6|.a
Ii*"@G zP]/:jB8`~!wbmxQ*%
iYZ ;
:E $
w?1#Z
F2^x
.>|#
;P\
sPH+:
~>ni
%OClD
G&[QSK
PEPy
B<;)
)>9s
M`fxEb
dL&
v0'ZSd
gfy
k*:+[@Ex3s8LipdBI/jV'D|#-
K|&3
Ox%aZE
^QM%
Il &
"Fl3%0UAy2o\ZGRr@ ZH1z<s&
/S-S
N}(m
YI Y
y6G#
\OPu
2:3N/
4X &
System.Core
O#!w}
:?uL5P
4}&K
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
T>`b-@YK7@9b@\,VXAj`\a|6"
#`<Qn
E>YQ
&'/z
CG1~
i =A4*D|r\\ui+{9aEBb!CAD
8]&=
-+M.L
4%1R
3GGJ
C}1'8
7~X )
0-i>
$eN|$
Rp p
&fg3H
;3 5
5`8#
Bg*(h
%f5q
Wx>o=(P]'BfmS*%LGDw[7wT!
?6-V,
Y~Ra
]mV7CE@j9VT'i}GD[)v >`[{#
`k~-S
.i:7
~ "a-
Ag_YI
T*=t
` |~
AssemblyCompanyAttribute
jJ_Y
e.h)$
*jJ]a
"N!_&//F4!9DB V#VNv2b3x12
InitializeArray
ao1(
M;Gm&
X'}wS
*w}R
*v}m
lxA=
:FbRdTm_m0Z[Gi?""|p6QcF@!
>:M
R+?\s4^4fk{<A(oaavKFfv9+&
! t1
s8*r
dyv-
4L,$
J @Z
AfRO
vehy
9_BYTJG!_g;[KE>pQ'%U%%\*-
l6+r
NY]J
3:M^
%\ W:
(WYq
QI{1
1#sf
@;5z*
L*d"R
_=~DL
)Gco3PUt)v]B;F\M[5:4(S\S'
QWG
[q ^
9U ?
# 7b|`
get_Length
/m\R
Zj#R
=-/C
5XWg
xo`<
@$V
3ljTP68Qs0!W1Mq41:GdvaIZ
WQPr
7} `
p$`X
H h-
(zZyt
s)DP
-k5*
N [Ff
?mYe$|
uK~B
:>!aX
%'*|g
k(9
CTy}+'
a/71
&93?
Own}#J
ofXW
B0xGv@6EZU"7|U'"yr SB22|'
Q` O
IEvidenceFactory
P!Vq
eN) $
d2V=
M!Bk
B<\
d#cR
}5^(
7B=:
SUaaE
:KCVse
30d6
GuidAttribute
/}#u3
9%P+yV1HB##ZQhsH;5q"c]u,(
/ [5
Qy$7Ht
rs62
oV{D
a^1ge
_%O7C
9C?/j
t9iU
-?J&
suR7;
@eRz
TI5q
n^Cw
System.Runtime.CompilerServices
Ja12
}UUR
7 vDW
""G3ULL
tomR2R
P]^R
7\rP
:V ^
--~iZ
<n#%
c5k;|
9)~Q
u.p\
|p6=`^
qn._
-Q68ed
x\
z`K_L
W.@+}sL
p*J,D
-R2#
c.o`XT
;`Up
A1q_b%
>N,\
5h01
w*_Xa
$s 7
xqv0
Y'y.Z
< E4
[0Kf
Wft?)i
SuppressIldasmAttribute
yr"`
e}ks
MsGW
!U%.Q
r&,'`
;/5c
,<z\
_)(w
U|0;:l
S"9J
tT}Q
c9Jjr
Dg0*
_4_V
+$se
rDNGC
^F6jHo
xtLB'+
?<WK tq
t<5*
UW2I
ToString
<oE6
]!~$
a0855e3e-e215-75.Resources.resources
VO:[z~}SaP(,;gQd#')yzL(v
J/t'-
CR zC
F2o?p7
8]|LN
9hOs
]& 2=7
S$5
__'N
1tB >Q6(
4< n
1i:+
IR;yx
.y:Z
v=Fl
[fe_
r[ND
,"{#
Qbpg
}WA
Z>)n
[=CS
HJ2),
[-0vx%z-
m37J
wG"~
ServiceBase
{2x{2Kk
H~uE
#)(f
Tq2'
{(L=`
v d4$0&pCs%%@X'2G?sc!v_d6
]n4&R*]J9{<;ot<]9'ttlXs,"
:m>A
M.wp
w G.
PXf !i
%!?0NG
4`!D5#
vU]"1
x|{=
i9NPI
aUe
0 X2Tw
aw_7*
98hr0
<lU(
;n)z?X
/$SF
-alr2
js{,
o'NT
R]OXs
O bv
|BWWC#
bEtZ
AssemblyTitleAttribute
$x%cr
SE?t
T5Lb
[ hmE
iiH&Fx}8xr9Ib*ev{n y,7Tw
@).C'
^ 0i\
F!:#@
\B/j
x-*v
[0~X
>.I{
GEA,
? LpL
pfS{
i3b
t1VY
bk/IG
Iv.jfK
i(:>
X7In
^QLz
oe7XFr
j#57
[ Y7
pf~J6
ck f
!TR%
_`fq\^
43[A
+yH,
0HLd
bTak
C]QO
^]oh
1} k
z~f
Start
E^=8
OpBl
dVLz
7<rs
o@H+$
I]gx
D/ ;
^G20}
#+LiF
ZbWT
uF';=*
PhL)Y
d9C;^
Wr
8Qe7i
gdX{
J;j
F2[?
?nFBl6
Kt$p#
S?Yc
Q\%4&
DYuR
e;;?~;"Pa4-F`EpQ\-xDtgkZ*
nxh
*~[f1
'N{ ,/
z) ~RNWBe
u'QQ>!
$\mk
uj;F"
j@Jj6
#Strings
b4m0
get_EntryPoint
{iuV
Dw/x
9}7|63
JQy
Q(Oq
.ctor
yACK
n'I]u<bG[MHm#(aS5%;V0zHo!
*V*q,
Int32
=3v+
iX=;
Container
*j&
Yw3V
T(L>c
X`;@P
Xh2
>5b b
~Udcvh
,Bet
Y<j7+(O':4,66E])K#hKNwdJ'
[sk
W,p{
#a}
UXv%c
n-Ds
Invoke
9sK<
}E=7
&G9E
_g](b
v\E'
}Wz=
a}n
t_Q|1{
~h~b
+{[A?
pKRN
=:_
@fxQ
q I Hx
"Y3>
l8DL@
<EIX
UR!%
io]/3
c/dS0)Q
I0T,
y2'.#
L`d)l@<P
=O?Z
Q{?M #1
7$9u
t0D<Q
hr=
l@jR
R0B(
vXH
_|d'
m'${
_tCFa
PaintEventArgs
",z%o
.=df,Tf
jG(7
U[m{
(~WO
]-<s
S$J#+~_`v_oWC%x G%yc<C+`!
gC3s
*G&v3
mo\.
&q^
2 P
@.reloc
B~~
&zq]e
j%Wh8Q
iaK]
&>_l
--8
L/|w
@R\,'twL
;3Y)<
brx.
\\[f
D$&s
9;]m
g"W1tx
"?(\
!b$eF
5<*9
;5AU
*o%1
Byte
O} "
G'.k1
q!fj
7R|
]k/\
NhEG
f=LEx
wTZL
@6` j
g{^a
{o[]
Ewc9
x=f/
X l"j
#a4#
LqfVO`6`;@
6N5
'G%p
pMd!/I`Ear[?!r= F31hXl7e%
a`]H
L)MR
;sC}
+qsbK%!
mIF?
LB4+
49 >)
=PRq
_eW;
qL*$
oQ*U
Y\m4
Jig
I1KK
UDMa
(#us
v',>
dt->
})3h
3j$Ie
