MalScore
100/100

Nazfilx.exe

Is DLL Packer Anti Debug Anti VM Signed XOR AntiVirus 46/66 Related 2135
File details Download PDF Report
File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 291.50 KB (298496 bytes)
Compile time: 2018-04-21 19:14:08
MD5: bd190a8db314768d2afe800176437944
SHA1: ad22dc8e5b0684eb70216af906a88feb4a8f1f10
SHA256: f6ab4f25a7a3626bb632ef474171d5bb47d2c50827ee76b1ed19ef11b6cb6de7
Import hash: f34d5f2d4577ed6d9ceec516c1f5a744
Sections 3 .text .rsrc .reloc
Directories 3 import resource relocation
First submission: 2018-05-24 03:21:07
Last submission: 2018-05-24 03:21:07
Filename detected: - Nazfilx.exe (1)
URL file hosting
hXXp://legalwatch.com/Files/Nazfilx.exeVirusTotal
Antivirus Report
Report Date Detection Ratio Permalink Update
2018-05-23 10:27:35 [46/66] VirusTotal
PE Sections 2 suspicious
Name VAddress VSize Size MD5 SHA1
.text 0x2000 0xbed4 49152 c9f1c88828deb555da49157ff96fbd6e b5bb0fe2f6c3a4bc3079a26fe87c9d12e67c9038
.rsrc 0xe000 0x3c82e 248320 af51e509a26ff84692ce64d9b25e4128 c0de79c6d02af71662b5fa6b97adbd1f03a6bba2
.reloc 0x4c000 0xc 512 c19c035ab0e179b9da4860d0676b0c81 c35fe3f64b2f973a3fe2860a5192e983b1a7e014
PE Resources
Name Offset Size Language Sublanguage Data
RT_ICON 0x3d30c 1128 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_GROUP_ICON 0x3d774 90 LANG_NEUTRAL SUBLANG_NEUTRAL
RT_HTML 0x3d7d0 52849 LANG_GERMAN SUBLANG_GERMAN
RT_MANIFEST 0x4a644 490 LANG_NEUTRAL SUBLANG_NEUTRAL
  • API Alert
  • Anti Debug
Meta Info
No Meta found in this file
XOR
No XOR informations found in this file.
Signature
This file isn't digitally signed
Packer(s)
Microsoft Visual C# / Basic .NET
Microsoft Visual Studio .NET
.NET executable
Microsoft Visual C# v7.0 / Basic .NET
File found
FIle type: Library
System.dll
System.Drawing.dll
System.Management.dll
System.Core.dll
mscoree.dll
IP Found
No IP detected
URL(s)
No URL found
String too long
=0nCNASfK0nCNoAI7YzN4YTNg0DINZnZlBCdy9GazVnCgsjR2IzKFJTMzATM34iMg0DIJpkepBCdh9GbmpAI7YkNz0SR3kTN3UjNucDI9ACeB1mRgQXYvxmZ7kSKocmbpJHdT9GVuMVSFJHKl5WaMVGdpJ3VuUGbvNnbvNkCNsTKjJlTYN0cOhyZulGbpV2QugGdh1EI9AyUJVkcK0wO4ATLFNTN0gzNz4COtASPgMmUOh1Qz5EIlxmY19GZKAyO1EzKFhjM4AjNy4SMg0DITlURyBSZsJWdvRmCNsXKowmQs1EIkl2b2ByYpxmY1BXfK0wOpICR01kRigyclRXeCxGbBRWYlJlLlxWaG5yTJ5SblR3c5NFI9ACR01kRERXTGBSXbVGd5JGIKAyOwEDO0ETLg0DIERXTGBCdy9GazpAI7Y0NzsSR3IDNzIDOuQDI9ACezh0agQXYvxmZ7kiIiRXZlJCKzVGd5JEbsFEZhVmUuUGbpZkLPlkLtVGdzl3Ug0DIiRXZlJGdlVGIdtVZ0lnYgoAI7UDM4UDI9AiY0VWZgQncvh2cKAyOxQzN4gjMxETMg0DIu10UEBCdulWdK0wepgSWD5EWgQWavZHIjlGbiVHc9pQDKAyOxkTN1ASPgMEZDlGI0J3boNXd7kiI3JGU5JCKzVGd5JEbsFEZhVmUuUGbpZkLPlkLtVGdzl3Ug0DI3JGU5dnYQlHIdtVZ0lnYgoAI7kTNzkDI9AydiBVegQncvh2c7kiIkB3RUJCKzVGd5JEbsFEZhVmUuUGbpZkLPlkLtVGdzl3Ug0DIkB3RURGcHRFIdtVZ0lnYgoAI7cDMzkjMtASPgQGcHRFI0J3boN3OpADK0lGeF5CduVWbu9mcpZnbFBiCgsTNzACI9ASeK10bgUGd5JmCNsXKog3YWNFIkl2b2ByYpxmY1BXfK0QfK0wO1YjNzMDNg0zKgk0SvZmCNsXK0YzNzMzMg0TPgk0SvZGKmlmCgsDM3IjM4ETO5ASPgk0SvZGI05Wa9pQD7kSKocmbpJHdT9GVuEXZEVFKl5WaMVGdpJ3VuUGbvNnbvNkCNsTKpEjLwgCauFGVugGdh1EKn5WaslWZD5Ca0FWTg0DIxVGRVpQD7lyNxsSRxYDM4QDMucDI90DIxVGRVhSZslGa3pAI7YzMtUUOwkzNz4SMg0DIxVGRVBSZsJWdvR2OpADK0lGeF5CduVWbu9mcpZnbFBiCgsTO2EDIg0DIXplb6BSZ0lnY7kSQGF0boUmbpxUZ0lmcX5SZs92cu92QgoAI7ISQZ50biASPgEkRB9GIn5WayR3cK0wepgyU5xUVgQWavZHIjlGbiVHc7VGU1FFIzNXYsNGIjlGbiVHcg0nC9pQD9pQD7UjMtUkNxATM5EjL40CI9ASW09mRoZ1RKZ1alF2RiFUWxV3TttGSndkCNsTW09mRoZ1RKZ1alF2RiFUWxV3TttGSndEI0NWZqJ2bK0wOpkiMuADKul2cB5Ca0FWTocmbpxWalNkLoRXYNBSPgAlVuhmCNsXKzIzKFJzNxgzMz4SMg0TPgAlVuhGKmlmCgsjMxsSR3kzMxQjL4ASPgAlVuhGIlxmY19GZ7kiIVdFVsJCKzVGd5JEbsFEZhVmUuUGbpZkLPlkLtVGdzl3Ug0DIVdFVsV1VUxGIdtVZ0lnYgoAI7YzN4ITMg0DIVdFVsBCdy9GaztTKI5mSThSZulGTlRXaydlLlx2bz52bDBiCgsjIZZmdRJCI9ACSup0UgcmbpJHdz1nCNsTKdliMsADK0hXZO5SRxJ3duJlTWhFUPRFd152UPh0awNVW3tGckhFZbRXdEFlaLp0drV0VsRXYMJVblllSoUmbpxUZ0lmcX5SZs92cu92QK0wOpgSbvRmbhJFI3Vmbg0TRxJ3duJlTWhFUPRFd152UPh0awNVW3tGckhFZg02bk5WYSpQD7ASfgYTOzczNgwCI4ATM1kTO0Ayeg0DI0VHRRp2SKd3aFdFb0FGTS1WZZpEIdtFdulmCNsTKuVmdF9GVucmbpRmb19mU05WavBHZp1ELxwCIB10Qx5GW6ZXUnd3cql3V6JXW5dFToQmb19mUugGdh1EI9ASS1R1aK0wO4ITLFdDO4ATM24iNtASPgEUTDFnbYpndRd2dzpWeXpncZl3VMBSZsJWdvRmCNsXKzgDOxQzN1ADMuATLg0TPgkUdUtGKmlmCgsTNwMTOzAzMuADI9ASS1R1agUGbiV3bkpQD7lCK4V1Q2BCZp9mdgMWasJWdw1nCNoAI7EDMwATO4UTN1ASPg0WWBFFI05Wa1pAI7MDN1kDN4ADOyYjNxQzN3gjNg0DICVEcwByZu9Gb7kidxhGSoUmbpxUZ0lmcX5SZs92cu92QgoAI7IyZyllZiASPgYXcohEIn5WayR3cKAyO2UDM1YDI9AiS6NXdgQncvh2c1pQD7lCK6BnSrBCZp9mdgMWasJWdw1nCN0nCN0nCNsTKwMzKFNjMzYTMw4yMoUmbpxUZ0lmcX5SZs92cu92QK0wegkyOgsDIoI3bmpQD7kSKxgibhRlLoRXYNhyZulGbpV2QugGdh1EI9AyaY52cK0wepITMxIDO54iMg0TPgsGWuNHKmlmCgsjNzsSRzITM1UTNuIDI9AyaY52cgUGbiV3bktTKwgCdphXRuQnbl1mbvJXa25WRgoAI7gTOxACI9Ayb1dnagUGd5JmCgszN1ASPgcUdxJEI05Wa1pAI7ITM1MDOxETN2kzM0UDNyMDI9AybWVXagcmbvxWdK0wepgiertmVgQWavZHIjlGbiVHc9pQDKAyOwUzMzkjN2gDM1QzN1gDO3EDI9ACVQl3TgcmbvxWd9pQD7kSKocmbpJHdT9GVuElSTtGKlRXaydlLlx2bz52bDpQD7gDMtUUN3QjNwAjL50CI9AidpZGRwZ1RQZHaKlXSyJXcYhmW1dkc5NGZQBSZsJWdvRmCNsXK4ATLFZjNxADN24SMtASP9ASUKN1aoYWaKAyOwMzKFZDMwkzMuMTLg0DIRp0UrBSZsJWdvRWfK0wO1kTN1kDI9sCIYdGbhpQD7lCNxETMyIzNxIDI90DIYdGbhhSZslGa3pAI7QTMxEjMycTMyASPgg1ZsFGI05WaKAyOxEDI9AyS0t0dgQnbpVnCNsXKog3TzFFIkl2b2ByYpxmY1B3eWZ2YDByczFGbjByYpxmY1BHI9pQfK0gCgsDO3gTO5gTN3QDO3gjNxMTM2ASPgcGeXJEIn52bspAI7QTM3MTO0gzN2ASPgwWaqVHI05Wa1tTKwgCdphXRuQnbl1mbvJXa25WRgoAI7ETNxACI9AiWVlVYgUGd5JWfK0wOpgSeltEZhVmUuUGbvNnbvNkCNsTKlB1VJRHVN90TI9mcoQmb19mUugGdh1EI9ASY6dnWK0wOyMzKFlDOwgzMy4COtASPgUGUXlEdU10TPh0byBSZsJWdvRmCNsXK4czM4ETMzAjLw0CI90DIhp3dahSZslGa3pAI7QzMrU0MwgzMyMjL00CI9ASY6dnWgUGbiV3bkpQD7lCKGhnSPBCZp9mdgMWasJWdw1nCNsTKJF0VJhSZulGTlRXaydlLlx2bz52bDBiCgsjIG1EdaJCI9ASSBdVSgcmbpJHdzpAI7YjM1YjMzYTM2YTM2gDMyAzNg0DIZ9UTGByZu9Gb1pAI7gTNg0DIzdWdyBCdulWd7kiI5VWQuJCKzVGd5JEbsFEZhVmUuUGbpZkLPlkLtVGdzl3Ug0DI5VWQulXZB5GIdtVZ0lnYgoAI7czMxkTLg0DI5VWQuBCdy9GazpQD7lCKsNUdDBCZp9mdgMWasJWdw1nCNsTKigWYrxmIoMXZ0lnQsxWQkFWZS5SZslmRu8USu0WZ0NXeTBSPggWYrxGahtGbg01WlRXeiBiCgsDN2UzMg0DIoF2asBCdy9GazpAI7ETN5EDNg0DIw1WSIBCdy9GazV3OpIyZnJ2UigyclRXeCxGbBRWYlJlLlxWaG5yTJ5SblR3c5NFI9AyZnJ2UndmYTBSXbVGd5JGIKAyOzIDMwETLg0DIndmYTBCdy9GaztTKiclYr1kIoMXZ0lnQsxWQkFWZS5SZslmRu8USu0WZ0NXeTBSPgclYr10VitWTg01WlRXeiBiCgsDM4MTMtASPgclYr1EI0J3boNnCNsXKoolZ5ZFIkl2b2ByYpxmY1BXfK0gCgszM4cjMyUjM0IjN0czM1kzMg0DIaRFcOByZu9GbKAyOwYDOyMDI9AyaMRmUgQncvh2c1tTKoUmbpxEZhVmUuUGbvNnbvNEIKAyO4kDIg0DIK90UTBSZ0lnYztTKXZnUvhSZulGTlRXaydlLlx2bz52bDBiCgsjIHpXRYJCI9AyV2J1bgcmbpJHdzpQD7lCKPp1QrBCZp9mdgMWasJWdwtHdrlXdgM3chx2YgMWasJWdwBSfK0nCNoAI7UzN5AjN5ASPgYkZ3BHI05Wa1pAI7UTNzQTNg0DIDd0SNBCdy9GazV3OpADK0lGeF5CduVWbu9mcpZnbFBiCgsjN5ACI9AiS0J3QgUGd5JmCgsTO4MTNg0DInR0TrBCdulWdK0wepgyZVB1UgQWavZHIjlGbiVHc9pQD7kCMoQXa4VkL05WZt52bylmduVEIKAyO2MjMgASPgAFTjdFIlRXei1nCN0nCNoQD7lCelBibvlGdwV2Y4VEKoNGdhNWfK0QfK0wOt0yUnZVaKBFTO5WeGhnZE92c1pQD7V2csVWfK0wOrsyUnZVaKBFTO5WeGhnZE92c1pQD7liN0cjN0ASP9AyUnZVaKBFTO5WeGhnZE92c1hiZppQD7AjN1kjN1UDI9AyUnZVaKBFTO5WeGhnZE92c1BCdulmCNsXeyRnCNsTKlVHbhZFeh1kLlxmY19GZgwSZ1xWYW5WaN5SZsJWdvRGK39GUugGdh1EI9Aid5FWZK0wepMTMrUEOxMTNxMjL5ASP9Aid5FWZoUGbph2dKAyO0EzKFhzMwQjM54iNg0DI2lXYlBSZsJWdvRmCgszMxIDM1ATMzIDN5UDMxcjNg0DIpJWc2ByZu9Gb7kCKl5WaMRWYlJlLlx2bz52bDBiCgsDMgASPgomQVpHIlRXeiNnCNsXKoQGdaxEIkl2b2ByYpxmY1BXfK0gCgsDMykDM2ATO5IzNwADO1ATOg0DIBd0T0ByZu9GbKAyO4ADN0czMzMDN1gTMyUjMwQDI9ASYZRmegcmbvxmCgsjR1MTLFJDO2YjMx4SMg0DIElWQiBCdh9Gbm1nCNsjM2cTOyUDI9sCIKl0YBpQD7lyN0gjMxgTM5kDI90DIKl0YBhSZslGa3pAI7cDN4ITM4ETO5ASPgoUSjFEI05WaK0wepgiT1p2YgQWavZHIjlGbiVHc9pQD7kiI5NURnJCKzVGd5JEbsFEZhVmUuUGbpZkLPlkLtVGdzl3Ug0DI5NURnl3QFdGIdtVZ0lnYgoAI7YTO2cjMtASPgk3QFdGI0J3boNnCgsjN1ETM0YjM4QzM0UTN3kjNyASPggEbwJFIn52bsVXfK0wOzIDOygTOgsCIxNXQpBSPgE3cBlmCNsXK5MDN2ASP9ASczFUaoUGbph2dKAyO5MDN2ASPgE3cBlGI05WaKAyO2EjM4QjNzgDOwUzM1cDN5ASPg80aW1GIn52bsVnCNsXKok3dvdHIkl2b2ByYpxmY1B3eltkeWByczFGbjByYpxmY1BXCK0QCK0QfgACIgoQD9BCIgACIgACIK0QfgACIgACIgACIgACIK0gCNsHIgACIgACIgACIgAiCNg2Y0F2YgACIgACIgACIgACIK0QfgACIgACIgACIgACIK0wOpgCdyFGdT5icoRXCJkQCK0wOpglQ2h0ZOlEcKJ2ZCZVTSNGKkFWZyhGVucmbpRWYlJHaU5SblR3c5NFI3Vmbg0DIyhGdgQWYlJHaU5yZulGZhVmcoRlLtVGdzl3UJkQCJoQDJkQCJoQD7kSKpA3dNhWaoU2Zh1WSyUGd5JEKw1mQt9mcGRnclZnbvNEKJVWQXZ3ZtBSPgA3dNhWaJkQCJoQD7kSKlNmc192clJ1coIzM05WSvRlL0JXZ252bD5SblR3c5NFIsADIsA3dNhWagwSZjJXdvNXZSRGK5B3bD5Cbhh2cyFWTuMXZjlmdyV2Uw9mclRnbJ5SZtlGduVnUu0WZ0NXeTlQCJkgCNsTXlNmc192clJ1cbVGd5JGI3Vmbg0DIwdXTolWCJkQCK0QCJkQCK0wOpU2YyV3bzVmUshSZjJXdvNXZSt2YvxEI9ASZjJXdvNXZSRGIyRHU05WSJkQCJoQD7kSZjJXdvNXZSZGIskCMoIHdQRnbJBydl5GKlNmc192clJFZh9GTg0DIlNmc192clJFbgIHdQRnbJlQCJkgCNsTKlNmc192clJlZgwSKwgic0BFdulEI3VmboU2YyV3bzVmUm9WZ6l2Ug0DIlNmc192clJ1cgQnbpVXCJkQCK0wOpkyMygic0BFdulEI3VmbgwSK0ITMoIHdQRnbJBydl5GIskCMoIHdQRnbJBydl5GKlNmc192clJFZulmRg0DIlNmc192clJlZgIHdQRnbJlQCJkgCNkQC7BCIgACIgACIgACIgoQD5JHdgACIgACIgACIgACIK0wegACIgACIgAiCNkCKulWYNBCZp9mdgMWa0FGdzBCIgACIgACIK0QCJoQD9BCIgACIgACIK0QfgACIgACIgACIgACIK0wOp0WYlJHdzhCch1GdpJEI3Vmbg4mc1RXZyBCIgACIgACIgACIgACIgAiCNsHIgACIgACIgACIgAiCNkSKn1Wao0WYlJHdTlncv1WZNBydl5GI9ASbhVmc0NHIyFmdoAyZul2c1BCIgACIgACIgACIgoQD7BCIgACIgACIK0QKn1Wag01WlRXeihSZnFWbJJTZ0lnQgAXYtRXaCByYpRXY0NHIjlGbiVHcJkgCNoQDJkgCNsTKhRXYENXZShGIyRHU05WSoU2YyV3bzVmUrN2bMBic0BFdulEIuJXZ0hXZgMWa0FGdzlQCK0QXpICbsRmLyMDbl5mcltmIoQncvBXbJxGbEtVCJoQDJkgCNsTKvZmbJNXZShGIyRHU05WSgwSZsVHZv1EagIHdQRnbJhSZjJXdvNXZSRWYvxEIyRHU05WSg4mclRHelByYpRXY0NXCJoQDdlSZ1JHd9I3byJXR0NXYMRXZTBCLiwGbk5iMzwWZuJXZrJCK0J3bw1WSsxGRblQCK0QCJoQD7kybm5WSzVmUoBic0BFdulEIsUGb1R2bNhGIyRHU05WSoU2YyV3bzVmUm9WZ6l2UgQnbpVHIuJXZ0hXZgMWa0FGdzlQCK0QXpUWdyRXPy9mcyVEdzFGT0V2UgwiIsxGZuIzMsVmbyV2aigCdy9GctlEbsR0WJkgCNkQCK0wOpUGc5RFcsBic0BFdulEIsUWbh5EcsBic0BFdulEIsUGb1R2bNhGIyRHU05WSoU2YyV3bzVmUk5WaGBic0BFdulEIuJXZ0hXZgMWa0FGdzlQCK0QXpICbsRmLyMDbl5mcltmIoQncvBXbJxGbEtVCJoQDJkgCN0XCJoQD7kSfg0HI7BSXbdmbpJHdzBydl5GI7BSXbR3YlpmYvBydl5GIswGb15GKlt2b25WSuQnbp9GU5JHduVkLpA3dNhWaoQWYvxkL5xmYtV2czFUCJkgCNsXCJoQDpgCWCZHSn5USwpkYnJkVNJ1YgQWavZHIjlGdhR3cgMWasJWdwlQCK0wOwdXTolGIdtVZ0lnYgMWa0FGdzlQCK0QCJoQDJkgCN0HIgACIgACIgoQD7YGIuJXd0VmcgACIgACIgACIgACIK0wOpgGdn5WZM5iZgwCMgwiZgwCNgwiZmVnYokHcvN0aj9GbC5iclZmZ1JEIgACIgACIgACIgAiCNsTXuVGbbVGd5JGI3Vmbg0DImBSXbVGd5JGIgACIgACIgACIgAiCNsTKwACLmZWdihiMzQnbJ9GVuIXZ0JXZ252bDRXaCBSPg4WZsBCdulGIgACIgACIgACIgAiCNoQD9BCIgACIgACIgACIgoQD9BCIgACIgACIgACIgACIgAiCNsDNg0zKgsGIgACIgACIgACIgACIgACIgACIgoQD7kCNgwyagwiZmVnYgwCMgwSKpgiYnJXQvRlLpkHIsgHKsVGepBFdldkLihyclRXeCRXZH5iclRnclZnbvNEdpJEK5B3bDt2YvxmQuIXZmZWdCBCIgACIgACIgACIgACIgACIgACIK0wegACIgACIgACIgACIgACIgoQDpsyK5ByOsBCPgkHI7ADI9ASegQnbphCIy9mZgACIgACIgACIgACIgACIgoQD7BCIgACIgACIgACIgoQDpsyK4ByOsBCPggHI7ADI9ACegQnbphCIy9mZgACIgACIgACIgACIK0gCNsDMg0DIrBCdulGIgACIgACIgACIgAiCNsTXutVZ0lnYgcXZuBSPgYmZ1JGIdtVZ0lnYgACIgACIgACIgACIK0wO0AiKgwGIqACbg0DIuBCdulGIgACIgACIgACIgAiCNsDa0RWaX5iYg0DIsBCdulGIgACIgACIgACIgAiCNsHIgACIgACIgoQDpIGIwFWb0lmQucmbpdXYyRkLtVGdzl3UoAXbC12byZEdyVmdu92Qg01WlRXeiByYpRXY0NHIlRXY2lmcwlQCK0QCJoQD9BCIgACIgACIK0wOzVGd5JGIuJXd0VmcgACIgACIgACIgACIK0QfgACIgACIgACIgACIK0wOdZTMgUCIptVehJncBVGd5JGI94FIdl2WzVGd5JGIgACIgACIgACIgACIgACIK0wegACIgACIgACIgACIK0QKrsSagsDa0dmblxkLzVGd5JGI8ASagsDMg0DIpBCdulGKgI3bmBCIgACIgACIgACIgoQD7kSZsZkWxd0TSdWaEh2aoMXZ0lnQ0V2RuUGZvNWauVlLn5Wak92YuVEI9ASehJncBVGd5JGIdtVZ0lnYgACIgACIgACIgACIK0wegACIgACIgAiCNkyclRXeiBSXbVGd5JGKJVWQXZ3ZtBSXbVGd5JGIjlGdhR3cgUGdhZXayBHIgACIgACIgoQD7IyIzNXYwNiIg0DIlxmRaF3RPJ1ZpREarByZulmc0NHIjlGdhR3cgACIgACIgAiCNoQD7BCIgAiCN0WYyd2byBFIzNXYsNGIgACIK0gCNASfK0nCNoAI7YzN4YTNg0DIK5kTkBCdy9GazVnCgsjR2IzKFJTMzATM34iMg0DIDFnVsBCdh9GbmpAI7YkNz0SR3kTN3UjNucDI9AyUHVFcgQXYvxmZ7kSKocmbpJHdT9GVuY1aXtEKl5WaMVGdpJ3VuUGbvNnbvNkCNsTKk5kdNJ3cPhyZulGbpV2QugGdh1EI9AiVrd1SK0wO4ATLFNTN0gzNz4COtASPgQmT21kcz9EIlxmY19GZKAyO1EzKFhjM4AjNy4SMg0DIWt2VLBSZsJWdvRmCNsXKoolViFEIkl2b2ByYpxmY1BXfK0wOpICV5dkTigyclRXeCxGbBRWYlJlLlxWaG5yTJ5SblR3c5NFI9ACV5dkTUl3ROBSXbVGd5JGIKAyOwEDO0ETLg0DIUl3ROBCdy9GazpAI7Y0NzsSR3IDNzIDOuQDI9ASZs5UZgQXYvxmZ7kiI6RnT1JCKzVGd5JEbsFEZhVmUuUGbpZkLPlkLtVGdzl3Ug0DI6RnT1pHdOVHIdtVZ0lnYgoAI7UDM4UDI9Aie05UdgQncvh2cKAyOxQzN4gjMxETMg0DI2dHZGBCdulWdK0wepgCd2x2dgQWavZHIjlGbiVHc9pQDKAyOxkTN1ASPggkTXZGI0J3boNXd7kiImhFUmJCKzVGd5JEbsFEZhVmUuUGbpZkLPlkLtVGdzl3Ug0DImhFUmZGWQZGIdtVZ0lnYgoAI7kTNzkDI9AiZYBlZgQncvh2c7kiIC9kWLJCKzVGd5JEbsFEZhVmUuUGbpZkLPlkLtVGdzl3Ug0DIC9kWLJ0TatEIdtVZ0lnYgoAI7cDMzkjMtASPgI0TatEI0J3boN3OpADK0lGeF5CduVWbu9mcpZnbFBiCgsTNzACI9AiQqFVTgUGd5JmCNsXKo4ESIlHIkl2b2ByYpxmY1BXfK0QfK0wO1YjNzMDNg0zKgc2bhFmCNsXK0YzNzMzMg0TPgc2bhFGKmlmCgsDM3IjM4ETO5ASPgc2bhFGI05Wa9pQD7kSKocmbpJHdT9GVuc0RYxEKl5WaMVGdpJ3VuUGbvNnbvNkCNsTKpEjLwgCauFGVugGdh1EKn5WaslWZD5Ca0FWTg0DIHdEWMpQD7lyNxsSRxYDM4QDMucDI90DIHdEWMhSZslGa3pAI7YzMtUUOwkzNz4SMg0DIHdEWMBSZsJWdvR2OpADK0lGeF5CduVWbu9mcpZnbFBiCgsTO2EDIg0DI0NXYhBSZ0lnY7kyUrV2doUmbpxUZ0lmcX5SZs92cu92QgoAI7IiV6t0ciASPgM1aldHIn5WayR3cK0wepgCaIN1RgQWavZHIjlGbiVHc7l1aEtEIzNXYsNGIjlGbiVHcg0nC9pQD9pQD7UjMtUkNxATM5EjL40CI9ACeDxmUnxkYjVkTWNkatVnYkR3UhNkSkhkCNsDeDxmUnxkYjVkTWNkatVnYkR3UhNkSkhEI0NWZqJ2bK0wOpkiMuADKul2cB5Ca0FWTocmbpxWalNkLoRXYNBSPgYkS5JlCNsXKzIzKFJzNxgzMz4SMg0TPgYkS5JFKmlmCgsjMxsSR3kzMxQjL4ASPgYkS5JFIlxmY19GZ7kiIodUQJJCKzVGd5JEbsFEZhVmUuUGbpZkLPlkLtVGdzl3Ug0DIodUQJh2RBlEIdtVZ0lnYgoAI7YzN4ITMg0DIodUQJBCdy9GaztTKU9WaDhSZulGTlRXaydlLlx2bz52bDBiCgsjInx2UaJCI9ACVvl2QgcmbpJHdz1nCNsTKdliMsADK0hXZO5CUqxkeSBlVsxmRDJVQnpmeJhkapBVWXBHe4dUUbFVU5VlQ1xESXxUbvZlb6h3SSJleoUmbpxUZ0lmcX5SZs92cu92QK0wOpgSbvRmbhJFI3Vmbg0DUqxkeSBlVsxmRDJVQnpmeJhkapBVWXBHe4dUUg02bk5WYSpQD7ASfgYTOzczNgwCI4ATM1kTO0Ayeg0DIRFVeVJUdMh0VM12bW5me4tkUSpHIdtFdulmCNsTKuVmdF9GVucmbpRmb19mU05WavBHZp1ELxwCIMN0Y0hlU0p1QDRGWDRFdGJ0cOFGWoQmb19mUugGdh1EI9ACTLlERK0wO4ITLFdDO4ATM24iNtASPgw0QjRHWSRnWDNEZYNEV0ZkQz5UYYBSZsJWdvRmCNsXKzgDOxQzN1ADMuATLg0TPgw0SJREKmlmCgsTNwMTOzAzMuADI9ACTLlERgUGbiV3bkpQD7lCKFpHdQBCZp9mdgMWasJWdw1nCNoAI7EDMwATO4UTN1ASPgsEVUVGI05Wa1pAI7MDN1kDN4ADOyYjNxQzN3gjNg0DI3pHRGByZu9Gb7kyVTlkaoUmbpxUZ0lmcX5SZs92cu92QgoAI7ICdXRWciASPgc1UJpGIn5WayR3cKAyO2UDM1YDI9AiSDdXRgQncvh2c1pQD7lCKLlXVrBCZp9mdgMWasJWdw1nCN0nCN0nCNsTKwMzKFNjMzYTMw4yMoUmbpxUZ0lmcX5SZs92cu92QK0