/ v
41. M
/\A2
,pgT
ppn"^p
OQ^_
3p!b
LbMv
8Yqp?69LJ?0CRw;HG|"\Raf'#
b}HJ}{=@^}'Sm*trUQJtHdM%
t8 Q1
\s7
yAXB
`aY
DMX.W6,h
( Lu
X#kD
y#PU]
67^e
6a+K]4-
dDz~h
AssemblyTrademarkAttribute
'SUh5)
add_AssemblyResolve
1uvD
W#}
o0qX
L1u1/8?P#@SOeo`p#L7?lL6~'
-Ql[
-2'yBC
nTbt
}?]LU
B^6$
PnGq
FcS`
^mhD
zL"Tqb{
,XLa
k 5+
(/CX
(>(
B}{*N?(Z-%UO@>$5(83<`v-r$
`!wg
o.O7*QNU
O@V?|f|WNVz9-@Y=W(&([|n)
_x*LE
A&3]
Q_=
{D;]!Y
RuntimeCompatibilityAttribute
8qUM
uPaN
TT4v
sQVw
~X,OoJ
6GF.~
5W3^
zl<6
j]/H
{_jE
Assembly
l:!p
t2o
"[:R
3a",O
Xg??
Copyright
>.T
g$Eo
`gY%>
O*L4
[cy7
?Q^7} a
R? u
-uA(A
`(1-"b
$G>|
z7ec
kW$sJ
BbmG8j.
h|t}x1q1`,s@w\qC@x<CpP:n%
${LlC$3uRQDnUs2CQGVN+M2q
q1MgH
OC(w
~)Qj
i']k|
?\_*
Ae#,
e^TdZW!Kh0[1)ejp)*P7T+i-)
1o x)
;5fv5oUMDgQ:Zq`tGK+g= Qh$
Y[RK4JuF|ZH7'ff #a|#$zb:"
uEy\I
AF
D*qb(6vRe3};w'[}q(2"@:x%
Nuc%a
}-t9
i8K6
tqwc
lsFU
4>e"
<bqg
#JZb
P,Q3M
e!RR
# 'Z
7> yp
t}S?
mJZ4
dX/zd
8fI&
4y~{
1=aK
7,cc
_[!M
'ICy
2zCC
set_AutoScaleMode
|E~Tlo
7ihH
Sp>#9
q).81
XUo=g
oI 8M
FI7W
[}aO
\Y1ii
Etx0
nk@h
AKLh
H]g@+
Lhe,
ML[/mY
MLp^
f$(:1
OOB=i
Fw'
| nUV1
"+zl
v**-t
~m2y#`
@hb3Wa
[C!%-
hH^d
BS %
Lubh[
bqv{2
n6GQO
4AuC~
ParameterizedThreadStart
,Vbn
N"'a
>/# sN.nY2
.B,{S
XN@V
*Y$1<su
2;)s2'
u`QBy
R-T<
GFt(oz
46!$
ID=aAl"#$h6U+= i STx!Z+B&
~RG'
z8-H
F':"
'}dV,RHgVuK,&39z*nZsR(Vy#
p2-n
i/l8
@!q"
bRd%q
#!Asn:,j=I*P`9's5wbW3Y@R%
\Aqs
,e_.
2e ~
Ac'u
"1eZ{
Module
f'4|x
vqpX
PRH#
Ht]`
jWq+
R J
.26?^
M MTD@ES
yd}C
pH+xNH
F!TCnz
h,+^
w_b3=
{7; *
kc77
6 Y
Ie7(
_iOy
q yA
>>p6
8FOg
_K:i
/njD
2[&
!;l"$
laJ?;
cy9$w
N6P6
/J.g
8&+>I/
*n$?
$m3
l=z3Ze*C]G`Nz/~?&X0,qL0S"
^h=a
,t"7
GphN`r
nL:L%
Si3c
_tF[
atcD
Z-E&P
@lN[
^dd/$, 7>Jd*U'h,A!?(w-xj'
8@@'P
)w (
TFsR
<}Y~Ms8
pl$RB
ContainerControl
get_Chars
F\/
$@Vy
H.=Po
:4(bz
c&%
`SWv
,<fG
A Y d
w:tMRN
$q K
jy"\
~RJ
9O ^I
yWv
cz-
MCi#
JI@.
FrFY
w4d0
9+W3
+hm5
V\yX
&[o1
bR7=
Kr`t
R" b
5:H *
Eeqe
F<Z~
IR_?
1)\^
=} /
]^ms
5]B*,i;Mih1e~p3g'/@UqhON"
O930
tc#D
/&N&8
"^5N
hN=|
%o%
Yd"Lb
\~ZN
8D7z
"XxeE
>'_!
b[e
:_9
AssemblyCopyrightAttribute
wC@`
{q&;(
l"/K8
>N a
Hx)yn#
8AR#P/hfXBjIz's-|v'](wKW!
`7&''`\r4O^&9LZtB3-v*PK&'
xk+R
."%Z
#=`G
jw 2
Wrpt
dfF5j
mo[m
0X',
aX?mG
K$.z
+JB2
5er1
j<40
2&#:J
_g9)
~<Eh(
M4L
l%y&
<rt7;
Ie ?8
)Oye
v9\!
]m2cG4WB9uVV"LQ5Xhhjc$0~'
<}9T
5M>m?
oUKJ
C20O
Q:~f
Mva/m;
{\@0 j2t
/3&H
}|u%
:/6KI@SuBH~
(@RQ
82C.lF
Wl=q
'%>F
;[:/
( j|sU
nb"7
_&^{
sZHs
fV;
hE%E
>Zy7
3/Q$
W=tPb8ihI
J?L5
?M@u
O`-;5J
aXj~
V1LE/
SkN:
uHvU
l'uPkEi/lw(_GDg~y4K7-\R{&
b-Y,FEF:{mIsM=vb(,VMRrv_!
g`lo
hK*o
- iw
1r7!
LOsh
*D;f
VJ,
nUi
f{2MT-Uh\lw~cu%x+8b_sa~Z
qyw=
[RQPj
Read
0X;D
ok9}J"7a>t[++qKN5LUCT&5$!
OEM7
pME" (*"1|&I'QY>I%Vv9aU&
o[/m
0yA7
]@j9
|0gzE
+Uae
Cb1#
ANzk
_`g+
|>\>
iS]B<
ywvc
?g8$
n}.P
K\@i
UZQFM
UQ0&
teI@:
I6 wB
!3td,
d9U(
@e^ P
`o&Ht.r2E4
&yq !
#K
L+>
'6ed*/+4B
G]V||
K?|-=
:P':
Lib
Wp x
e -
)!|GD
I:Np
t S%9
Usb?
S ju;IJ"~l+-GguexFIV%|u #
gR`8)
18^#
YO/V
2|`=/7
\C;Zxb$zoc%;qVg]9`0ynY~q+
#p% cf
Sy+|1
So 4
Ka`A!
Bbys
|@XB
Mdy_
AutoScaleMode
( Ue;
2vm5^
mD0s
,p;l
,(a u
Mh(T
(<ag
dx Nz
%RU
A?%]
+N`d
%'Tb:
["P1
OW'W[w&p3lUNwc[p2~(;<;PF
t@6fWv.
<9O|7we
aBj-
[*
\+2
Fd }
<^vh
9g_
},2V|
-WW#A
h5f
/# 3:
GetMethod
[ \~
@G<%
@N-k
p2[l
$f)
N0Em
uO\f
b}!<
RjYn7
@1c>
N8s,
"E?(
H,(e
Id=0e
5 /Co
3MkR
J~+&%
<vA'
OJ&6tz
?*2[
#Fzr;
0gbl
6GK<;Q1kaq#5]Y%D0cB sBT?,
]^am
:UW1
(|9T<WT/z/U:-%7xu*"7oLeg"
~H)t
.*R
XoByAj
L=NWX
I 5]
puO<
gVez
1G?Q
.$7R
=rj
m!M.*[
iF?y
TtRs
&IMWF
. j K
@*ey
Y Y6]
pe6P
/p^w
NA_s& l\
: r"
*KD`#
%0MB
RuntimeTypeHandle
\H)
@O1l'i
4RQ1
\'}I
Object
g4ndxV
I
&[%W):
c.f=>
+]OM
o[D3 U
4 ex
tyw?=
<kySD
^-,y
RUr
`3ym
E|;CD
Va.a
dv!8
y bz
'(x1B
%6{
~"6K
U4J;\f
\ A$
EQ:c{i
}VB]
6Sc(
z=N9,D
z=$m
,9OS
ha49
bSTxV|}M%d6D>
'V|~
YRo"
*G#ru
op_Equality
_I@`
Xa<I
I1Is
]XbY
z<=2
|{<7
0'?%
:" L[)
=P!I'0
zWe!{
F$"d
uP[@
6H8>
)E42
,l"d
k%+W7Ds
Mekq
vK3(
_#xoD
Um Q
'v?xx[
(-~G
AssemblyDescriptionAttribute
+( 00
bsYs
^B E
qN(q
7E]8
~bUp
n2yuY
Iuu6
x{|]a
h%1"
i 7$
!3Kqxx
7ktz
TiEHi
[0,L
G_h/8'
QZOXY
)=y%(
M]8NZ
ih0L'D
Cvej
Z'O XtrGOtMC+:reLO^gLu-$!
- (\R
i81yU
x)f4Y*][&Be#CI'|sp:Q:o2|"
AVP G#ta=$Qnr008Q6'D+B#D#
Isg%
m\o+
~<r`
`+fz5^
EUiw
:3w H
ComVisibleAttribute
-@zj>
s*c%
FWH@
uk.<
<V w?
iVcOh
B\"Z
]O6e]]
.G,x
#qLz
2#[(
yEi(g
V"N*
dgbK
? H?
O"JwKv;aJ
. ~M~d
j>+o
-{1e
W ~iZ
gy\F
l=j3
2; Qm
z/F3
~d^y
Wm;6
yz A
u`7o
Ipx
System.Configuration.Install
Rr%z
;hElL4BZ;^FbuW@1F10 {<%(
6t lU
=*!U/
k;Nt
S (x
gIt
xb[r
x 9\
ResourceDictionaryLocation
-YI1=
M @&
w7d1r
ZIJV]W
\ /;
mscoree.dll
!This program cannot be run in DOS mode. $
>!H }
8 2
vE`H
b!;;
0sm DEe
pD%l6u
(W=6J
`!:?U=c'O^'3Z7r5*Rn^:InK"
P3 I
'jXO
\ #N
I4W@
Dispose
#)r\
*wqh
:cVGm
W2`F
c!uZ
h*Dp
Z2\Y5$V
'4 Iw
'2# "**^*Qvn[B=x&EdQiHAN!
aq_S
KnT F7
7$>]
|z-J)
*+|2G
_-7
f}{|v
yF7-
3E_Y
906N~
J;2m
>lmfdS
//B@DkF
$D*0
o e"
Bol^qG
3h WS
D{1
$Zp8
-_HK
X-P?R
@|bo;zpH
u5Bi
HqG
F54Hz
v=f*
'o!$6
LToZ
Bf\
`+gq
<$2n
AhJ7
b?/VD
_eqWG
':7myA
+pn
xuZE &"Kc
60(%
/Dki
?]&U.
xEHy &V+]
7mqx
cvN4
F !4
9Mmxf
R2H9wc+\'ufYZ8SZER#@j%8E!
?((0Z>Tg3z{
3\6 >E^Y
BSJB
Va eCy
tLPbj !GMc/b"9oL%+>a$jxb"
1(7
S!y(*
,cK5w
XVIO^#_cJ&6Q@s$#g"2[=Cm)
^ 7S
@c#k
XI %
Q#s
$}G7
v9M>?*|}?[C|qa,t+t?Dd@d1
rS ;
&gTq
t\Hj
6&Df
<;]/
x [.
&Oz,
A/P^@6
E r>
dQHp
*Uvsgc
PC ?
3.]>
jKI+ @
"z'E
4K?uM
J)=+6
4bu5
wLAK
N8O
/HEim6
s>iB
QSQa:-
9`+tm
~nyx
N{7=
System.Linq
F'Tpuuox
!2IVm
g;gw4
f_ZV
t&|5
h+P7
K@vr
E{ t.
ldDc
)n4.&
c n^
~f2&
F <J5)!"
- Hg
[: ^A
X7||o
^E!h
6.0!
rN>I
o|NN
|&+M
\x 0p
6u=n{^
VP|?
^FN;
*& g
=s;J
`YoL7N
j6(:
STAThreadAttribute
c\K0
S3s1
G"6nu
.Cmo
w;EUZ=I]cjVFp$\g"\XlB55\!
[*Z?
PU6er
$KV:~
,7[G
w7 T=R
igVJ
VNU B
0(P
D&%Z
=.|2
F,!PZgI7J2rGo|U~O1'KY@:V$
q x:
Kf '7
[Dmg
Z Iv
tJg*)
^sf|5\#
u1wIT
p&h}
M|9yo
2p in 2
,nMvc
(A9`
4J^~
H^<!UU
f~J?]u
H8{"
vFr<w A?#$
R&#F
Zf>j
tVn".
{Q}^|:H^`AmjGzTGGTF5h&DE%
!a3cs
,<)R,]
E/06
-'N@
;[oJTt
D|\x
;+]G#Xm
{Ls]b
5Dw
_jVK/
4PBR
nAbh
o(J/b
. z!
|%]e
#M\{
2y01g
"hH@1}
sZJ9
jv
x?l-X
q=>M
pqrv
*{ M
yZo<g;@K&$r/WW'V)Cm>e*y8+
usc
Mw;n
Vs:vn
D90574A20BB1284227DEF0F70F1CF6BD0FC140DA
); H
ZLp"B_/aaPk^P/^==>AKUam;!
{za`
iR5*_
~Z^e
Ren{
hS|:<
+76'
S?TO<26If|0:Q;CWLdAa*6ez%
!@,p\
v a*
qQ Xq
`.:S
5t<]
ISerializable
3zH|h
T344P
m:H
s$jf
:m@e
y"TZ
Q;(l dM
cfL%
D+F^
=L(K
4vj}b#
PJy@
~V,u
Ny$~
Y{O7+
=)zzS
3H^Q
[e/
MethodInfo
"GA/ &A
gs]s
Fm$n
0Z3!
0,vf
tC@v
f5{(
fjz~
<&d\
DQ9!
9,(@
fs2
p`f I
~m<%W
KT(i
Sx8#'N
} 8u?
4IzTi
8jE
=Q1H
^o%f
/1"I
3 mc<`
81\o*
u`NF0#
q b)GZ'kph'nB_]0WA>AC${^(
{"+%
)R56
Ek/)
9]/?
6AP1
.kta
@Vw?w"
fQ`(x
+"jTw
#QFPAr
2^y@
0Osf
VEx21
yTa^7
CFGU
ZP/cA
NgrkK
+~z&o
;&6h
b}vtp
s"`1A
I|d8'
ohM&:Ld
d@~t
4fDq
7HOXjgjlH?fE7C62aWCOvF(S#
r yPv-3
#7h'^s
-+V!
&6\cA.4T
c1z2?
{-jY2O
Jb3
Z)bEj
!$-K
DP C
fc,^
TxwBqo0
Rcy8
qhY
JF!
O7Rg
@ )h
{9PS^
U#[p)
wl`A~F
=)$4}}
%x^*
]$4M[
wq^X}
Y^Wm9
|ky<]
R*THDU
gfcvb
~e@R*9
ResolveEventHandler
4inB
t.VR
.%qi
U</NJ
&`<x
9z7+
+Xn
@ s
3009A9B3C2291589C277BC17EA7B7AE49847B36A
[~|8n
7Gac'/DlgXIhig;[T+Hk~18>#
V:d S
PLY|C
0aH&
]XX.
yIO=!
K&f%
QVkq
q))*
q2jh
PY"6 5
fM:!}.
! h"
BlockCopy
a'Ak
, EIC
+Wj T