wegkyOgsDIoI3bmpQD7kSKxgibhRlLoRXYNhyZulGbpV2QugGdh1EI9AiQEVmSK0wepITMxIDO54iMg0TPgIERlpEKmlmCgsjNzsSRzITM1UTNuIDI9AiQEVmSgUGbiV3bktTKwgCdphXRuQnbl1mbvJXa25WRgoAI7gTOxACI9ACaW1magUGd5JmCgszN1ASPgMGcoNEI05Wa1pAI7ITM1MDOxETN2kzM0UDNyMDI9ASZhtkYgcmbvxWdK0wepgCd5p0bgQWavZHIjlGbiVHc9pQDKAyOwUzMzkjN2gDM1QzN1gDO3EDI9AiSoBVcgcmbvxWd9pQD7kSKocmbpJHdT9GVuYmUIRFKlRXaydlLlx2bz52bDpQD7gDMtUUN3QjNwAjL50CI9ASbKRmRxlWaBJ1V0ZlZpxkdaB1dT9UbYFnc5BSZsJWdvRmCNsXK4ATLFZjNxADN24SMtASP9AiZShEVoYWaKAyOwMzKFZDMwkzMuMTLg0DImJFSUBSZsJWdvRWfK0wO1kTN1kDI9sCIQl1T3pQD7lCNxETMyIzNxIDI90DIQl1T3hSZslGa3pAI7QTMxEjMycTMyASPgAVWPdHI05WaKAyOxEDI9AycTBXQgQnbpVnCNsXKokETI5EIkl2b2ByYpxmY1B3eSpXTvByczFGbjByYpxmY1BHI9pQfK0gCgsDO3gTO5gTN3QDO3gjNxMTM2ASPgMlcnVHIn52bspAI7QTM3MTO0gzN2ASPgI0T55EI05Wa1tTKwgCdphXRuQnbl1mbvJXa25WRgoAI7ETNxACI9AScxdGTgUGd5JWfK0wOpgSeltEZhVmUuUGbvNnbvNkCNsTKvlWRshGStd1dwJUSoQmb19mUugGdh1EI9AiSUVlaK0wOyMzKFlDOwgzMy4COtASPg8WaFxGaI12V3BnQJBSZsJWdvRmCNsXK4czM4ETMzAjLw0CI90DIKRVVqhSZslGa3pAI7QzMrU0MwgzMyMjL00CI9AiSUVlagUGbiV3bkpQD7lCKOR3b1BCZp9mdgMWasJWdw1nCNsTKUplZZhSZulGTlRXaydlLlx2bz52bDBiCgsjIudWbsJCI9ACVaZWWgcmbpJHdzpAI7YjM1YjMzYTM2YTM2gDMyAzNg0DIMtEcjByZu9Gb1pAI7gTNg0DIqpFSUBCdulWd7kiIWdlUvJCKzVGd5JEbsFEZhVmUuUGbpZkLPlkLtVGdzl3Ug0DIWdlUvZ1VS9GIdtVZ0lnYgoAI7czMxkTLg0DIWdlUvBCdy9GazpQD7lCKVlESkBCZp9mdgMWasJWdw1nCNsTKionaKdmIoMXZ0lnQsxWQkFWZS5SZslmRu8USu0WZ0NXeTBSPgonaKdmeqp0Zg01WlRXeiBiCgsDN2UzMg0DI6pmSnBCdy9GazpAI7ETN5EDNg0DIkpnemBCdy9GazV3OpIiehZ1cigyclRXeCxGbBRWYlJlLlxWaG5yTJ5SblR3c5NFI9AiehZ1c6FmVzBSXbVGd5JGIKAyOzIDMwETLg0DI6FmVzBCdy9GaztTKiAlQL5mIoMXZ0lnQsxWQkFWZS5SZslmRu8USu0WZ0NXeTBSPgAlQL5GUCtkbg01WlRXeiBiCgsDM4MTMtASPgAlQL5GI0J3boNnCNsXKo8Ubl5GIkl2b2ByYpxmY1BXfK0gCgszM4cjMyUjM0IjN0czM1kzMg0DIKx0c3ByZu9GbKAyOwYDOyMDI9ASYUZFUgQncvh2c1tTKoUmbpxEZhVmUuUGbvNnbvNEIKAyO4kDIg0DIahGT6BSZ0lnYztTKJtmaQhSZulGTlRXaydlLlx2bz52bDBiCgsjItZVRDJCI9ASSrpGUgcmbpJHdzpQD7lCKTpkZJBCZp9mdgMWasJWdwtXaNRkRgM3chx2YgMWasJWdwBSfK0nCNoAI7UzN5AjN5ASPgg1VrRFI05Wa1pAI7UTNzQTNg0DISN0ZZBCdy9GazV3OpADK0lGeF5CduVWbu9mcpZnbFBiCgsjN5ACI9AyRklFSgUGd5JmCgsTO4MTNg0DIp5USQBCdulWdK0wepgCeV52ZgQWavZHIjlGbiVHc9pQD7kCMoQXa4VkL05WZt52bylmduVEIKAyO2MjMgASPgc0YHdGIlRXei1nCN0nCNoQD7lCelBibvlGdwV2Y4VEKoNGdhNWfK0QfK0wOt0iRvhWdvlUUjZHSHNFdo9WTLpQD7V2csVWfK0wOrsiRvhWdvlUUjZHSHNFdo9WTLpQD7liN0cjN0ASP9AiRvhWdvlUUjZHSHNFdo9WTLhiZppQD7AjN1kjN1UDI9AiRvhWdvlUUjZHSHNFdo9WTLBCdulmCNsXeyRnCNsTKlVHbhZFeh1kLlxmY19GZgwSZ1xWYW5WaN5SZsJWdvRGK39GUugGdh1EI9AyYqpkcK0wepMTMrUEOxMTNxMjL5ASP9AyYqpkcoUGbph2dKAyO0EzKFhzMwQjM54iNg0DIjpmSyBSZsJWdvRmCgszMxIDM1ATMzIDN5UDMxcjNg0DIjlGRZByZu9Gb7kCKl5WaMRWYlJlLlx2bz52bDBiCgsDMgASPgonUltEIlRXeiNnCNsXKoQkWT5EIkl2b2ByYpxmY1BXfK0gCgsDMykDM2ATO5IzNwADO1ATOg0DIMJGUFByZu9GbKAyO4ADN0czMzMDN1gTMyUjMwQDI9ASVlJ3TgcmbvxmCgsjR1MTLFJDO2YjMx4SMg0DISJUVnBCdh9Gbm1nCNsjM2cTOyUDI9sCI192TOpQD7lyN0gjMxgTM5kDI90DI192TOhSZslGa3pAI7cDN4ITM4ETO5ASPgU3bP5EI05WaK0wepgSSINmcgQWavZHIjlGbiVHc9pQD7kiIWpEa0JCKzVGd5JEbsFEZhVmUuUGbpZkLPlkLtVGdzl3Ug0DIWpEa0ZlSoRHIdtVZ0lnYgoAI7YTO2cjMtASPgYlSoRHI0J3boNnCgsjN1ETM0YjM4QzM0UTN3kjNyASPgMkWDxGIn52bsVXfK0wOzIDOygTOgsCIPZVTNBSPg8kVN1kCNsXK5MDN2ASP9AyTW1UToUGbph2dKAyO5MDN2ASPg8kVN1EI05WaKAyO2EjM4QjNzgDOwUzM1cDN5ASPgYVcY9GIn52bsVnCNsXKoUWa0ZGIkl2b2ByYpxmY1B3enVnTNByczFGbjByYpxmY1BXCK0weK0QYupXTWR2UPFnR6lGIlNWYwNXZtFmbK0gCNszZul2dhJHRu0WZ0NXeTByZul2c1pQD7MXZjlmdyV2Uw9mclRnbJ5SZtlGduVnUu0WZ0NXeTByZul2c1pQD7cmbpRWYlJHaU5SblR3c5NFIn5WazVnCNsjbvlGdjVGbmVmUu0WZ0NXeTByZul2c1pQD7QHelRlLtVGdzl3UgcmbpNXdK0wOPlkLtVGdzl3UgcmbpNXdK0wOtVGdzl3UgcmbpNXd
zLeM
wlKUUh
ygDQse
POny
XkuADoHSolAF
wTJApJ
twPiRS
o.#
zjKoRe
.ci.ki.si
mtiX
UrouWZ
RoLMHH
ltGaAN
EbAD
System.dll
$this.TrayHeight
wAfhEk
mlkGpN
.+i.3i.;i.Ci.K
PNuqJF
gXLG
cHMk
GJlVda
alTF
$this.DrawGrid
opZqHT
iGxN
hOOcIs
GvcCBL
uiBbGL
TBOBcIYTprRt
OfrTnD
WNlY
VgBRjB
#pass#
YKazqW
=0nCNASfK0nCNoAI7YzN4YTNg0DINZnZlBCdy9GazVnCgsjR2IzKFJTMzATM34iMg0DIJpkepBCdh9GbmpAI7YkNz0SR3kTN3UjNucDI9ACeB1mRgQXYvxmZ7kSKocmbpJHdT9GVuMVSFJHKl5WaMVGdpJ3VuUGbvNnbvNkCNsTKjJlTYN0cOhyZulGbpV2QugGdh1EI9AyUJVkcK0wO4ATLFNTN0gzNz4COtASPgMmUOh1Qz5EIlxmY19GZKAyO1EzKFhjM4AjNy4SMg0DITlURyBSZsJWdvRmCNsXKowmQs1EIkl2b2ByYpxmY1BXfK0wOpICR01kRigyclRXeCxGbBRWYlJlLlxWaG5yTJ5SblR3c5NFI9ACR01kRERXTGBSXbVGd5JGIKAyOwEDO0ETLg0DIERXTGBCdy9GazpAI7Y0NzsSR3IDNzIDOuQDI9ACezh0agQXYvxmZ7kiIiRXZlJCKzVGd5JEbsFEZhVmUuUGbpZkLPlkLtVGdzl3Ug0DIiRXZlJGdlVGIdtVZ0lnYgoAI7UDM4UDI9AiY0VWZgQncvh2cKAyOxQzN4gjMxETMg0DIu10UEBCdulWdK0wepgSWD5EWgQWavZHIjlGbiVHc9pQDKAyOxkTN1ASPgMEZDlGI0J3boNXd7kiI3JGU5JCKzVGd5JEbsFEZhVmUuUGbpZkLPlkLtVGdzl3Ug0DI3JGU5dnYQlHIdtVZ0lnYgoAI7kTNzkDI9AydiBVegQncvh2c7kiIkB3RUJCKzVGd5JEbsFEZhVmUuUGbpZkLPlkLtVGdzl3Ug0DIkB3RURGcHRFIdtVZ0lnYgoAI7cDMzkjMtASPgQGcHRFI0J3boN3OpADK0lGeF5CduVWbu9mcpZnbFBiCgsTNzACI9ASeK10bgUGd5JmCNsXKog3YWNFIkl2b2ByYpxmY1BXfK0QfK0wO1YjNzMDNg0zKgk0SvZmCNsXK0YzNzMzMg0TPgk0SvZGKmlmCgsDM3IjM4ETO5ASPgk0SvZGI05Wa9pQD7kSKocmbpJHdT9GVuEXZEVFKl5WaMVGdpJ3VuUGbvNnbvNkCNsTKpEjLwgCauFGVugGdh1EKn5WaslWZD5Ca0FWTg0DIxVGRVpQD7lyNxsSRxYDM4QDMucDI90DIxVGRVhSZslGa3pAI7YzMtUUOwkzNz4SMg0DIxVGRVBSZsJWdvR2OpADK0lGeF5CduVWbu9mcpZnbFBiCgsTO2EDIg0DIXplb6BSZ0lnY7kSQGF0boUmbpxUZ0lmcX5SZs92cu92QgoAI7ISQZ50biASPgEkRB9GIn5WayR3cK0wepgyU5xUVgQWavZHIjlGbiVHc7VGU1FFIzNXYsNGIjlGbiVHcg0nC9pQD9pQD7UjMtUkNxATM5EjL40CI9ASW09mRoZ1RKZ1alF2RiFUWxV3TttGSndkCNsTW09mRoZ1RKZ1alF2RiFUWxV3TttGSndEI0NWZqJ2bK0wOpkiMuADKul2cB5Ca0FWTocmbpxWalNkLoRXYNBSPgAlVuhmCNsXKzIzKFJzNxgzMz4SMg0TPgAlVuhGKmlmCgsjMxsSR3kzMxQjL4ASPgAlVuhGIlxmY19GZ7kiIVdFVsJCKzVGd5JEbsFEZhVmUuUGbpZkLPlkLtVGdzl3Ug0DIVdFVsV1VUxGIdtVZ0lnYgoAI7YzN4ITMg0DIVdFVsBCdy9GaztTKI5mSThSZulGTlRXaydlLlx2bz52bDBiCgsjIZZmdRJCI9ACSup0UgcmbpJHdz1nCNsTKdliMsADK0hXZO5SRxJ3duJlTWhFUPRFd152UPh0awNVW3tGckhFZbRXdEFlaLp0drV0VsRXYMJVblllSoUmbpxUZ0lmcX5SZs92cu92QK0wOpgSbvRmbhJFI3Vmbg0TRxJ3duJlTWhFUPRFd152UPh0awNVW3tGckhFZg02bk5WYSpQD7ASfgYTOzczNgwCI4ATM1kTO0Ayeg0DI0VHRRp2SKd3aFdFb0FGTS1WZZpEIdtFdulmCNsTKuVmdF9GVucmbpRmb19mU05WavBHZp1ELxwCIB10Qx5GW6ZXUnd3cql3V6JXW5dFToQmb19mUugGdh1EI9ASS1R1aK0wO4ITLFdDO4ATM24iNtASPgEUTDFnbYpndRd2dzpWeXpncZl3VMBSZsJWdvRmCNsXKzgDOxQzN1ADMuATLg0TPgkUdUtGKmlmCgsTNwMTOzAzMuADI9ASS1R1agUGbiV3bkpQD7lCK4V1Q2BCZp9mdgMWasJWdw1nCNoAI7EDMwATO4UTN1ASPg0WWBFFI05Wa1pAI7MDN1kDN4ADOyYjNxQzN3gjNg0DICVEcwByZu9Gb7kidxhGSoUmbpxUZ0lmcX5SZs92cu92QgoAI7IyZyllZiASPgYXcohEIn5WayR3cKAyO2UDM1YDI9AiS6NXdgQncvh2c1pQD7lCK6BnSrBCZp9mdgMWasJWdw1nCN0nCN0nCNsTKwMzKFNjMzYTMw4yMoUmbpxUZ0lmcX5SZs92cu92QK0wegkyOgsDIoI3bmpQD7kSKxgibhRlLoRXYNhyZulGbpV2QugGdh1EI9AyaY52cK0wepITMxIDO54iMg0TPgsGWuNHKmlmCgsjNzsSRzITM1UTNuIDI9AyaY52cgUGbiV3bktTKwgCdphXRuQnbl1mbvJXa25WRgoAI7gTOxACI9Ayb1dnagUGd5JmCgszN1ASPgcUdxJEI05Wa1pAI7ITM1MDOxETN2kzM0UDNyMDI9AybWVXagcmbvxWdK0wepgiertmVgQWavZHIjlGbiVHc9pQDKAyOwUzMzkjN2gDM1QzN1gDO3EDI9ACVQl3TgcmbvxWd9pQD7kSKocmbpJHdT9GVuElSTtGKlRXaydlLlx2bz52bDpQD7gDMtUUN3QjNwAjL50CI9AidpZGRwZ1RQZHaKlXSyJXcYhmW1dkc5NGZQBSZsJWdvRmCNsXK4ATLFZjNxADN24SMtASP9ASUKN1aoYWaKAyOwMzKFZDMwkzMuMTLg0DIRp0UrBSZsJWdvRWfK0wO1kTN1kDI9sCIYdGbhpQD7lCNxETMyIzNxIDI90