'"8Jh`!
1zQw]@
krQr
^{Az
xG]DC
NC0y
=(=~
SY~E
O&Lg
dDEZ+
\a?B
F|=S
%:*c"
:$#G
nQ_^,
vp>*
Z1!4l
G5{-
b]D!
3*;\
T**<
hhga
!3[G
!A!3<
>:l`_
KJ?x
\;-l
StringBuilder
W@o+
>c4i
Append
0c <
c&|9
qoFD
}6 }Z
W.;?-
V3gq8
_g]>P
LxuE
Stream
T]GO
N 7$}
n^J
ahP\*YK(
Xm>
B=s2(
Qg@gh
cj`G
xPw'
NTo4\-jJ{-UJkbn5&5;XS/ZE"
N.MG
nURO"
rpX~
iC-
@c3Ao
Ff
+c"A
N+%x
E72438DD9A06CF862B9274B492DED459CB035989
A@yD;nd
r2L<
0&FG
AppDomain
1tCx
nN]WR}+/:}^pC8vX?B", _Yy!
*"XJ-
;kb!
Thread
TS>;
j(n
b#v'
}''(B;
/QtOg
NT{O
-'Go
TnpFp
UND{
Zz+>
^^bc
AssemblyFileVersionAttribute
o<k<^Z%W6VO<{rJh?O,_Y!>B$
(M{.
U+f]%yaLt
System.Text
vtgS:'
ThemeInfoAttribute
qj :~@x
7j=^8F
L\}Bj
\C <U1q_Q
/1do
?rC
f+:
m)Z*
^ PTW
vKd9
n\ C
r~Jq
GetString
h]qME?F+JWHtXA1+-9_Gy\"o$
>/;f'L{S=T?T<_~;>kIs|?kc#
]u%f
sW6|
g^2
p!%H
(|Omxq#$bYoI0|Mw7'X3c*2k)
a8Lb
Uk]S
e! ,
|}T@
)<z3
/-)KmO4
D7~_/
vEbA
1m*CMh8)IuZ-RP`|Ucx+4I+&#
Kaxdxq
Component
GetElementType
@L&tX{
gw10O=
-XqV
_sFBo
Y|S
=l+7
@k@uj~
VT
~LLl
get_Name
\*Y
lNMX
bJCy
Y7y +
_`!e
um <
uF^bZ0^Q
?;=`0
wp L(
T ^
%mL+b
PiO|
f=z;
>Bp K
F^4#?-Q<h*%o 6N'_adtT):X4
Z+~s
Qa,M
167D
!HHNs
V{e%
TIh/
&VTc
aI]}
G>QZ8)'
"C]PD
Cf*f
yB2{
M)Bf
n@C\
UZl'/=",!|{X12E@F_" r#:$1
nBf#
;Ad=
vhdQ[zMzuaj7BWh~c]2f@QO{
(CG &r
y$|D
6 0gsB21ZD`{+JJ2nA:KM7^A
Ya<%
eV|cd$I
YR})N
JLg!X
'v7S
/7g
|hnE
lO7t
aMEs%*Q
f0 r
=f]u
xInnTW
UJ?zJ
NZd@S
0&_)[
WS \
A7J
z%uj
QY,!
T(oh
v$=eeV$}C6glZZr/a$BhP~5y"
( ;f
pCO=
y(Yh
RunInstallerAttribute
/Z
lJg<
3~=<
Q5,/
String
$>17
L\sr
c"ZL[*#rcj]P;qI*m,H(,aY:%
_CorExeMain
v@s~/_
&M]I
O,PO
jzAbT
B%F~
VpoW
nq!$nKo9
7Ybro
<Module>
UuKD
b(,V
mj(
' }~PM
,](
,!,
JKY1
#7CC
get_CurrentThread
H;=4
YOwx
CLBU=6<jw0&&Z!U!{4*M}e`*$
g4s,
'7JH"
#r3w
a+tY
t,k>r
p}CU
GMB{/f
@xNW
hx @
lB%`.
8Y?RnG&
Mz@h
xkIn
)5&K
.sjw
B;`
-HP
Uh _z
~)B5
LR.Z
'7F9{
ToArray
u^{o
DEWw9
?9v?b
#mdt
<Ms_
/ev"
4 fc
^B89
#'S g
Vnyg
b Z}
LMWV
aFt
h!TA
*qa:
0'[9
0.H!?
d][91P
GJx
kpJl
Gt|<
(>o$, ;
Wr.;c
8(u7
]e$s
=:O
lvD
;} &A=
z\*
V~By
e$d6
<Kl^C
b=bf
"sfC
bCV!
{k#wZ
H;PJv
3-)J
t'xF
lqM(P
b8lZ
Djx4
Load
+zg'
<?9-M/
g~jZ71
Z0NI
System.Windows
?G@$
LSd
9qvA
^+Dq
Hh}"[
fU H
ISxB!g
-P-1k
1G; T
5oCJ
] LC
7L3e
1K@g
get_FullName
dMb8
~!_)
5\9-l_
``"<
qDzr
/rkm
(:;=
O7j e
mQq}L6
/Wv?
k;6v+
*@ y
']y&
-E.^
/im\
Z[lz(
qgaU
!j n
C^x-'
<}C!
77m:
C2"
Y`Y/9S
J4?-@X`-
qe'3
^T$T
;a44
#mj@U=Xt`
&LB/
XO]Nf
[UX1
F4[dQ;F`'7xU)[pfV4Gfb,8n)
DqRf
Vn"Em
[^7R
&/Sp
vb?+
oBy+
1)z:
aFFKHY
s^ N(i
{Wa.z
RuntimeHelpers
;~-&
6N"S
`sI+R
3>ht
!fNaK
t TO
Hh4no
m9Nl34Z%HlEy<chd5$bL6e$e$
M.St<
( _1
INy$
,NJM
UserControl
\$|:
)[?
li7(
bbH;
{d v
IvV6
FG]up@69~<u+<qF3:k6H=3Nu#
Encoding
c-eK
\XK#\
:6wl
]6|V2
#b$S
UiDM
1ar4
$2Dg
=\1y%u<
:+ZQ
}]~C
ReadByte
3#Ej
|kS_
9Rm%
/5u$
>h+k
M~S
FU2M
;.6:
pwlS6
o_Wf
yr4+X~
OD|MX2G
^/w4
vDM2
~ctt
>#0
<w5
oA%U
$6<
?{:
f#al
?s:k
g>??
0/JZ
l5xt~
m*f6
]hIp
%\yHP
@u/%
w3-{
get_IsAlive
O +U[3
p=k|ntJjhv-FI>V]>:0c;nXe$
M<Od
TXZkq;#:'--+60ixf:L7:LJX"
P=|+
4DL
;Bcj
E+0k*ER^7y#Jagtc?*){nB<o#
Xkxi,&
mV u
vh[g
A-#hZxc
_I/4/
16R|
AssemblyConfigurationAttribute
{W!fH?@P
@x]
(/Q+
>r@T
+<@0T(
u&1i6p3
MS%7"K%$ork*"r(zV&4dwA`I"
87aT
EYe ]'PV
Ij*G
nWWm
t'sj*
4YVb
wI{Vj
1.0.0.0