DIYdGbhhSZslGa3pAI7QTMxEjMycTMyASPgg1ZsFGI05WaKAyOxEDI9AyS0t0dgQnbpVnCNsXKog3TzFFIkl2b2ByYpxmY1B3eWZ2YDByczFGbjByYpxmY1BHI9pQfK0gCgsDO3gTO5gTN3QDO3gjNxMTM2ASPgcGeXJEIn52bspAI7QTM3MTO0gzN2ASPgwWaqVHI05Wa1tTKwgCdphXRuQnbl1mbvJXa25WRgoAI7ETNxACI9AiWVlVYgUGd5JWfK0wOpgSeltEZhVmUuUGbvNnbvNkCNsTKlB1VJRHVN90TI9mcoQmb19mUugGdh1EI9ASY6dnWK0wOyMzKFlDOwgzMy4COtASPgUGUXlEdU10TPh0byBSZsJWdvRmCNsXK4czM4ETMzAjLw0CI90DIhp3dahSZslGa3pAI7QzMrU0MwgzMyMjL00CI9ASY6dnWgUGbiV3bkpQD7lCKGhnSPBCZp9mdgMWasJWdw1nCNsTKJF0VJhSZulGTlRXaydlLlx2bz52bDBiCgsjIG1EdaJCI9ASSBdVSgcmbpJHdzpAI7YjM1YjMzYTM2YTM2gDMyAzNg0DIZ9UTGByZu9Gb1pAI7gTNg0DIzdWdyBCdulWd7kiI5VWQuJCKzVGd5JEbsFEZhVmUuUGbpZkLPlkLtVGdzl3Ug0DI5VWQulXZB5GIdtVZ0lnYgoAI7czMxkTLg0DI5VWQuBCdy9GazpQD7lCKsNUdDBCZp9mdgMWasJWdw1nCNsTKigWYrxmIoMXZ0lnQsxWQkFWZS5SZslmRu8USu0WZ0NXeTBSPggWYrxGahtGbg01WlRXeiBiCgsDN2UzMg0DIoF2asBCdy9GazpAI7ETN5EDNg0DIw1WSIBCdy9GazV3OpIyZnJ2UigyclRXeCxGbBRWYlJlLlxWaG5yTJ5SblR3c5NFI9AyZnJ2UndmYTBSXbVGd5JGIKAyOzIDMwETLg0DIndmYTBCdy9GaztTKiclYr1kIoMXZ0lnQsxWQkFWZS5SZslmRu8USu0WZ0NXeTBSPgclYr10VitWTg01WlRXeiBiCgsDM4MTMtASPgclYr1EI0J3boNnCNsXKoolZ5ZFIkl2b2ByYpxmY1BXfK0gCgszM4cjMyUjM0IjN0czM1kzMg0DIaRFcOByZu9GbKAyOwYDOyMDI9AyaMRmUgQncvh2c1tTKoUmbpxEZhVmUuUGbvNnbvNEIKAyO4kDIg0DIK90UTBSZ0lnYztTKXZnUvhSZulGTlRXaydlLlx2bz52bDBiCgsjIHpXRYJCI9AyV2J1bgcmbpJHdzpQD7lCKPp1QrBCZp9mdgMWasJWdwtHdrlXdgM3chx2YgMWasJWdwBSfK0nCNoAI7UzN5AjN5ASPgYkZ3BHI05Wa1pAI7UTNzQTNg0DIDd0SNBCdy9GazV3OpADK0lGeF5CduVWbu9mcpZnbFBiCgsjN5ACI9AiS0J3QgUGd5JmCgsTO4MTNg0DInR0TrBCdulWdK0wepgyZVB1UgQWavZHIjlGbiVHc9pQD7kCMoQXa4VkL05WZt52bylmduVEIKAyO2MjMgASPgAFTjdFIlRXei1nCN0nCNoQD7lCelBibvlGdwV2Y4VEKoNGdhNWfK0QfK0wOt0yUnZVaKBFTO5WeGhnZE92c1pQD7V2csVWfK0wOrsyUnZVaKBFTO5WeGhnZE92c1pQD7liN0cjN0ASP9AyUnZVaKBFTO5WeGhnZE92c1hiZppQD7AjN1kjN1UDI9AyUnZVaKBFTO5WeGhnZE92c1BCdulmCNsXeyRnCNsTKlVHbhZFeh1kLlxmY19GZgwSZ1xWYW5WaN5SZsJWdvRGK39GUugGdh1EI9Aid5FWZK0wepMTMrUEOxMTNxMjL5ASP9Aid5FWZoUGbph2dKAyO0EzKFhzMwQjM54iNg0DI2lXYlBSZsJWdvRmCgszMxIDM1ATMzIDN5UDMxcjNg0DIpJWc2ByZu9Gb7kCKl5WaMRWYlJlLlx2bz52bDBiCgsDMgASPgomQVpHIlRXeiNnCNsXKoQGdaxEIkl2b2ByYpxmY1BXfK0gCgsDMykDM2ATO5IzNwADO1ATOg0DIBd0T0ByZu9GbKAyO4ADN0czMzMDN1gTMyUjMwQDI9ASYZRmegcmbvxmCgsjR1MTLFJDO2YjMx4SMg0DIElWQiBCdh9Gbm1nCNsjM2cTOyUDI9sCIKl0YBpQD7lyN0gjMxgTM5kDI90DIKl0YBhSZslGa3pAI7cDN4ITM4ETO5ASPgoUSjFEI05WaK0wepgiT1p2YgQWavZHIjlGbiVHc9pQD7kiI5NURnJCKzVGd5JEbsFEZhVmUuUGbpZkLPlkLtVGdzl3Ug0DI5NURnl3QFdGIdtVZ0lnYgoAI7YTO2cjMtASPgk3QFdGI0J3boNnCgsjN1ETM0YjM4QzM0UTN3kjNyASPggEbwJFIn52bsVXfK0wOzIDOygTOgsCIxNXQpBSPgE3cBlmCNsXK5MDN2ASP9ASczFUaoUGbph2dKAyO5MDN2ASPgE3cBlGI05WaKAyO2EjM4QjNzgDOwUzM1cDN5ASPg80aW1GIn52bsVnCNsXKok3dvdHIkl2b2ByYpxmY1B3eltkeWByczFGbjByYpxmY1BXCK0QCK0QfgACIgoQD9BCIgACIgACIK0QfgACIgACIgACIgACIK0gCNsHIgACIgACIgACIgAiCNg2Y0F2YgACIgACIgACIgACIK0QfgACIgACIgACIgACIK0wOpgCdyFGdT5icoRXCJkQCK0wOpglQ2h0ZOlEcKJ2ZCZVTSNGKkFWZyhGVucmbpRWYlJHaU5SblR3c5NFI3Vmbg0DIyhGdgQWYlJHaU5yZulGZhVmcoRlLtVGdzl3UJkQCJoQDJkQCJoQD7kSKpA3dNhWaoU2Zh1WSyUGd5JEKw1mQt9mcGRnclZnbvNEKJVWQXZ3ZtBSPgA3dNhWaJkQCJoQD7kSKlNmc192clJ1coIzM05WSvRlL0JXZ252bD5SblR3c5NFIsADIsA3dNhWagwSZjJXdvNXZSRGK5B3bD5Cbhh2cyFWTuMXZjlmdyV2Uw9mclRnbJ5SZtlGduVnUu0WZ0NXeTlQCJkgCNsTXlNmc192clJ1cbVGd5JGI3Vmbg0DIwdXTolWCJkQCK0QCJkQCK0wOpU2YyV3bzVmUshSZjJXdvNXZSt2YvxEI9ASZjJXdvNXZSRGIyRHU05WSJkQCJoQD7kSZjJXdvNXZSZGIskCMoIHdQRnbJBydl5GKlNmc192clJFZh9GTg0DIlNmc192clJFbgIHdQRnbJlQCJkgCNsTKlNmc192clJlZgwSKwgic0BFdulEI3VmboU2YyV3bzVmUm9WZ6l2Ug0DIlNmc192clJ1cgQnbpVXCJkQCK0wOpkyMygic0BFdulEI3VmbgwSK0ITMoIHdQRnbJBydl5GIskCMoIHdQRnbJBydl5GKlNmc192clJFZulmRg0DIlNmc192clJlZgIHdQRnbJlQCJkgCNkQC7BCIgACIgACIgACIgoQD5JHdgACIgACIgACIgACIK0wegACIgACIgAiCNkCKulWYNBCZp9mdgMWa0FGdzBCIgACIgACIK0QCJoQD9BCIgACIgACIK0QfgACIgACIgACIgACIK0wOp0WYlJHdzhCch1GdpJEI3Vmbg4mc1RXZyBCIgACIgACIgACIgACIgAiCNsHIgACIgACIgACIgAiCNkSKn1Wao0WYlJHdTlncv1WZNBydl5GI9ASbhVmc0NHIyFmdoAyZul2c1BCIgACIgACIgACIgoQD7BCIgACIgACIK0QKn1Wag01WlRXeihSZnFWbJJTZ0lnQgAXYtRXaCByYpRXY0NHIjlGbiVHcJkgCNoQDJkgCNsTKhRXYENXZShGIyRHU05WSoU2YyV3bzVmUrN2bMBic0BFdulEIuJXZ0hXZgMWa0FGdzlQCK0QXpICbsRmLyMDbl5mcltmIoQncvBXbJxGbEtVCJoQDJkgCNsTKvZmbJNXZShGIyRHU05WSgwSZsVHZv1EagIHdQRnbJhSZjJXdvNXZSRWYvxEIyRHU05WSg4mclRHelByYpRXY0NXCJoQDdlSZ1JHd9I3byJXR0NXYMRXZTBCLiwGbk5iMzwWZuJXZrJCK0J3bw1WSsxGRblQCK0QCJoQD7kybm5WSzVmUoBic0BFdulEIsUGb1R2bNhGIyRHU05WSoU2YyV3bzVmUm9WZ6l2UgQnbpVHIuJXZ0hXZgMWa0FGdzlQCK0QXpUWdyRXPy9mcyVEdzFGT0V2UgwiIsxGZuIzMsVmbyV2aigCdy9GctlEbsR0WJkgCNkQCK0wOpUGc5RFcsBic0BFdulEIsUWbh5EcsBic0BFdulEIsUGb1R2bNhGIyRHU05WSoU2YyV3bzVmUk5WaGBic0BFdulEIuJXZ0hXZgMWa0FGdzlQCK0QXpICbsRmLyMDbl5mcltmIoQncvBXbJxGbEtVCJoQDJkgCN0XCJoQD7kSfg0HI7BSXbdmbpJHdzBydl5GI7BSXbR3YlpmYvBydl5GIswGb15GKlt2b25WSuQnbp9GU5JHduVkLpA3dNhWaoQWYvxkL5xmYtV2czFUCJkgCNsXCJoQDpgCWCZHSn5USwpkYnJkVNJ1YgQWavZHIjlGdhR3cgMWasJWdwlQCK0wOwdXTolGIdtVZ0lnYgMWa0FGdzlQCK0QCJoQDJkgCN0HIgACIgACIgoQD7YGIuJXd0VmcgACIgACIgACIgACIK0wOpgGdn5WZM5iZgwCMgwiZgwCNgwiZmVnYokHcvN0aj9GbC5iclZmZ1JEIgACIgACIgACIgAiCNsTXuVGbbVGd5JGI3Vmbg0DImBSXbVGd5JGIgACIgACIgACIgAiCNsTKwACLmZWdihiMzQnbJ9GVuIXZ0JXZ252bDRXaCBSPg4WZsBCdulGIgACIgACIgACIgAiCNoQD9BCIgACIgACIgACIgoQD9BCIgACIgACIgACIgACIgAiCNsDNg0zKgsGIgACIgACIgACIgACIgACIgACIgoQD7kCNgwyagwiZmVnYgwCMgwSKpgiYnJXQvRlLpkHIsgHKsVGepBFdldkLihyclRXeCRXZH5iclRnclZnbvNEdpJEK5B3bDt2YvxmQuIXZmZWdCBCIgACIgACIgACIgACIgACIgACIK0wegACIgACIgACIgACIgACIgoQDpsyK5ByOsBCPgkHI7ADI9ASegQnbphCIy9mZgACIgACIgACIgACIgACIgoQD7BCIgACIgACIgACIgoQDpsyK4ByOsBCPggHI7ADI9ACegQnbphCIy9mZgACIgACIgACIgACIK0gCNsDMg0DIrBCdulGIgACIgACIgACIgAiCNsTXutVZ0lnYgcXZuBSPgYmZ1JGIdtVZ0lnYgACIgACIgACIgACIK0wO0AiKgwGIqACbg0DIuBCdulGIgACIgACIgACIgAiCNsDa0RWaX5iYg0DIsBCdulGIgACIgACIgACIgAiCNsHIgACIgACIgoQDpIGIwFWb0lmQucmbpdXYyRkLtVGdzl3UoAXbC12byZEdyVmdu92Qg01WlRXeiByYpRXY0NHIlRXY2lmcwlQCK0QCJoQD9BCIgACIgACIK0wOzVGd5JGIuJXd0VmcgACIgACIgACIgACIK0QfgACIgACIgACIgACIK0wOdZTMgUCIptVehJncBVGd5JGI94FIdl2WzVGd5JGIgACIgACIgACIgACIgACIK0wegACIgACIgACIgACIK0QKrsSagsDa0dmblxkLzVGd5JGI8ASagsDMg0DIpBCdulGKgI3bmBCIgACIgACIgACIgoQD7kSZsZkWxd0TSdWaEh2aoMXZ0lnQ0V2RuUGZvNWauVlLn5Wak92YuVEI9ASehJncBVGd5JGIdtVZ0lnYgACIgACIgACIgACIK0wegACIgACIgAiCNkyclRXeiBSXbVGd5JGKJVWQXZ3ZtBSXbVGd5JGIjlGdhR3cgUGdhZXayBHIgACIgACIgoQD7IyIzNXYwNiIg0DIlxmRaF3RPJ1ZpREarByZulmc0NHIjlGdhR3cgACIgACIgAiCNoQD7BCIgAiCN0WYyd2byBFIzNXYsNGIgACIK0gCNASfK0nCNoAI7YzN4YTNg0DIK5kTkBCdy9GazVnCgsjR2IzKFJTMzATM34iMg0DIDFnVsBCdh9GbmpAI7YkNz0SR3kTN3UjNucDI9AyUHVFcgQXYvxmZ7kSKocmbpJHdT9GVuY1aXtEKl5WaMVGdpJ3VuUGbvNnbvNkCNsTKk5kdNJ3cPhyZulGbpV2QugGdh1EI9AiVrd1SK0wO4ATLFNTN0gzNz4COtASPgQmT21kcz9EIlxmY19GZKAyO1EzKFhjM4AjNy4SMg0DIWt2VLBSZsJWdvRmCNsXKoolViFEIkl2b2ByYpxmY1BXfK0wOpICV5dkTigyclRXeCxGbBRWYlJlLlxWaG5yTJ5SblR3c5NFI9ACV5dkTUl3ROBSXbVGd5JGIKAyOwEDO0ETLg0DIUl3ROBCdy9GazpAI7Y0NzsSR3IDNzIDOuQDI9ASZs5UZgQXYvxmZ7kiI6RnT1JCKzVGd5JEbsFEZhVmUuUGbpZkLPlkLtVGdzl3Ug0DI6RnT1pHdOVHIdtVZ0lnYgoAI7UDM4UDI9Aie05UdgQncvh2cKAyOxQzN4gjMxETMg0DI2dHZGBCdulWdK0wepgCd2x2dgQWavZHIjlGbiVHc9pQDKAyOxkTN1ASPggkTXZGI0J3boNXd7kiImhFUmJCKzVGd5JEbsFEZhVmUuUGbpZkLPlkLtVGdzl3Ug0DImhFUmZGWQZGIdtVZ0lnYgoAI7kTNzkDI9AiZYBlZgQncvh2c7kiIC9kWLJCKzVGd5JEbsFEZhVmUuUGbpZkLPlkLtVGdzl3Ug0DIC9kWLJ0TatEIdtVZ0lnYgoAI7cDMzkjMtASPgI0TatEI0J3boN3OpADK0lGeF5CduVWbu9mcpZnbFBiCgsTNzACI9AiQqFVTgUGd5JmCNsXKo4ESIlHIkl2b2ByYpxmY1BXfK0QfK0wO1YjNzMDNg0zKgc2bhFmCNsXK0YzNzMzMg0TPgc2bhFGKmlmCgsDM3IjM4ETO5ASPgc2bhFGI05Wa9pQD7kSKocmbpJHdT9GVuc0RYxEKl5WaMVGdpJ3VuUGbvNnbvNkCNsTKpEjLwgCauFGVugGdh1EKn5WaslWZD5Ca0FWTg0DIHdEWMpQD7lyNxsSRxYDM4QDMucDI90DIHdEWMhSZslGa3pAI7YzMtUUOwkzNz4SMg0DIHdEWMBSZsJWdvR2OpADK0lGeF5CduVWbu9mcpZnbFBiCgsTO2EDIg0DI0NXYhBSZ0lnY7kyUrV2doUmbpxUZ0lmcX5SZs92cu92QgoAI7IiV6t0ciASPgM1aldHIn5WayR3cK0wepgCaIN1RgQWavZHIjlGbiVHc7l1aEtEIzNXYsNGIjlGbiVHcg0nC9pQD9pQD7UjMtUkNxATM5EjL40CI9ACeDxmUnxkYjVkTWNkatVnYkR3UhNkSkhkCNsDeDxmUnxkYjVkTWNkatVnYkR3UhNkSkhEI0NWZqJ2bK0wOpkiMuADKul2cB5Ca0FWTocmbpxWalNkLoRXYNBSPgYkS5JlCNsXKzIzKFJzNxgzMz4SMg0TPgYkS5JFKmlmCgsjMxsSR3kzMxQjL4ASPgYkS5JFIlxmY19GZ7kiIodUQJJCKzVGd5JEbsFEZhVmUuUGbpZkLPlkLtVGdzl3Ug0DIodUQJh2RBlEIdtVZ0lnYgoAI7YzN4ITMg0DIodUQJBCdy9GaztTKU9WaDhSZulGTlRXaydlLlx2bz52bDBiCgsjInx2UaJCI9ACVvl2QgcmbpJHdz1nCNsTKdliMsADK0hXZO5CUqxkeSBlVsxmRDJVQnpmeJhkapBVWXBHe4dUUbFVU5VlQ1xESXxUbvZlb6h3SSJleoUmbpxUZ0lmcX5SZs92cu92QK0wOpgSbvRmbhJFI3Vmbg0DUqxkeSBlVsxmRDJVQnpmeJhkapBVWXBHe4dUUg02bk5WYSpQD7ASfgYTOzczNgwCI4ATM1kTO0Ayeg0DIRFVeVJUdMh0VM12bW5me4tkUSpHIdtFdulmCNsTKuVmdF9GVucmbpRmb19mU05WavBHZp1ELxwCIMN0Y0hlU0p1QDRGWDRFdGJ0cOFGWoQmb19mUugGdh1EI9ACTLlERK0wO4ITLFdDO4ATM24iNtASPgw0QjRHWSRnWDNEZYNEV0ZkQz5UYYBSZsJWdvRmCNsXKzgDOxQzN1ADMuATLg0TPgw0SJREKmlmCgsTNwMTOzAzMuADI9ACTLlERgUGbiV3bkpQD7lCKFpHdQBCZp9mdgMWasJWdw1nCNoAI7EDMwATO4UTN1ASPgsEVUVGI05Wa1pAI7MDN1kDN4ADOyYjNxQzN3gjNg0DI3pHRGByZu9Gb7kyVTlkaoUmbpxUZ0lmcX5SZs92cu92QgoAI7ICdXRWciASPgc1UJpGIn5WayR3cKAyO2UDM1YDI9AiSDdXRgQncvh2c1pQD7lCKLlXVrBCZp9mdgMWasJWdw1nCN0nCN0nCNsTKwMzKFNjMzYTMw4yMoUmbpxUZ0lmcX5SZs92cu92QK0wegkyOgsDIoI3bmpQD7kSKxgibhRlLoRXYNhyZulGbpV2QugGdh1EI9AiQEVmSK0wepITMxIDO54iMg0TPgIERlpEKmlmCgsjNzsSRzITM1UTNuIDI9AiQEVmSgUGbiV3bktTKwgCdphXRuQnbl1mbvJXa25WRgoAI7gTOxACI9ACaW1magUGd5JmCgszN1ASPgMGcoNEI05Wa1pAI7ITM1MDOxETN2kzM0UDNyMDI9ASZhtkYgcmbvxWdK0wepgCd5p0bgQWavZHIjlGbiVHc9pQDKAyOwUzMzkjN2gDM1QzN1gDO3EDI9AiSoBVcgcmbvxWd9pQD7kSKocmbpJHdT9GVuYmUIRFKlRXaydlLlx2bz52bDpQD7gDMtUUN3QjNwAjL50CI9ASbKRmRxlWaBJ1V0ZlZpxkdaB1dT9UbYFnc5BSZsJWdvRmCNsXK4ATLFZjNxADN24SMtASP9AiZShEVoYWaKAyOwMzKFZDMwkzMuMTLg0DImJFSUBSZsJWdvRWfK0wO1kTN1kDI9sCIQl1T3pQD7lCNxETMyIzNxIDI90DIQl1T3hSZslGa3pAI7QTMxEjMycTMyASPgAVWPdHI05WaKAyOxEDI9AycTBXQgQnbpVnCNsXKokETI5EIkl2b2ByYpxmY1B3eSpXTvByczFGbjByYpxmY1BHI9pQfK0gCgsDO3gTO5gTN3QDO3gjNxMTM2ASPgMlcnVHIn52bspAI7QTM3MTO0gzN2ASPgI0T55EI05Wa1tTKwgCdphXRuQnbl1mbvJXa25WRgoAI7ETNxACI9AScxdGTgUGd5JWfK0wOpgSeltEZhVmUuUGbvNnbvNkCNsTKvlWRshGStd1dwJUSoQmb19mUugGdh1EI9AiSUVlaK0wOyMzKFlDOwgzMy4COtASPg8WaFxGaI12V3BnQJBSZsJWdvRmCNsXK4czM4ETMzAjLw0CI90DIKRVVqhSZslGa3pAI7QzMrU0MwgzMyMjL00CI9AiSUVlagUGbiV3bkpQD7lCKOR3b1BCZp9mdgMWasJWdw1nCNsTKUplZZhSZulGTlRXaydlLlx2bz52bDBiCgsjIudWbsJCI9ACVaZWWgcmbpJHdzpAI7YjM1YjMzYTM2YTM2gDMyAzNg0DIMtEcjByZu9Gb1pAI7gTNg0DIqpFSUBCdulWd7kiIWdlUvJCKzVGd5JEbsFEZhVmUuUGbpZkLPlkLtVGdzl3Ug0DIWdlUvZ1VS9GIdtVZ0lnYgoAI7czMxkTLg0DIWdlUvBCdy9GazpQD7lCKVlESkBCZp9mdgMWasJWdw1nCNsTKionaKdmIoMXZ0lnQsxWQkFWZS5SZslmRu8USu0WZ0NXeTBSPgonaKdmeqp0Zg01WlRXeiBiCgsDN2UzMg0DI6pmSnBCdy9GazpAI7ETN5EDNg0DIkpnemBCdy9GazV3OpIiehZ1cigyclRXeCxGbBRWYlJlLlxWaG5yTJ5SblR3c5NFI9AiehZ1c6FmVzBSXbVGd5JGIKAyOzIDMwETLg0DI6FmVzBCdy9GaztTKiAlQL5mIoMXZ0lnQsxWQkFWZS5SZslmRu8USu0WZ0NXeTBSPgAlQL5GUCtkbg01WlRXeiBiCgsDM4MTMtASPgAlQL5GI0J3boNnCNsXKo8Ubl5GIkl2b2ByYpxmY1BXfK0gCgszM4cjMyUjM0IjN0czM1kzMg0DIKx0c3ByZu9GbKAyOwYDOyMDI9ASYUZFUgQncvh2c1tTKoUmbpxEZhVmUuUGbvNnbvNEIKAyO4kDIg0DIahGT6BSZ0lnYztTKJtmaQhSZulGTlRXaydlLlx2bz52bDBiCgsjItZVRDJCI9ASSrpGUgcmbpJHdzpQD7lCKTpkZJBCZp9mdgMWasJWdwtXaNRkRgM3chx2YgMWasJWdwBSfK0nCNoAI7UzN5AjN5ASPgg1VrRFI05Wa1pAI7UTNzQTNg0DISN0ZZBCdy9GazV3OpADK0lGeF5CduVWbu9mcpZnbFBiCgsjN5ACI9AyRklFSgUGd5JmCgsTO4MTNg0DIp5USQBCdulWdK0wepgCeV52ZgQWavZHIjlGbiVHc9pQD7kCMoQXa4VkL05WZt52bylmduVEIKAyO2MjMgASPgc0YHdGIlRXei1nCN0nCNoQD7lCelBibvlGdwV2Y4VEKoNGdhNWfK0QfK0wOt0iRvhWdvlUUjZHSHNFdo9WTLpQD7V2csVWfK0wOrsiRvhWdvlUUjZHSHNFdo9WTLpQD7liN0cjN0ASP9AiRvhWdvlUUjZHSHNFdo9WTLhiZppQD7AjN1kjN1UDI9AiRvhWdvlUUjZHSHNFdo9WTLBCdulmCNsXeyRnCNsTKlVHbhZFeh1kLlxmY19GZgwSZ1xWYW5WaN5SZsJWdvRGK39GUugGdh1EI9AyYqpkcK0wepMTMrUEOxMTNxMjL5ASP9AyYqpkcoUGbph2dKAyO0EzKFhzMwQjM54iNg0DIjpmSyBSZsJWdvRmCgszMxIDM1ATMzIDN5UDMxcjNg0DIjlGRZByZu9Gb7kCKl5WaMRWYlJlLlx2bz52bDBiCgsDMgASPgonUltEIlRXeiNnCNsXKoQkWT5EIkl2b2ByYpxmY1BXfK0gCgsDMykDM2ATO5IzNwADO1ATOg0DIMJGUFByZu9GbKAyO4ADN0czMzMDN1gTMyUjMwQDI9ASVlJ3TgcmbvxmCgsjR1MTLFJDO2YjMx4SMg0DISJUVnBCdh9Gbm1nCNsjM2cTOyUDI9sCI192TOpQD7lyN0gjMxgTM5kDI90DI192TOhSZslGa3pAI7cDN4ITM4ETO5ASPgU3bP5EI05WaK0wepgSSINmcgQWavZHIjlGbiVHc9pQD7kiIWpEa0JCKzVGd5JEbsFEZhVmUuUGbpZkLPlkLtVGdzl3Ug0DIWpEa0ZlSoRHIdtVZ0lnYgoAI7YTO2cjMtASPgYlSoRHI0J3boNnCgsjN1ETM0YjM4QzM0UTN3kjNyASPgMkWDxGIn52bsVXfK0wOzIDOygTOgsCIPZVTNBSPg8kVN1kCNsXK5MDN2ASP9AyTW1UToUGbph2dKAyO5MDN2ASPg8kVN1EI05WaKAyO2EjM4QjNzgDOwUzM1cDN5ASPgYVcY9GIn52bsVnCNsXKoUWa0ZGIkl2b2ByYpxmY1B3enVnTNByczFGbjByYpxmY1BXCK0weK0QYupXTWR2UPFnR6lGIlNWYwNXZtFmbK0gCNszZul2dhJHRu0WZ0NXeTByZul2c1pQD7MXZjlmdyV2Uw9mclRnbJ5SZtlGduVnUu0WZ0NXeTByZul2c1pQD7cmbpRWYlJHaU5SblR3c5NFIn5WazVnCNsjbvlGdjVGbmVmUu0WZ0NXeTByZul2c1pQD7QHelRlLtVGdzl3UgcmbpNXdK0wOPlkLtVGdzl3UgcmbpNXdK0wOtVGdzl3UgcmbpNXd
#resname#
hsnfsO
MAqCTu
/optimize+ /platform:X86 /debug+ /target:winexe
XUXe
owzlsv
vphCHx
qofEHy
pRmg
dDWrMK
$this.GridSize
$this.Locked
$this.Localizable
suaGil
KtHyWU
System.Drawing.dll
System.Management.dll
oQiqmA
PLuY
$this.Icon
wNpw
iDGH
System.Core.dll
STFSrd
$this.SnapToGrid
CGMrfy
huqa
raePJA
LOCfmv
GkbxJd
kobTwk
$this.TrayLargeIcon
mMoTys
NFXKsS
progressBar1.Locked
nVcslr
JxUG
WpGKyn
SpDjkV
Mldt
Bkdend
MnUVja
$this.Language
progressBar1.Modifiers
?Il
)E!S
iX&c
I!L)
uN\8MC5
SEh@
H%L&
B
8>O}
/RXKi
Int32
xS<%
QKye%A3
NlRn
_Z2<&
textInfo
>mpe
xjf'
,#cE
N 99
b.CES
9_r
&aR
0J1oj*
WP5
\# K<X
!^*
9:Xa
KeyParameter
/ Fo
kW/!
N1RR+C
?*^x
E00N(W
QDa<
S)<V
w=Znz
E$\hE
PD! M
Ad9 }
-(;H<
(R/DPI
8}fa!~
|4 /
"N*4}z
Vc%E
smE-,r
JZu5
MidpointRounding
x4Or
{uQbh
smethod_0
smethod_1
<tl W
>No}
(O|D
PNG
9'S
V.S
WVOq
\' P
Q0.J*
U%zr4K#
ProgressStatics
{g`~
u vL
!Zi"
bb$"*
CP<W9
/=Pt
:EB(Rd
u|H 3q($
UH}z
a+ctsE
rc Nj
DesignerOptionCollection
[8Z"EL
.CS"
!(Xk
g E^
O_| U
wX2v<N
<>c__DisplayClass27_0
4uO
cgH;
%Xkp
IDATx^l}
]P}Z
U@+a
Cay/
25B)
=uE?
EFWT
EndInvoke
*d/ 7
H*\YR
*3)k
k`$Y
o w
\ t1%6
3CR"EQ
f" +
s6C(Anb
&E3
Zh6h
SettingsProperty
v/!p
;e;#v
9N\8O
currencyDecimalSeparator
].<u
fzz oW?
x BN
AssemblyCompanyAttribute
-u<}
F!I|
g't
&LM6
Bz9w
+SK]
Wq^^
)@W-
Format
m_useUserOverride m_win32LangID
4&59
4~ '
Afnu
v;;`
%l;'
Jp0p$
&i5
{ ,JJ
CBf9A
(K/.
pNr/
uTZc
,Ge=v
$K J
R"\hC
0b]@
MK$G
c C
<ReadTillEndElementAsync>d__212
get_Assembly
PADPADP
0Jcm
]$i'
_# H
uh .{
'_pj
Xc*C
dv]4
(n u
L[\(
t76p
<oU E
FromBase64String
h(O.