b)PB
MA\r
lgjF
& /
1_w#=
{ @E.
RHNy
cD@6
n>f`
{ 0k!<
s.p5
-;M>
emB^J
@=iF
V 3e
T+v\
aBF*[!
.P'
*B<A5
P3+
>:bG
+ %
wpq
%_Nfp$
76Tl
#]D>
=qodJ
z*@
\9GwX
cOep|;
1?zz VJ>Y4
X2,|
C l(\5
] Dx
Qo_#
Pdr|fb
X ?T
'g<s3FCc }5roB%1K?L2^t/1$
lLe |
\0$X
*=(@~
z 6'
Q+2Fi
CompilationRelaxationsAttribute
G=}\
* P U
hv7N
FO25
8 IwA
/.,;
K D} cE37eV\KOV
*_"`
*~r{
.Bm3 WC
{\w}E
;tPcS
/#[Z
set_ServiceName
MWvG
#DjW
5/oB`O
=c1
0=^\|
`=ra
n2APE
)^3R
xRG6
8L j=
$ns
Rp`Bi
^jC.
CI
iqmH
RO?!
kG8`
pD>b1+
vE`n^m"f:W>yQAG3"^oR_;I}
M@mkg
"KLIm
E2o*
#.cM
get_IsAttached
IJ9\~
1\9hum
cJtm
nu],K3W9
\,yZu_
OR:')
9|i;
@N^$
2RmZ
FailFast
yZ}1
iW~kJ
xg0R
%= XH
u#L\ pn
s 8Ea
yT8kNg
S"^4\%0&}&N7jd$T"$rMb2c}(
G,n#K
sC|\
]`q)
Z9NW
~f@,
D:?fC
?l']?
b$tJ
^jv2
R AA
!)mr
L7 W
MemoryStream
qK}:
az`Vi
System.ComponentModel
Cz ^
6M/
>pw,9
lI q
*)M{i
s3 Z
QUue;Uk%M_~"C*C_?c0l,"BR$
w)q}
.3o@
A5wEx
G#&zh=3x{D%,W/[3)'yb47ag)
w" _}
System.Threading
~u@
gISEYNVyYMbzKtTWjerCTypgaZOi
^^xL
TxUC6
xvT5
]SrG.
`"iW
60<5 x
0FIE
y%1]1
`8y62,74;Mv4,Tb61off<E5o"
R'NV
HrRg
.cctor
}}p!sG
xp[
I%D d
`KTh2
ResolveEventArgs
=qP6
dv=(
sF5h
z g8}
ValueType
LWj#
:*]7
3$ Wj
GDAh
t-_m
B]Lt`J;
AY}
}1lh
)0D<
vc5}
T}VFr
.[GE
1jMW
Vn~[9
%yeU
_7|Mh[
/poW?
Buffer
[C+>
HC3
Y: y
1 ^L
#T4u Dte
I~u+5
P;D>
Gm/%I
KQQ
']@
Fa3:bJ$qRyH\e,^;<"pyoES4$
hXMjY3x
+:.%k
Xy=`Z
=Q;KSg
xp13ZL8@
WRh bfw
JN>zs[V;\1qZdG8(HGn!{qc%
y~C=
h<7pryk:H
+X#.
+`_(B
Jl%
3DE'
e)OE
FYZHa
u+=z
M."p
@Fb4
Vwg
$rX`
Debugger
N# R
q[R}
Zrk!/~
asfj
QzAg
MNx#
:62<*$f
J=j\AN
T>9t7,yd0XdT%Q*IYGb(=*N$$
&E4u^
9[$r
Y]B{
}`O&m
1-d<3
rgV5c
\H6cA
q(v^
>(/q{
MhWy
6kDM
::Y
A5pk
I\d6
PM#Z
Y=DU
3H ]{Bew
,,qs
&nv }K
q_}?>
ATVz
es%B{m
]&?4
jTm
-x}
#kf8f<?f
;sp\
xj)r
J6O
bUjY
/5 .
W&>`
3`- M{4
ArgumentNullException
b(Sb
kW.Q
"yLc
{m7x
= O&
' {]
VY+J&
K? )Wh
{~x06
%BfaVk
p7eU
^V]
%+W
\`}A
D#"~;
xlcT8O19
4\F|
7E %
n4gg
0I o
oJx{
v2.0.50727
_GvHJC
rwj!v*G7o6rXm5N;(u}WlTg~
>3E!
E j+
8;2HAU"\5F
8I0>
;n#~M
>Yfn
0KmM&
scKoN
QTtI
-2+
"(.X
Pg9g$
M#v~
IfjF
W7Ef
w8(e
) ^)O
km.%
4bt?KJ
,[\b
cAR}k
gh=S
r;$^#aU-5'd'#[$EY] Qx(m2$
E 5G
6\iNP
}w|umaN=2? !la~|F!T8AL#\$
\qK\
LAn2
71j
Qlz
c#u~
32t&
Kra<'
edRb
=c@2
l/ c
Nip*
FD_lr
^;[lA
rIEG
4k3b{(NbpW10W=cc,n^ n47G&
ff%v
3W*\
+MVZ_p^
^ti5C'D0
DwKO
PhQo
knh{
|H'$Gvbb'A"->|SW6lzral*o'
cZG
neBk'0
/ JI
AGv&r
tAIOJ
w|T+
PX~Jy
qW/S^
;8PS
GetTypeFromHandle
h^Z59K'H-
dd,_1
<b KJ
U+=E
;=;]
@M)k
oQMI
kC/w
$[}~
1k^Z]|<;
7$0P
System.Runtime.Serialization
.$Zd
jIV
M02(0
Ou1z
dNY!
_r5(
)6\&29
}8JPI1
s<u*
B9#y2 n
+\D,Gd#V"Xn|uBPpu4iI'-PX
MvRbMDf35TY=i3_4+fnU{ Y-*
! '&
aJUO
4M~
E^o=
gk)8,4c
%NBK
0>2 (_R#rQOXjJ|JPzh5b6HY
|h3O
"od8
;9!l
D;1}
8IW^7\
!wBq
aM-a
_3JU
mX%>
7=Qj`
?10pt
Z9byV
CH7@
H|J_?Vd
L`w1^
*F]D
:[)G
hpc0|*,1|`*WHBzjZ#A'}+HW"
tkW
Z1vb+
+5k-[Va?*4]|+GLS|5tN"?;b"
01~ :
DXU
J+pi]
rm C
"|fk
|8^Q
H^N.r~D
TUZ{|d
System.Collections.Generic
mA2%
gE(.
]`bR
~%Sek>#m>uUSh3;`\Y^d+P#^
<6q'
System.Runtime.InteropServices
:MX^m
ZmxJI8
J2q+:'
S C/4
.p!?
/ib6
[g7b
$ZbH
+T ;
3gi!
Math
S2/=_
qb:o
sL<o
<ca
rSl\?
!vv7
u29R
c+u7
mx%c
l 8lN
+Tf;
)48@om<y
?vz"
? H
2465
&t{H2
o y_
Oz0R
uUkW
. yh
*ixfSv
_}u[8
CcD
U>|wMSo
S=29;
:hd|
3 ]-