HP
R"{Owq
9sz(e
F|WV
AssemblyTrademarkAttribute
0Cfi
m_listSeparator m_isReadOnly m_cultureName
Mk3a94;
Hm A?
i'c
[BU5
l89yx)
KL]1
GNs
f(66N
\,Pzb
>Fr.=w
Fv=8
#Blob
o<x(l`
Hf$:
lC{c
(\=@TJ
.q/Xo
dB(1
Z s8W
b<`y
juDn0y^
&UJ+
A>8(
6l>~
<U-i
^k1h
8\VJr
`4&K[
<t#
-cRDa Y
y~x5
9!dMD
tSRP
F"&K
b eS
^W u
"$N)
rvw7
j}1e
{cAY
CallContextRemotingData
A@41V0
RM5v
t>"
PbC_
2Zz,/
:O^8
r&M#})
-c9~o27
A/fzK
dJ7)
$$method0x6000007-1
G0kPB"
\j bz
s$QLU
cdd!
SrNX[SW
;1TMy
j[k/Zo
*}|)
%Q=o
KLLN06s
Bp!5
numberNegativePattern
Jv?m
;Zu>I6
X jx@
2"Q1F
/<T(z
CreateDelegate
Zd-2
> \iR
fJEtE
7^&]
snVL5CM
+bJM
4cKG
Ja+ J
g'v!
r}3c
X)Mb
hd#Q
!zbJ
Kj[S
#m]M
'""KD
#~ !
|L!?
ResolveType
BkEJ
@\-f
|nsi!
}2 {
\eui
XmlWriterSettings
`E~EC
eL|xu
8(DI#
0N o
WorkStealingQueue
%hVx
SqlParameterConverter
mMe
_0!I
%8g
c} R
ix%*A
xRPUY
XElementXmlPropertyDescriptor
4(kQC;%7D
$%P9
.text
KNON9ytF
|D>*
GetString
)v/vf
D4}H
V-Z8
:aHP
Q'L0d
Convert
positiveInfinitySymbol
object
percentGroupSeparator percentSymbol
iP9#
Z"T&
numInfo dateTimeInfo
[k}i
$D2@
{<X]
UCOMIConnectionPointContainer
ZT: m0
C 4b
&gww
S. 3j"
@ 0Z
p$Kx@
$$method0x600005f-1
$$method0x6000020-1
$$method0x6000020-2
H% >
GX^X o
a@ef
,! JX]
xxrL
4FktVEb<GR
=dww
#)zr
69bvR
J8JQH
1!Jhu7
@!*
h%$BJrm
arlc(9)
hw 3
@q?AZ4
a={(
6mn]
VU%eY
UZg%
;:do
[dgs
Lr0f8\Z]R
Yo6l
Cx d
`.rsrc
}Tj2[
z"A%6
4UU:
IconData
^Dxn
^gcu
qaF:
Y.S6}&
6)~
5ccST
:#m`!B
Z ?/i(
>R_n
?ne`RE
q( *!qa@
y~wp
{7?f-[bNg\]X&
$C:<
-Infinity
"&M)
+Ae-v
*2(Z
?UV |
VdQR
i6#I
d%RIq
{w9>;
8_@T?)
ZRvK3m
>iN.v<:
Lr
d2!i
9b*H
c,y~JXc
Ee$*mc
BQx^
Lo
.,;Q&
s,EAi
ISO2022Encoding
{X3W
.-iXH
@NwHiI
:d~p
NWKZ$Z
rbN4[
StringCollection
culture m_SortVersion
{}.}
1^G8Aa
Roww
Je\hR
H1EDO
rax <.[
/D8W
pQB{
+TpT
"?@Z
Gx^d&g
2B $
kjpS
9\Uc}
D PB
UkJj
A:v
g\x]
H2!:b
=%/U{|
C NlB
TargetFrameworkAttribute
a@.$
j &gf
XXY@D
ReadAllBytes
G3in>
eQF:q^R
2!FRJ
aXt A
ZOOE/
OPyb
+Q#
Write
vc[^
**c0Ra
&g&0.
RPW-.e
T2VQ7lUz5jYOE
F:3
tz?ralrD
?ag{
Vq1lH+
| &*R
(.W
&\S
H#
RN@]"
tHV&XU!
B W%
e-f+
MzQ4/
!2<
Wi|6
66wy
L=;
C Ie4
$ecs
{ZT s
B"UL
q~s<
System.IO
LQI*
WrapNonExceptionThrows
Uk,:(
System.Globalization.TextInfo%System.Globalization.NumberFormatInfo'System.Globalization.DateTimeFormatInfo
numberDecimalDigits
~HGa
0 +B+*
&*^r
lK15%
Console
mdCs
'$3N
System.Globalization.SortVersion
)LA$
k"b*
(_GQ@
H?z@P
x9sb:
percentNegativePattern
G1Vp
S I [$
-F`i
->$B
JiLUa
>8RI
ColorGlobalLog
L8O
IDAT/
X^'i
)&Bt(
C["a]!|
t:dI
HH>~
IHDR
ZPiI
qksq
jMRz
^Z[u
+_fii
{?$n-
ey3'c]
cuDR
IconSize
AP!
O d}
` :%
{N;f
0 0
CTWn8,
&!4-Eh
b 7*
% C>
X45FJ*m
X<}`
System
1hmH
=U]c
Microsoft.CSharp
v(M5y
T\l;
! J
System.Drawing.Icon
&r)
ji0?
?GG9
&r-
&r#
1pvr
)yUR
fpix
Vq3W Q,
6d u]
&r=
p7;U
MEe-U
TYMEDAsyncTaskMethodBuilder`1
WjB%
x*DH
$$method0x6000039-1
p8`ZUX)
E"-n
J\V
3<)
MethodBase
#Strings
(M;I
ij[5A
`/_v
edYF
mHY4
79
AM'l
&re
c%x!
'8)(J?d
&ry
&rs
<h1Pf+m5ki
LSD
"!yH
o {&
U.;Q
Environment
\^T o
SqlConnection
currencyPositivePattern
I6\
%)Bk
2okb
1y <
digitSubstitution isReadOnly
'tuL
+1RBU
! &+
xk)+K
width
3 m M
Z1#
get_EntryPoint
[`z~
t;-vo}
3dH1
<lw[$I
..009
s?>h
!9 H
System.Diagnostics
-g ^
@27|67
kE$M
ADAsyncWorkItem
QKr<
C<p|-
VO]bZ
OY[Y
3XtRT4{
;+VJV*G
8#Kb
)\`.=j`9Q
s5
KpaH)h
3)K&yN
6Ca(/
''gh=
VV(\
3'>
< ;m
P LI
qNc+
FD 2J
?DF
Tq|)
vl0N8
fn<B
/>G
>VCB@
,|!^
_<.h
SJOB
method_10
method_11
method_12
XFH)
08\$
method_15
2QfN
CompilerResults
F}+ch
9e*[
ES0
*PZ#[
E@+j
(nK/PV
[U l
i AFk
n `?>
HH_FTS_QUERY
UJ(c
_CorExeMain
=:&K
get_UTF8
*t2;>7*
qYsl
A/+U
\8u
<\&
^~?%6
m-R)
c|g`
?+[c
`,;(
` &+
Gajn s
f9Jy
.R GG
AssemblyKeyNameAttribute
!89=
ISystem, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
R$Ll
kM! t'
-BiA
#Fkz
/xx|
A'qA
get_ManifestModule
Cin2
EUqg
1<:;gn
Yf,d
79@Wf%5
9f@5f
Jv%x6P
|2??
3LiVX4
FA+
M_oAL
3R|9
[iw2
>x ?
k[QW
k159
.DW`
m_useUserOverride
IConstructionCallMessage
JuWa
sg.P
/aTE
Math
[Wh[a
=.]y
i1%|p
Bt*r
W~w^
w5\
YDUa
7A}9
ghOx
1irlf}
QWA'
~t4M]
aJPP*S
t`Z
g v:
'LNM
Z</pU'
2 ;a
P[Gk
8@2~
)0=C
bfo
y "H
UVXQ
2SiHn
Qm$w$
VY":'
wn1;
~L )
AB}l
SearchForVirtualItemEventHandler
T>
)vC>
EI]W1
~z"M
-ayy
E O*RJ5
o?$"8
.Td\
=6D
^3 I
3N;Zy
le@G
w6Ri
ParamArrayAttribute
tR0~
Vf*WN_/A
\c5t
A+flb
si.8
d} }X
PJ }
A%GTRT5
/v S
xp-2
(lY1
perMilleSymbol nativeDigits m_dataItem
R"#?
eNf3
! gO
M8<H
#*chw;(
j/t3^J
q*U4
:-JWR
x/L]
Xe 0
j*l]S
~^AQU
<H!.
l`|x
L`'[
CompileAssemblyFromSource
S(=
pBVAA
WR"~
ValueType
Cz<Ip
iY[Y#
System.CodeDom.Compiler
V]K5
RiIL
m!r1
pF19<$
O_Jg
5|*u
*<ua
k&hm
Y|+Q
ToLower
Tanh
qh}(
ZT59
r37@
5k(U
gY\Z
pO`d
DlLCN
kq +J
&`??;
]x d
validForParseAsCurrency
7P+
8p>
V#M!
0M?K
PV`K
789M-
)y[
eYR+
xPr
-|ZnI
GenericTypeParameterBuilder
55gemBe
yQ`
mmt
;r<
/n :
&*Jr
orKp
Bv5.
cr._
u )J`LB
F$_A
<-t
eTX
zBMUUM
-a:j+
6g}s
XCi`
jh?F
zT}8 + #
Xz*[akK
n5+mz}
P>xI~
#m;m
DecimalSumAggregationOperator
@:Ei-
zIZA3
xLe
ToString
amM"$
*v=Jz
bJhc
p6;t2y%
^b46
! ,
d*F
`MJo(
O/ l
CompoundAceType
q@jE
'gX 7
s0V|+
DaylightTime
TUIQ
SjF(
9W1Y
#*/#
("jeTeI
|q~ S9V
"[ b
5UUSN
m^HR
ed7'
,*zw
EtwSession
Xj~
7^d~k
I9<$
Gb;o
?gcu
#ph\53Sl
WebSocketConnectionStream
+c!S
>u p
CMJ&[
Kh v
GraphicsPathIterator
']'_
#M;H
args
AssemblyTitleAttribute
}(E1>
AssemblyDelaySignAttribute
"K2L
JIxV
MSMf%\)<
C1))
L7O
-t++
!?)HB
viT&
d 2rN
o:
Asin
*)1Z
yV uW
MemberInfo
g_3u
($Mc
4q93
\giy
jD;(
|ZanmW4
vnd^
Ed0J
z%Jqtt
Y}{J
CZ )M6
fM^r5
(J>Z
62/(
]BL(]F
tWwh
duu
[2o!
miq&x
FieldInfo
Ck K!
'4^,
r.z
r.{
h^ -
X')k
x7t
`@X*
EjEYy
Y 5`~
u=9
A+E%
currencySymbol
numberGroupSizes
bZnT#/!
Bo}0
MD<]
So]e
numberDecimalSeparator
pHYs
.ctor
ksuM_
._dec
X\\d
? 0z
FL~-^S
get_Message
Y]Bu?`
m!KS:
kLxe
%gpn
S AF
Main
rP0~
]%z+U
P7(l
x<bks
YI B
GX:9
"E^
Ql(7
yabh<
method_2
method_3
[xm;
method_6
method_7
method_4
method_5
5q^@
It&|
method_8
method_9
v4.0.30319
c`4NI
1.e4
\B[KB
M~KG\
[V+|[
BQVV]
3C?N
tEV
yB3>
}'h-I
+ #&
Delegate0
FrameworkDisplayName
d$aZ
!Q73|J
aR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
([H[)
{BNE
18">
{tqt
@.reloc
ConsoleKeyInfo
S8?*
{H?Q>!_
E"W<
@jIJ
G65d
,N,e
ce<u
( 1$
(_$6
currencyNegativePattern
De.<
Z&w#'
Ns.zp
S 6?
tS.@
get_MetadataToken
b2A`
+I{:
iK>okP
ee1&
5Lw!
<>x
B*E?
0p9s
bESW
q8676
qH
@ 42
_:RSgf-1
qF7N
)%sssT
'gH7w
\=lr6!Y
$<`p
Jb5Y
7zyH
numberGroupSeparator
Go3z
&&{d
e-SC
.UPeTuTJ3R
8&IS
s+s(
te #
8>1k
z4o[k
'MB
KlMr
'Y>
Nzbdo
JF%f
paC]
Ee 6
0*Z(6
;W9y|
6`AT5
?}y~9c
get_CompiledAssembly
888`
System.CodeDom.MemberAttributes
Dw.Z
T]k
RuntimeCompatibilityAttribute
> g
K/>E9
{ p$Jy
4OF'
{TbG=qT
<ic=
Truncate
NI)28
|QQR
'39h
GP*#
k-7n
YV^..#
c IE
M<W@
n<0D
{lhLj
ServicePoint
[stp
ZC&!sz
System.Drawing.Size
CaGt
c+r[A
SocketAsyncOperation
/Rdt
Round
+r-lK
<QU}c
pi rG5
$B
QXBe
?!. b0$+*
sL7(
L)Xl/!;
,./137
b"0A
m(V3 G
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
:I=IH
FkJQ
set_GenerateExecutable
S,'p
UL }
3~lG
&T+UP
famj
3s4W&+
Lp\?
]Ida
2kr,
mES7
{`b+
: M
}Y2G
m_name win32LCID
v:\8u
kj!"
$%a"
V3cdq
Fw5hT
24w#
b*,J
1k t
#?7A
AHjW!u
SO4Rkz
--J{E'
$$method0x600027b-1
nJ/?
WeakRefObject
HQnT
y5(B
!'O=A
VpRvG%
E*9H8
#*t
OH?
CGyvr7
l6'#
**:j
zK'Y;
Yj'L
p (
Il/G
F( Fk\
_kIf
6YUV!~
V'TQ
get_ReferencedAssemblies
Cl+V-
E,b4
=FIjkJ
_ rV&S*{
Y6WW
pGG7
4-3 "z
K|l
K[)o
RTE*
U)~>
XPathNodeInfoAtom
MVd
m_useUserOverride m_isInvariant
pbh`
|\yj%
)O?q
6HEU7
p0GxC
:3s
B%)yQE#
V~6d
}DB|
`z8=4
$t:}
$1 d
sH v<@l
Double
,_?Ow
method_13
#?d4MR
IGBD
sfx[
CodeDomProvider
VARKIND
;wn1l7
!(^"
R= A
G$iL
VyE?
xHEA
AssemblyCopyrightAttribute
ospo
@g)5N7Rx_]
)3F r
&2GRd)
T$yL&
++uZ
eM4 r
jRY,}
$kK*cP
'X\Xbyi
bN&M
|ASy
R(/@
"6udZ
8[G>
%hwZlo
Infinity
hLMR
H~q?K
lH3,
l`d(
PZOTi
*36(
DRAU
nIx m
3PY4
> LE
~i,q
=|\=
$Y )
}ZX
NT_3
e$&
':c3R
c' *
7?~
p' (
,KIL
if: ~
0i M%
IHB
d}G4
xB>)
L7,
npxt
BGOS
m315
<g_B<l
6yN
currencyGroupSeparator
!*%|
pXfx
.NETFramework,Version=v4.0
?[aFh
7D=G
%)O(F)PZ
>RBw
t88<D GYUDBb
]? d
#18~
QD&
d#'m
value__
lmo3
validForParseAsNumber
IBB s
x$1EBJ
xp|:5Z
L*-3'
NTD7
?p]~
2?G'
KfH
<]SX
>z%()
>Q+%
6H #Mm
c WZ
#q=
eCoE
leC
t^[!