*n)R
@(;-
A) @
nv>|
Zid2FGP=y/`f%X+Pf(*%JYEV!
~(\zP3U
Th @p
Ji-Y
L )0/
MG"n
h+T2
u<|I
;Gf[
3<J_
]AaZ
:='g
@#05
3gI"
!Bj"
nRBe
SI:1D?
x1ay
s)"Q$Ij`
eJ1Y
FHT$V5
H$\q
k4\C
Jo#@
kf,HT
%6RU
U`^P
) D"
J!z5A
RCOr
";Rt^
A Ia7[
7ZApf
>X"8
[0S'
:}],zWT
HND/
(<D'
pSCkC/:%{G>D-\)=y1\)=`7)+
-<GY
$st_
Ts:&txI
]hZBf
<zo
^rg.
4EAT1zP[
_WFA
{:X_j*
_pL
.Ku[
r1ogJws
D&M9
SB,H
j'oK,
$3ZkV?&wu gde/FNf`+{?Q!>!
h$!D
IDisposable
EH#Oc
0 2^!
'F ]
C^D!
>WA<
qiqr
\p5c
P)rk>_}L
NN+%J3[T#\W2I(-_,I@9h&Jj-
uBXS-
{C(
~ 5d
C?P,
xYh9:
4v X
o7`+3 5l
gT]J6<e
%]g^
w]vAw@Gp
P%Gn
UyP[+6Qg;MWU]}xF2$|k)34r!
DC"9"L
y~32
o$r
} Fhu
-5D*
mscorlib
g29y
<\"k
AssemblyProductAttribute
FL_>
PZUi
Equals
pLuz
Zf[Pf
^r46
ds3Q#
0Uvj<
ms)CdF .!K
N-EI
gBAW
=Zkd
le|FP
i[owo`
$&S+
{j1h
8n[tu`
!M4.
a;!$K
SpQWs(
{\{
JM]
d wu;
oS,/lX/5s&-GI6Dz>eCJ N3)
0=2*"Nq
IntPtr
0,r3
9UU2+nFmn
G&<
(zz"@^!_*0,}Q(9o[}!eAI>r
-u O
Z $i
b4VJ
UInt32
w'L(
&hk jhz
pVQy
\;P@7
R[.)g
)mQ"n
H 8tv
W_OF
WGC
8Xw5
{8Jp
{,A|
C9x1
/:Lq
3*^L2"
m d[
{qM
j*;
J1 ?
y|V9
v${oe
*9B_
z'Fr
b(zW
?SuO#=
a \G1V
m dc
WtBE
g)K\u
o}#(
0E}t
XxL`pu
2~"r
3585MW
Y,_F
|P2#
0aLg
.ruS
!f,f
o2#:Ix
pew;
.?qD
A=%W
y8<^
{G*
cb!_
"meut
O+1v
PresentationFramework
r- +
u\;m
F =
lX^{
^L:O
3Jv
*k?
eMd
-U r}
8L'4\\YPJF@nxSLav(>]SX36#
37 `
8?6,
|rLM2
ja&f
w *e3
>zrg
i|f
\KjZ
M9Y7
H8WQ%
42%4
7K[> =
07R?;!{UZ)dO%7)8cqYr6I$a$
J-__
h1^G
/,N)F(w3
k-[QJB
Wf`
G3%B
)X!K
2 y")m
#ytX
&[$el*1%
%EH d
jrac
>)gt
DI\02
/Lry
x&od
*(I4~HF07Zl*\O[cKy8j/Jal$
~Co
\\6x
Kloh
%I U
M@q>/
0/gbCSk
M>sKm
&YVI"
p /7-
mv~E
A!/X
k(i:
ru#x
gEXqNV
'N, s
Wsmoe
t)O#
`NL>v
I<K%
-i19*
fdbz
e~(
S&.<
r+hZk_y
{Btk
U{3P
<+=:g
h"g /Q
yZ*P
:vlq/4I:v9;-Ym+ %>ju,T7:+
"VH{
Xy>uk
Qo9W
disposing
3 ?E
\sLs3
>qy
*tM
IEnumerable`1
0qXq
e*w9~W^
_2^6
|UBCL'1sqh,75!Q(H;MC4|B $
% {R
_RK-~?
get_Module
@aqCH
%aj>Q
+y9o
iMGLHj{8\uTb,UM'k??Pc!JQ"
4 OB
;:Bt
lp]QO
Gm~Y
95[DV/
`9x<
(z5y
+NA'
uAGz
3FSB
a1VJ
$U{v.
kDJB
$a5+c!
igLz.
rl2n
yi$b
L$QP
g4 M+s
B2[ V
fumatul Ucide
Tgp1;_Bh-+~\W1f\k3w,t$<2$
r[^,'
d zf
(B>Nk%
tLbx~
9==+
)]wc#{y
<T1<Q
~u1[q
I>Y:
%DbiX
HF!7I
r"z !;w
mz(y
v:v||
Mta W:
,<}nK
Z?b&
+Rk@
\%n`0*
jQ}"
7ZB s"O
E8bxP{
96R4
q&v?
'!:C7
O)JP
3Er&x
MP (i
(g>&
4 v-Z
5Z HWrVUCw(;3A\LYd2s|=66!
h<{/
f1T+#
ol/{
|a @Y
1ip0L-cp},cdsp5Z({44^Xou!
-\M<_
?^^z
-&%r
.C~\5g
rftl#H
=% X
z$X;
j{tGVV;@()5oD _MMWojA~2%!
>8 )
o[{T.F
J{O2
aXs<
dPGb
_r5.
plx#
a'psT
G.`A
kxlMvGfdSbeJH&6&eb [th'o
\1Iq
2=wm
[z> /
n9sj
\{C=
Q'71
%lo8
4kSEh
KhL :
t M
i|y :
spH8
pa78
LLTf
Nr8Vp
8}
mw%2,
Mw2-
vz,Ar
b3eJz
OLMz
System.Windows.Forms
;e#p
Kz}x
ufhy
yrJ=
%*X}
/}@!)6
UM!xzB
{tp4X
btY%
8t?O
&K/F
5[Q:
.gp1
wTXl0
i~82
,c5P
a2&m
q\KK9
<;\h
HlU
)g@b
8%aI}7-q(4wFA)Dl:$/4V|07%
lM1"!
1R)&h
#TE7N
WDYfV
?L9o3ARH`<j;h<jKl{cB4J3R"
20j
' jK
Array
zJ&[Fo
G }eX
z=7csb
v MA`)JJ
v nC
uh;0
Va&
xAc7
.'G8
e&p;
/9LA
f{Z@
=iHMuf*$j-jB2V:c_P1Ma/S#
v;RMk$
fED)
p-qu
|S(F
5w+j
I|EH
^GV=
$&=2
Dh%~
8t{HYB@?7;|7v7IF_*ipm*)[*
0+K *0
p Os
Y0^*W
8G)h.
q .1m}dN
Xf"R
cBg8+
,G%q
.I&;
Sleep
G)0}
M'3+
;bP_f&
"!_@5Qh qT
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven01b_64 Seven01b_64 VirtualBox 2018-02-12 20:04:37 2018-02-12 20:07:25 168