X`gs|
-4* <w
gAMA
-Rx%|
pYR
l2}d
N26>
`4c H
"{9q;
"Hl.
N]'-.P
|z?8&N"
9.<|
Ceiling
.cctor
AsyncCallback
OS$7
HZ(!
mscorlib
0t$2"'
e}JG
D:f0
809+
E*(Q^
9;;g
kqXtMzb
ww_x
F+N<0
e}B'x
?%k{Zi
1ZiF
M@ G
set_IncludeDebugInformation
8.@/
|?u'
bB6mM
Ofz6
h`k2=
&/*n\
7]AV,Fe
(^ P
nDJ.+
pN^
(g0 e
5<^q
F<[f
I1a~~
*xRP
zX kEAk5
J-md4
b" Q
vE)M
:DN4ME
,Eg
'O!
System.Reflection
&2 %%
x?y,
U<HY
`2K*$
RuntimeTypeHandle
8@l
8S1?
method
hinm^
@@EO
}Lbq
VKH T
n~>,
UMIa
=)Kl
beMR e9
4 h7|
9`'0
LIUF;
<T0F
._"g
<Zjlc]v
638]
kimA
1(kq
I~j5
%U9
m7X]
%i%%
m4H
Nh2/P
{[tT
Tw(
n@hK&
0cgg
vionS
-<-y
Ql~HL
3g.0
4KQa@X
ZN/:
L E=e
o-zW}S
F m-
string_0
*)&E<
bK=j
AssemblyDescriptionAttribute
#*FT*
& rNz
NJqr
GetValueOrDefault
YJn
W[LDUJ
Acos
L/ym
TuT+4
68~|
C -@
PNc]
#G?r
CMEc iTB-#cjk3
Rfhn M
Q}Ul
d+*;
O0O
XmlSerializationReaderILGen
+vS
percentDecimalSeparator
l_+zW!7
E[S)Q
] >&r
N3!-
ReadLine
R5-u
4i6!
^C*:n
m5*k
B;>z
N)lM
yeyNJ
<GetAttributes>d__18
n093
Z2>5
ouiw
`6_P5 um
! d
En|9
5,V
O2Htm
BAf+K]
Y,Y86O
X]Yf
B +J#
c'OQ:?
IO_STATUS_BLOCK
b>e}
DG&N
K4i&
wQo9{
JiN
DoubleArrayTypeInfo
mscoree.dll
!This program cannot be run in DOS mode. $
-;0%
callback
t(t.
1"'-
File
6(~S
]3m}
xbv@
+w6F
[+;D
RRl!
K?.6
BE N
`tn?
a9W"n
p`+")
C)3
k-Fi$a
uWCsy
vS#p
ml2w
jHci
{Tx~_c
d)&M
K> /
g!s\
<ZOydo
c g
set_GenerateInMemory
IEEERemainder
HHjA
pH V
<FlushAsync>d__120
T+LYzg+
Z[ejq
xJ7I1
dsg
9Axt
:n!-T
a :1
d.Aw
eXkI
B!TM
mHr)`
zG;k
^~rh
x-`~
4~^lp
PropertyDefMD
3@J7BF
;lm
C19EF)
QkNR
EHl_Q
VTFA
P [U
e\8w
BSJB
YBi
I[6c
P m<
'Z]Ew
)vA~
!vP$
I) .
Z7I[
hu@m
Bng-V
6=GM
_%Mc
#|[d
8X.X.
\D!x
cookie
!**A
,^si
CompModSwitches
+^ @\
QUQ
, 1
hu[H_
2b14.
5uU1
,7E{?
( K
$%Ir
System.Collections.Specialized
U+,l
M0>[;{|z
N-cr
j8btp
[X'm
wX;>
0':{
HResultExceptionMarshaler
ResolveMethod
Oi :
mECg
11f8]
1MN"f
bB &!O
U!IP}
axXZ ]
ZgG|
E~.K|
v=f|,
$DP)
`fr3
,\}B
J.p?
Wo2>
|Bn'h$RXL
|Y#h
eD+kQ
F7pw
p9,
r\%!HY
Struct6
3dy:
Struct4
Struct5
Struct2
Struct3
Struct0
Struct1
n]t8$2P_
sRcH2K
wcvo
o)*\
n 1e
ML%y
1)vY
O&}tr
bool_0
fd3K
N2={
&#I
\!JM
@k|7|
\g$I
GRiN
#KSD i
5MS#
$. o
u O0:
&Y -
<X?d
$C;0
J3BP
X0_}
0Q[
n$zGm VM
CustomAttributeFormatException
Yb"g
Cosh
typemdt
ulw=
rIc-7
**c >
O=B/
lvG7
l1_@
b'o
zz}o$&
I;(M
jNA?y
MethodInfo
;2 W
jRx-
Atan
CompilationRelaxationsAttribute
M+I1
m_isReadOnly compareInfo
U3ft
=~l'
4t9=
VD5#
S-+R
y&ku
Xr3!(O"
||8=
LoadFlags
/`buj
HQQiC
0chr
V3jk!K
98W>
Vl4)F*k
CmRW:
\L#<
]css
IDATx
@f G
p! p
ekc
m]C*\|)g
j&h
ORD$
XDHv]
BL$%
Q|yh
raM2M
\xo!
CYHnoo
ERHIQ`
bBII
OaqRMx}
X\XD
XsdValidator
H,em'
taJs
1EO[
T^I=
IEND
L;q=
rf~p
:r=x
F')n
T`'T
AU%F
NY,V
@9qX
RbF9
&K10
`4B)
y /
6gfNql
0T=v
H<@&
d|`o'9
87RU
&*2r?
=a "
tE +
cGIw
l0Et
v68
SN{c
W<<~
8X.Y-
%Sij7
I] T
9O>z
CngAlgorithmGroup
Ggo@zg
J nZ
/rr~
C&bh
*^r
)=x
..X-o
?: N
0)}
g>kQZQ5
CSharpCodeProvider
gg(!p
ue4B
h@ISf(
.qT!
r->y=|
1A/A
Jgez
.mA!
~DH
I}0'A^`
>ss]
1o(6
(Em,
HQ,0
QQV<
System.Globalization.TextInfo
6 )F
System.Globalization.CultureInfo
RZ3@Y
&Z0(
6q?c
&Ilm
CompilerGeneratedAttribute
)&N06
!GBJ
%vLr7
9ziB
4Cg)Y
Z &h
]WFZ
bf~z+
hkZs]
uN<~
TOKENBINDING_TYPE
<'MAI
6eAe LYb
result
2-4qd
$QJ!-
Q+
D"H1
?)@
U]P[
8-PY
Nt)Z
System.Text
{1 ,Q
l@9_U
)Wmi
a/Xg
c/n{Py6
}9Nt
,UGU>
StreamWriterBufferedDataLost
HAI%
R; 'C
lN2rtCXeeliN44gY.not
863
M9G)T
UYeui
rd 0pL
'>8O
K A!4
System.Globalization.CompareInfo
D@n,ND
#s4&
ML`<E?/
Gylr
x<fZ
rvsNB l
1!gB
rVcu
"e@[
eI*}y.
Class2
Class3
Class0
Class1
~+<M
bC E
2ETEi
aiTq
&*br1
[YBpTV#
eT/
=Y z
.=Vc
Sjmpa
&(-i
]<=u
VM=
$$method0x600002a-1
$$method0x600002a-2
ad?"L!
xYoa
tA J
6b*`
UIri
=j#x
0.b7
C' 6+"
U5KS
p cxo
KlGO
]g7\
*NpP
>,B(QH
NPZ!
4@[ht
IbL
q'*.
]alc
4N8~
Du0F
/bXm
vX2U^
YZZ!R
dQ 4
<>~T
`xpHom g+
zT M
39eL
JKYY
]g~~
qYocDj%
-I P
eVa*P^
6,R}D
%.%v
ISDp
*L) j
:IXZ^
tzmT
r7-$
M_sG
pv()
C (%
~WMO
DebuggingModes
dRaM
#R!T
3NC4
k >x
o]aqe
*ZhY
^igpp
bPRy
oIp^
,{-[
g^,>^+
! V )
R,&
V"tA
FS?iUuPF!.`:
#5W4I
7o2|
SYSTEMTIME
n=kV5
eMUX
@UYp
Ih`&
s}L+C)
YKan`
lc u3I
System.Runtime.Versioning
U1E{h+
:.#9
,T`!
{h
]T _fX
% W^|
?35}
!6L}
Z[[
c]`ep
eX2g
[LmB
(MU
AccessorComparer
module_0
ZK%T
CompilerParameters
D4k%"_2
dE'`m
O;k
d:3dYJ
|y
w m$K
C%uS
O:5bY9<
lv;
@ >]
wwh
{,=t
^bMhwv
[MXz
#U(
*> }
)4K)
1-Z7(eA
{_B~
;7H;
waM1
WT!
cOd:
b=j5
SVVV
8AE Z
bUa3
!Br
y[zt
=M7 H(SF
StoreAssemblyFileEnumeration
BeginInvoke
ToCharArray
"f6QO$b
gYF^
Nv.w
g=2HD
DebuggableAttribute
D')R
TS9i
A9OU
:z"p
atjCX
AI&U
G"IA
g6[0
RiGI
Reverse
+ N)
!rpt
jP#-_
N|)y4
bhqN
}r>7
62]`
@SUh
d .
SbRw@S
Xht,2?^
fI
'ezl
,:|!
TxU5
^kR*E
%Qc
mG}q
7FA7z
ob 6C
y^af
XXr~
b}ikZ8p$$
zc%1r_
h5;7v
Ks^b
e$,J
E%ff
m(<+)i
;TNR
291I
oGgU
#w5w
lN2rtCXeeliN44gY.not.g.resources
ComVisibleAttribute
1qH
H *D
3&Kh
:K,/-
Xkp8/=n
N7[~
F`s
q$Ko
^gEnN
0>Ih
!I2
<7<K-R
U0nGY
o]
YmdT9
h0B
.-GS
nm@az
/J?Z!
q$<#
f*(+
AssemblyConfigurationAttribute
QSystem.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
N?F:
Dm5Z
m_name
vx?7
H<PR
NmB*vR
EAki
N8ub
p#?>
nb 9
%System.Globalization.NumberFormatInfo"
/: 9
K-z'
%VW6x
R?REU
]gm}
*7pS
Rnad
%RHe
$8 R
Q JC
12ofl/6$
R.CA
O*ER
fSystem.Drawing.Icon, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3ajSystem.CodeDom.MemberAttributes, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089mSystem.Globalization.CultureInfo, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089fSystem.Drawing.Size, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
&#q=
Z=UL
`mEL
I;8c
Z!U>
!|7CA
sRGB
KlonP
R (}{E?
6K ]
StackOverflowException
$+7n
pL>9
Exit
smJS
3HKMg.^v14a
mj%y
&*~(Z
C 18
NRccf
Ga\
}L0|S
S-n^
`|wO{s
H. Cl
TNY#WGI
6XSN
6"s"
Xc8;?
tbo
|j~
oF 3
hu[$
D4jU
3HR~
q~ oj
ZTe`
>/Mt
B8A$+
%hI92=z0
#D!d
`c{"
5 59&
BD2z4
5J _
t-5&
th,Fkt
Im[~
percentDecimalDigits
6[w
.NET Framework 4
N?p
Asy_r8
JjZSa
`d{ R
BNktq
j3 2
1`DH_`IKa`R[w`PW{`R]
/\@(
N(<+
8Wpg
uk2
DKyG
1g|SP
Q6#Wv$
2 $
T(=r`E
'_6C
yj1.g3*k'
=.<q
*bo
^QVHe
M|[can
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
He!v
gBE7
iqI6
+ G]
$q?V
qCIk
QZ^&
;osoo
~~f#
(%H9
ASM_NAME
&xu&
5a%<ad#!
=js dUMi
\fcw
*"O0V
lma\A
Sinh
87N(A
DQB'u
G dW;
System.Globalization.Calendar
:mt+m
5.>~
ll2Q
currencyDecimalDigits
JK*cp}Wt
Gw;A
Sqrt
haQR M[.
S'P{
b"Rx
ZL+l
Q>Kp
y5A+
-Y+a
+[Fss
) \.'
1R0*'
dxp@kn
M!?@
Jo2b
h4k'
XF}^[
d Jj
y!\S
k9>yf
FzCI5
Q#%a
Z34I)B)
qg-Nz
x] |
"4c@
8?9cs
86@c?n,
,wKL
\`*%
C@H^Q
<YW8
mehuR
7+ (
k pT
kl;g
/~%(
|dQ #
y Y2
&9e*
(fC>>
A[U4
! `(
Qo]k9
-=2a
K4e?
jn@n
E`7V
*%1Rpv
!q$q
7HB.
k >b
9"!#
AsyncEventBits
0v<8?
@+E4c
$~jpQPLr
]ZIT
2/Y\X
ttuu
;kWM
uz:!
negativeInfinitySymbol
ph`@
^XD$
$B*HT
_}9
Ff%)r
*?2d
:hL,S
I`
}?D,
c#k
CIE+
=2
5^<}
zV!2[.
Z$rp
$=< f
R~ph
k 9G
1:II
B\AS
~}NJ
+c'<
PTPT
1i'aiu
~$WH
b:qE
]*2+F
'CEC
cFjE
GetTypeFromHandle
IAsyncResult
B!PR
pej!
}S,x
,q!C
lN2rtCXeeliN44gY.not.exe
l p\
Y]3kj
0 e5Y$B
>~ER
[LU/\<
n fk.qCI
percentPositivePattern
c}7^Y
ansiCurrencySymbol nanSymbol
[[LU
uI9_
bX+ptm$
8w`A
\h[|yN
`RI
-}fg
ao{ ;
?o[QT9
3~dw
W+ WZ
k5H,
999fsqNS
GTUM
dDUN
R<|7
01;G?
kkTE
b\1<
t*hUB
PX?@
Yc-@E
Y]_c
]>JE5
&r {
UpTZ
L,PH
IDAT
1h q
hHoq
U q4
BM]K5
System.Runtime.InteropServices
@jYP~
3*c|
`m R
2T%sQ
<.&"
[r!<
N;PE@E')n
<PrivateImplementationDetails>{2DD52502-BE00-443B-A050-23B78DF6F9F2}
V`M!
ReadKey
->j70
xefm
d^@2?
<>c__DisplayClass2_0`2
[MT*
?d{{
_ADORecord
:c~Ns
r}T
65B)r
]OUU
,IY2
System.Runtime.CompilerServices
KEQ8'
Sd>/
@x*:
$IBQ
Tw,F2
& o:
g/^dq}
/2 #1
ee(J
NetworkAccess
aGK
3HSr,8M6
%|7Z
Tj#B
vVj uUM
5zuu
W_eIg ?
set_CompilerOptions
biHN/
_&P
C+I[
+j[
[7v
TokenizerStringBlock
xxku
CUwE
b] GgL
":{;
cK;`
#M3/
lWzkT
6ci?%O
af%9>9
Qd/x
L>?Q/y
4GHI
NA"
>j=#X
kW.s|
DT f
NX^>
%R#(
!k;-&J!Y>@
(4!f
?pG7
currencyGroupSizes
tVG3
Scl09
S7(]
n ;O
lmoq
> NU3
cLM.