5 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven01b_64 Seven01b_64 VirtualBox 2018-02-12 20:04:37 2018-02-12 20:07:25 168

8 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\Timeflies.exe.config
C:\Users\Seven01\AppData\Local\Temp\Timeflies.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\unrar\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Python27\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\Timeflies.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index149.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
\Device\KsecDD
C:\Users\Seven01\AppData\Local\Temp\Timeflies.config
C:\Users\Seven01\AppData\Local\Temp\Timeflies.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\f02737c83305687a68c088927a6c5a98\System.Configuration.Install.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.INI
C:\Users\Seven01\AppData\Local\Temp\Timeflies.exe:Zone.Identifier
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll
C:\Windows\Globalization\it-it.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\cf293040f3a93afa1ea782487acae816\WindowsBase.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\2ad23de8284d4594aa658dfb5e667d97\PresentationCore.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\bfaf8f86e69928fb2f67987c0203f603\PresentationFramework.ni.dll
C:\Windows\assembly\GAC_MSIL\PresentationFramework\3.0.0.0__31bf3856ad364e35\PresentationFramework.INI
C:\Windows\assembly\GAC_MSIL\WindowsBase\3.0.0.0__31bf3856ad364e35\WindowsBase.INI
C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationCore.INI
C:\Users\Seven01\AppData\Local\Temp\it-IT\fumatul Ucide.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\fumatul Ucide.resources\fumatul Ucide.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\fumatul Ucide.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\fumatul Ucide.resources\fumatul Ucide.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it.nlp
C:\Users\Seven01\AppData\Local\Temp\it\fumatul Ucide.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\fumatul Ucide.resources\fumatul Ucide.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it\fumatul Ucide.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it\fumatul Ucide.resources\fumatul Ucide.resources.exe
C:\Users\Seven01\AppData\Local\Temp\gISEYNVyYMbzKtTWjerCTypgaZOi.dll
C:\Users\Seven01\AppData\Local\Temp\gISEYNVyYMbzKtTWjerCTypgaZOi\gISEYNVyYMbzKtTWjerCTypgaZOi.dll
C:\Users\Seven01\AppData\Local\Temp\gISEYNVyYMbzKtTWjerCTypgaZOi.exe
C:\Users\Seven01\AppData\Local\Temp\gISEYNVyYMbzKtTWjerCTypgaZOi\gISEYNVyYMbzKtTWjerCTypgaZOi.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources.exe
C:\Users\Seven01\AppData\Local\Temp\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2072.13268921
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2072.13268921
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2072.13268968

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\Timeflies.exe.config
C:\Users\Seven01\AppData\Local\Temp\Timeflies.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index149.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\f02737c83305687a68c088927a6c5a98\System.Configuration.Install.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1\System.Core.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\20008c75bb41e2febf84d4d4aea5b4e8\System.ServiceProcess.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\cf293040f3a93afa1ea782487acae816\WindowsBase.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\2ad23de8284d4594aa658dfb5e667d97\PresentationCore.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\bfaf8f86e69928fb2f67987c0203f603\PresentationFramework.ni.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll

Write Files

Nothing to display

Delete Files

C:\Users\Seven01\AppData\Local\Temp\Timeflies.exe:Zone.Identifier
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2072.13268921
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2072.13268921
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2072.13268968

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Timeflies.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index149
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index149\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index149\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\68706ec5\5adb9883
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration.Install__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.5.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.ServiceProcess__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.0.PresentationFramework__31bf3856ad364e35
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\68fb5015\1b89bb32\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\68fb5015\1b89bb32\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\68fb5015\1b89bb32\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\68fb5015\1b89bb32\7a\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\68fb5015\1b89bb32\7a\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\68fb5015\1b89bb32\7a\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\528efda8\3dbff305\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\528efda8\3dbff305\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\528efda8\3dbff305\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\528efda8\3dbff305\7b\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\528efda8\3dbff305\7b\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\528efda8\3dbff305\7b\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2d485ce4\6944285d\73
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2d485ce4\6944285d\73\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2d485ce4\6944285d\73\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2d485ce4\6944285d\73\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2d485ce4\6944285d\73\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2d485ce4\6944285d\73\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\43fd4348\4eab5f0e\74
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\43fd4348\4eab5f0e\74\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\43fd4348\4eab5f0e\74\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\43fd4348\4eab5f0e\74\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\43fd4348\4eab5f0e\74\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\43fd4348\4eab5f0e\74\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6b2ef2ae\3270cb54\75
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6b2ef2ae\3270cb54\75\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6b2ef2ae\3270cb54\75\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6b2ef2ae\3270cb54\75\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6b2ef2ae\3270cb54\75\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6b2ef2ae\3270cb54\75\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\5b43ba09\48ffecdd\76
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\5b43ba09\48ffecdd\76\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\5b43ba09\48ffecdd\76\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\5b43ba09\48ffecdd\76\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\5b43ba09\48ffecdd\76\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\5b43ba09\48ffecdd\76\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\77ccecdd\1a2c19d\77
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\77ccecdd\1a2c19d\77\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\77ccecdd\1a2c19d\77\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\77ccecdd\1a2c19d\77\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\77ccecdd\1a2c19d\77\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\77ccecdd\1a2c19d\77\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6e35940e\1639fec2\81
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6e35940e\1639fec2\81\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6e35940e\1639fec2\81\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6e35940e\1639fec2\81\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6e35940e\1639fec2\81\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6e35940e\1639fec2\81\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\82
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\82\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\82\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\82\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\82\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\82\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7f3aad1e\165f8aa0\7d
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7f3aad1e\165f8aa0\7d\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7f3aad1e\165f8aa0\7d\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7f3aad1e\165f8aa0\7d\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7f3aad1e\165f8aa0\7d\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7f3aad1e\165f8aa0\7d\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2ffb0c52\13250b76\7f
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2ffb0c52\13250b76\7f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2ffb0c52\13250b76\7f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2ffb0c52\13250b76\7f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2ffb0c52\13250b76\7f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2ffb0c52\13250b76\7f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\PresentationFramework,3.0.0.0,,31bf3856ad364e35,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.0.PresentationCore__31bf3856ad364e35
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\PresentationCore,3.0.0.0,,31bf3856ad364e35,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.0.WindowsBase__31bf3856ad364e35
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\WindowsBase,3.0.0.0,,31bf3856ad364e35,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.0.PresentationCFFRasterizer__31bf3856ad364e35
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\PresentationCFFRasterizer,3.0.0.0,,31bf3856ad364e35,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.8.0.Microsoft.VisualC__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualC,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.0.UIAutomationTypes__31bf3856ad364e35
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\UIAutomationTypes,3.0.0.0,,31bf3856ad364e35,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.0.UIAutomationProvider__31bf3856ad364e35
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\UIAutomationProvider,3.0.0.0,,31bf3856ad364e35,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Data__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Data,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.0.System.Printing__31bf3856ad364e35
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Printing,3.0.0.0,,31bf3856ad364e35,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.0.PresentationUI__31bf3856ad364e35
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\PresentationUI,3.0.0.0,,31bf3856ad364e35,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.0.ReachFramework__31bf3856ad364e35
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\ReachFramework,3.0.0.0,,31bf3856ad364e35,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1802fdb\2cba36d3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|Timeflies.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|Timeflies.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Seven01|AppData|Local|Temp|Timeflies.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1802fdb\45b258e6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\48e2b63f\454c783f
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Namespaces
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Classes\AppID\Timeflies.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE\AppCompat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\DefaultAccessPermission
HKEY_CURRENT_USER\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledProcesses\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\1531252E
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledSessions\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index149\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index149\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7f0603e4\73843e06\66\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\7ac727df\7b5311d7\61\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7b5311d7\1b0ed4d\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,3.5.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5fcea75a\3c9c8d7b\67\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3c9c8d7b\46b95040\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.ServiceProcess,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\46b91004\77ccecdd\77\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\68fb5015\1b89bb32\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\68fb5015\1b89bb32\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\68fb5015\1b89bb32\7a\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\68fb5015\1b89bb32\7a\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\68fb5015\1b89bb32\7a\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\528efda8\3dbff305\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\528efda8\3dbff305\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\528efda8\3dbff305\7b\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\528efda8\3dbff305\7b\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\528efda8\3dbff305\7b\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2d485ce4\6944285d\73\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2d485ce4\6944285d\73\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2d485ce4\6944285d\73\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2d485ce4\6944285d\73\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2d485ce4\6944285d\73\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\43fd4348\4eab5f0e\74\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\43fd4348\4eab5f0e\74\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\43fd4348\4eab5f0e\74\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\43fd4348\4eab5f0e\74\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\43fd4348\4eab5f0e\74\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6b2ef2ae\3270cb54\75\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6b2ef2ae\3270cb54\75\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6b2ef2ae\3270cb54\75\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6b2ef2ae\3270cb54\75\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6b2ef2ae\3270cb54\75\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\5b43ba09\48ffecdd\76\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\5b43ba09\48ffecdd\76\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\5b43ba09\48ffecdd\76\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\5b43ba09\48ffecdd\76\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\5b43ba09\48ffecdd\76\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\77ccecdd\1a2c19d\77\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\77ccecdd\1a2c19d\77\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\77ccecdd\1a2c19d\77\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\77ccecdd\1a2c19d\77\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\77ccecdd\1a2c19d\77\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3d67735\6e35940e\81\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6e35940e\1639fec2\81\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6e35940e\1639fec2\81\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6e35940e\1639fec2\81\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6e35940e\1639fec2\81\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6e35940e\1639fec2\81\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\55d78379\2ffb0c52\80\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\82\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\82\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\82\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\82\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\82\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7f3aad1e\165f8aa0\7d\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7f3aad1e\165f8aa0\7d\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7f3aad1e\165f8aa0\7d\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7f3aad1e\165f8aa0\7d\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7f3aad1e\165f8aa0\7d\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2ffb0c52\13250b76\7f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2ffb0c52\13250b76\7f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2ffb0c52\13250b76\7f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2ffb0c52\13250b76\7f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2ffb0c52\13250b76\7f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\PresentationFramework,3.0.0.0,,31bf3856ad364e35,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\PresentationCore,3.0.0.0,,31bf3856ad364e35,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\WindowsBase,3.0.0.0,,31bf3856ad364e35,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\PresentationCFFRasterizer,3.0.0.0,,31bf3856ad364e35,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualC,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\UIAutomationTypes,3.0.0.0,,31bf3856ad364e35,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\UIAutomationProvider,3.0.0.0,,31bf3856ad364e35,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Data,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Printing,3.0.0.0,,31bf3856ad364e35,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\PresentationUI,3.0.0.0,,31bf3856ad364e35,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\ReachFramework,3.0.0.0,,31bf3856ad364e35,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\DefaultAccessPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\1531252E
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Write Keys

Nothing to display

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
uxtheme.dll.ThemeInitApiHook
user32.dll.IsProcessDPIAware
kernel32.dll.QueryActCtxW
ole32.dll.CoGetContextToken
kernel32.dll.GetFullPathNameW
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.VirtualProtect
kernel32.dll.GlobalMemoryStatusEx
kernel32.dll.GetEnvironmentVariableW
kernel32.dll.SwitchToThread
kernel32.dll.DeleteFileW
kernel32.dll.CloseHandle
kernel32.dll.GetCurrentProcessId
advapi32.dll.LookupPrivilegeValueW
kernel32.dll.GetCurrentProcess
advapi32.dll.AdjustTokenPrivileges
kernel32.dll.OpenProcess
psapi.dll.EnumProcessModules
psapi.dll.GetModuleInformation
psapi.dll.GetModuleBaseNameW
psapi.dll.GetModuleFileNameExW
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
mscoree.dll.ND_RI4
mscoreei.dll.ND_RI4
kernel32.dll.GetUserDefaultUILanguage
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
kernel32.dll.WerRegisterMemoryBlock
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipGetImageEncodersSize
kernel32.dll.LocalAlloc
gdiplus.dll.GdipGetImageEncoders
kernel32.dll.RtlMoveMemory
kernel32.dll.LocalFree
gdiplus.dll.GdipSaveImageToStream
oleaut32.dll.#8
oleaut32.dll.#9
oleaut32.dll.#10
gdiplus.dll.GdipCreateBitmapFromStream
gdiplus.dll.GdipBitmapLockBits
gdiplus.dll.GdipBitmapUnlockBits
kernel32.dll.GetProcAddress
kernel32.dll.CreateProcessW
ntdll.dll.NtAlertResumeThread
ntdll.dll.NtGetContextThread
ntdll.dll.NtReadVirtualMemory
ntdll.dll.NtSetContextThread
ntdll.dll.NtWriteVirtualMemory
gdiplus.dll.GdipDisposeImage
kernel32.dll.VirtualAllocEx
kernel32.dll.VirtualFreeEx
kernel32.dll.VirtualProtectEx
kernel32.dll.Wow64GetThreadContext
kernel32.dll.Wow64SetThreadContext
ntdll.dll.ZwUnmapViewOfSection
ole32.dll.CoWaitForMultipleHandles
kernel32.dll.DeleteAtom
sechost.dll.LookupAccountNameLocalW
advapi32.dll.LookupAccountSidW
sechost.dll.LookupAccountSidLocalW
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptGenRandom
ole32.dll.NdrOleInitializeExtension
ole32.dll.CoGetClassObject
ole32.dll.CoGetMarshalSizeMax
ole32.dll.CoMarshalInterface
ole32.dll.CoUnmarshalInterface
ole32.dll.StringFromIID
ole32.dll.CoGetPSClsid
ole32.dll.CoTaskMemAlloc
ole32.dll.CoTaskMemFree
ole32.dll.CoCreateInstance
ole32.dll.CoReleaseMarshalData
ole32.dll.DcomChannelSetHResult
rpcrtremote.dll.I_RpcExtInitializeExtensionPoint
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
cryptsp.dll.CryptReleaseContext
advapi32.dll.EventUnregister

Execute Commands

"C:\Users\Seven01\AppData\Local\Temp\Timeflies.exe"

Started Services

Nothing to display

Created Services

Nothing to display