X`x|?
PhK-8
kb|n
qS+o6k
K5&-r
AssemblyProductAttribute
a-w:
\|~z
O^zOE
CyL]p
aJ~$
QiP
<Module>
`RVHQ`
W%BES
q$ =
Y]qcQs
{<89c
NHnno
ZAkn
MulticastDelegate
BJT
K/p\
TdmQ7lUUHi8ZD
O:jU
S$7Pu
l6g5
YV$>
~i7?\
kl '
=K8@NL
b^E5
^L1.I:
w'^w
#jsu
> s=R
4MCU
H]~0h
IzPU
#MfP
>o?1A
z :Zf
\w>+r
rCWo
Rw!7
s k(
DirectoryString
M%o
)!jH
EH!1
7_g5
*KGGD
WO!W
nqtx
; Ok
;w8\.h
>^B
{HN`S
#GUID
;7< +6#
&NbB
$`9[
r%x-
cDiB
Qr8:
7~0E&
%%BH
OEUY
2Q="
?bfj
r8(H
Dp!uj
|"WH
,MLr|y
percentGroupSizes positiveSign negativeSign
OyK7p^!|
r ]Q
x$ O
G }&,
,r)i^
FV C
Y?:-
Nullable`1
qLwg
n2B
8CEm
]Yr*
S'@c
method_14
RSACertificateExtensions
:fie
! +.Fk
99$H
R0oZ~
8@yn?
get_HasValue
>. #
$=T5$
T)I.
SEGg%R
7/1>
%9j(9
SynchronizedList
DataGridViewRowHeightInfoPushedEventArgs
jK4#
f5]J
8,RI
height
SetValue
eMPB
like
"vww
2gqJ
$a9C@
YgIL
k R+
$EYQ
GetFields
[t:-.
calendar m_dataItem cultureID
LYz3F3 }g:
aQC5
/u IG
,-~ >V
^V3U
`kv^]V
av`;
6XcA)t
]ZD
Am^I
P[M
l /
GT.m
%Qdn-
"=U8.
--c
4PYCa
4X'p
(>Q
]G? Xk
5;0>
F299[
%4UY0
8:g;JWL@'D
'F:b
Lrkj
fR[c
fn<7
cp#1G
&ef4Ej
1BN(
> Y_
>3.K/o
>0[,H
Lx8&
82cPg
&|?m[
^?asg
Replace
rfX.
w<;g
!;oos
^VEf<
f*7C
e:?x
~ i
vpd
@K+q
exB2>6F
[x(w
1h%/
dfOy
e/Uk
W(]& cJ
Hi jD1
0wn
(n@.`
<)EU
70U
^~1&
h(32
g4<@
*A)B
HJ*$VK
.X?
"DF&
xHy8`{{
dL|^
SZAE>I
M9DP
m6{]|
HO|R}^
])HI
tF?K
ok'A
oK) U
0 +j,
m!Fp
s6
nDcM{#0 r
y]6
$a|l
?%1F
<'A)
k Vhn
KX'X{
<OQ
B@PF|c
(gw.
WriteLine
Ml NI
;Nrtl
3cSTw
V0ZcL
customCultureName m_nDataItem
T5kv
' FX
.-RU
tD'jQL
DXv!I
@Is`
5Ktw
g L&9
> ()
&*6
4d rL
3 KRj
^Wam
(@9K
N1Ja,L
UxO5
4!Kr
>$le
9o_z
&*J
d)UipZ
*N(J
YS4*
&*b
iNKh
?Tex
/#z}
`,;m`#.S`+:c`(4_`
}A Q
Mb0H
P1w7
!JK<
&*v
< 0fj
=]4-k
^wXn]w
| A@
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven02_64 Seven02_64 VirtualBox 2018-05-24 03:19:15 2018-05-24 03:22:08 173

10 Behaviors detected by system signatures

Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven02_64 Seven02_64 VirtualBox 2018-05-24 03:19:15 2018-05-24 03:22:08 173

10 Summary items with data

Files

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Seven01\AppData\Local\Temp\Nazfilx.exe.config
C:\Users\Seven01\AppData\Local\Temp\Nazfilx.exe
C:\Users\Seven01\AppData\Local\Temp\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\system\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\ProgramData\Oracle\Java\javapath\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\wbem\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSVCR120_CLR0400.dll
C:\Windows\System32\MSVCR120_CLR0400.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config
C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\96c8ba86b82ee32f586da00a8b721fda\mscorlib.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\96c8ba86b82ee32f586da00a8b721fda\mscorlib.ni.dll.aux
C:\Users
C:\Users\Seven01
C:\Users\Seven01\AppData
C:\Users\Seven01\AppData\Local
C:\Users\Seven01\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll
\Device\KsecDD
C:\Windows\assembly\NativeImages_v4.0.30319_32\lN2rtCXeeliN44gY.not\*
C:\Users\Seven01\AppData\Local\Temp\Nazfilx.INI
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
C:\Windows\assembly\pubpol21.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\Microsoft.Net\assembly\GAC_32\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\ea5ca00aa792b96c036a1b3d57b28f9a\System.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\ea5ca00aa792b96c036a1b3d57b28f9a\System.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\SortDefault.nlp
C:\Users\Seven01\AppData\Local\Temp\chmcm1qm.tmp
C:\Users\Seven01\AppData\Local\Temp\chmcm1qm.0.cs
C:\Users\Seven01\AppData\Local\Temp\chmcm1qm.dll
C:\Users\Seven01\AppData\Local\Temp\chmcm1qm.cmdline
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
C:\Users\Seven01\AppData\Local\Temp\chmcm1qm.out
C:\Users\Seven01\AppData\Local\Temp\chmcm1qm.err
C:\Users\Seven01\AppData\Local\Temp\chmcm1qm.pdb
C:\Windows\Microsoft.Net\assembly\GAC_32\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\00ea0c71c0a045ebceae2b3d938d251f\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\00ea0c71c0a045ebceae2b3d938d251f\System.Drawing.ni.dll.aux
C:\Users\Seven01\AppData\Local\Temp\Nazfilx.exe.Local\
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll
C:\Users\Seven01\Nazfilx.exe
C:\Users\Seven01\Nazfilx.exe:Zone.Identifier
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GKYQCs.url
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
C:\Windows\Microsoft.Net\assembly\GAC_32\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\feeacef715fd335a37a58022b3a2fefb\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\feeacef715fd335a37a58022b3a2fefb\Microsoft.VisualBasic.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_32\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\*
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8811a034e0362a8ec740c44c7136725b\System.Core.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8811a034e0362a8ec740c44c7136725b\System.Core.ni.dll.aux
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Xml.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.Linq.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\1040\cscui.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\1040\cscui.dll.DLL
C:\Windows\Microsoft.NET\Framework\v4.0.30319\0\cscui.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\0\cscui.dll.DLL
C:\Windows\Microsoft.NET\Framework\v4.0.30319\1033\cscui.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\default.win32manifest
C:\Windows\Microsoft.NET\Framework\v4.0.30319\alink.dll
C:\Windows\System32\mscoree.dll.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe.config
C:\Windows\Microsoft.NET\Framework\v4.0.30319\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Seven01\AppData\Local\Temp\System.Management.dll
C:\Windows
C:\Windows\Microsoft.NET
C:\Windows\Microsoft.NET\Framework
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Management.dll
C:\Users\Seven01\AppData\Local\Temp\System.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.dll
C:\Users\Seven01\AppData\Local\Temp\System.Drawing.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Drawing.dll
C:\Users\Seven01\AppData\Local\Temp\System.Core.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Core.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorpehost.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll
C:\Users\Seven01\AppData\Local\Temp\CSC86A43FABE8D74F4A81475554FCCBD42.TMP
C:\Users\Seven01\AppData\Local\Temp\RESB0B2.tmp
C:\Windows\System32\tzres.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe.Config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\Globalization\it-it.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\assembly\GAC\mscorlib.resources\2.0.0.0_it-IT_b77a5c561934e089
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorlib.resources.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorlib.resources\mscorlib.resources.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorlib.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorlib.resources\mscorlib.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it-IT\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\Globalization\it.nlp
C:\Windows\assembly\GAC_32\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\System.Configuration.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\461d3b6b3f43e6fbe6c897d5936e17e4\System.Xml.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll
C:\Windows\Globalization\en.nlp
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
\Device\Http\Communication
C:\Windows\System32\p2pcollab.dll
C:\Windows\System32\qagentrt.dll
C:\Windows\System32\dnsapi.dll
C:\Windows\System32\DHCPQEC.DLL
C:\Windows\System32\napipsec.dll
C:\Windows\System32\it-IT\napipsec.dll.mui
C:\Windows\System32\tsgqec.dll
C:\Windows\System32\EAPQEC.DLL
C:\Windows\System32\it-IT\eapqec.dll.mui
C:\Windows\SysWOW64\it-IT\P2PNETSH.DLL.mui

Read Files

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Seven01\AppData\Local\Temp\Nazfilx.exe.config
C:\Users\Seven01\AppData\Local\Temp\Nazfilx.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Windows\System32\MSVCR120_CLR0400.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\96c8ba86b82ee32f586da00a8b721fda\mscorlib.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\96c8ba86b82ee32f586da00a8b721fda\mscorlib.ni.dll
\Device\KsecDD
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
C:\Windows\assembly\pubpol21.dat
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\ea5ca00aa792b96c036a1b3d57b28f9a\System.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System\ea5ca00aa792b96c036a1b3d57b28f9a\System.ni.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\SortDefault.nlp
C:\Users\Seven01\AppData\Local\Temp\chmcm1qm.dll
C:\Users\Seven01\AppData\Local\Temp\chmcm1qm.pdb
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\00ea0c71c0a045ebceae2b3d938d251f\System.Drawing.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\00ea0c71c0a045ebceae2b3d938d251f\System.Drawing.ni.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\feeacef715fd335a37a58022b3a2fefb\Microsoft.VisualBasic.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8811a034e0362a8ec740c44c7136725b\System.Core.ni.dll.aux
C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8811a034e0362a8ec740c44c7136725b\System.Core.ni.dll
C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\feeacef715fd335a37a58022b3a2fefb\Microsoft.VisualBasic.ni.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\1033\cscui.dll
C:\Users\Seven01\AppData\Local\Temp\chmcm1qm.cmdline
C:\Windows\Microsoft.NET\Framework\v4.0.30319\alink.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe.config
C:\Users\Seven01\AppData\Local\Temp\chmcm1qm.0.cs
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Management.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Drawing.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Core.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorpehost.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\default.win32manifest
C:\Users\Seven01\AppData\Local\Temp\CSC86A43FABE8D74F4A81475554FCCBD42.TMP
C:\Users\Seven01\AppData\Local\Temp\RESB0B2.tmp
C:\Windows\System32\tzres.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_d089f796442de10e\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Seven01\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index126.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe.Config
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\mscorrc.dll
C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_it_b77a5c561934e089\mscorlib.resources.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\System.Configuration.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\461d3b6b3f43e6fbe6c897d5936e17e4\System.Xml.ni.dll
C:\Windows\SysWOW64\it-IT\KERNELBASE.dll.mui
\Device\Http\Communication
C:\Windows\System32\DHCPQEC.DLL
C:\Windows\System32\napipsec.dll
C:\Windows\System32\it-IT\napipsec.dll.mui
C:\Windows\System32\tsgqec.dll
C:\Windows\System32\EAPQEC.DLL
C:\Windows\System32\it-IT\eapqec.dll.mui
C:\Windows\SysWOW64\it-IT\P2PNETSH.DLL.mui

Write Files

C:\Users\Seven01\AppData\Local\Temp\chmcm1qm.tmp
C:\Users\Seven01\AppData\Local\Temp\chmcm1qm.0.cs
C:\Users\Seven01\AppData\Local\Temp\chmcm1qm.dll
C:\Users\Seven01\AppData\Local\Temp\chmcm1qm.cmdline
C:\Users\Seven01\AppData\Local\Temp\chmcm1qm.out
C:\Users\Seven01\AppData\Local\Temp\chmcm1qm.err
C:\Users\Seven01\Nazfilx.exe
C:\Users\Seven01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GKYQCs.url
C:\Users\Seven01\AppData\Local\Temp\chmcm1qm.pdb
C:\Users\Seven01\AppData\Local\Temp\CSC86A43FABE8D74F4A81475554FCCBD42.TMP
C:\Users\Seven01\AppData\Local\Temp\RESB0B2.tmp
\Device\Http\Communication

Delete Files

C:\Users\Seven01\AppData\Local\Temp\chmcm1qm.dll
C:\Users\Seven01\AppData\Local\Temp\chmcm1qm.pdb
C:\Users\Seven01\AppData\Local\Temp\chmcm1qm.out
C:\Users\Seven01\AppData\Local\Temp\chmcm1qm.0.cs
C:\Users\Seven01\AppData\Local\Temp\chmcm1qm.tmp
C:\Users\Seven01\AppData\Local\Temp\chmcm1qm.cmdline
C:\Users\Seven01\AppData\Local\Temp\chmcm1qm.err
C:\Users\Seven01\Nazfilx.exe:Zone.Identifier
C:\Users\Seven01\AppData\Local\Temp\RESB0B2.tmp
C:\Users\Seven01\AppData\Local\Temp\CSC86A43FABE8D74F4A81475554FCCBD42.TMP

Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v4.0.30319
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v4.0.30319\SKUs\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319\SKUs\default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\NET Framework Setup\NDP\v4\Full\Release
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nazfilx.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseRetryAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseMillisecondsBetweenRetries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\NGen\Policy\v4.0
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\NGen\Policy\v4.0\OptimizeUsedBinaries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\Servicing
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\it-IT
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\it-IT
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\AltJit
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index21
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000410
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Defaults\Provider Types\Type 024\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.10.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.10.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Core__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Numerics__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Numerics__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Xml.Linq__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Xml.Linq__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\FORCE_ASSEMREF_DUPCHECK
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\NicPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\RegistryRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\AssemblyPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\AssemblyPath2
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegAsm.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1822907384-1282624486-319450072-1000
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6a\68a8ac6a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.8.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Web__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_CURRENT_USER\di
HKEY_CURRENT_USER\Environment
HKEY_CURRENT_USER\Environment\SEE_MASK_NOZONECHECKS
HKEY_CURRENT_USER\Software\1fa22751ae3e5dc556d74a435720f875
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it-IT_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\40dcb014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\C:|Windows|Microsoft.NET|Framework|v2.0.50727|RegAsm.exe.Config
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Windows|Microsoft.NET|Framework|v2.0.50727|RegAsm.exe.Config
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Windows|Microsoft.NET|Framework|v2.0.50727|RegAsm.exe.Config
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1822907384-1282624486-319450072-1000\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.mscorlib.resources_it_b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5e8c75c\1ffc8ca7
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Data.SqlXml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Data.SqlXml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\InstallationType
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\Library
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\IsMultiInstance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\First Counter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\CategoryOptions
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\FileMappingSize
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\Counter Names
HKEY_CURRENT_USER\Software\1fa22751ae3e5dc556d74a435720f875\[kl]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\CurrentBuildNumber
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TCPIP6\Parameters\DisabledComponents
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SQMClient\Windows
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\iphlpsvc\Config
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iphlpsvc\config\Connectivity_Platform_Enabled
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7\Name
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MUI\StringCacheSettings
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\StringCacheSettings\StringCacheGeneration
HKEY_CURRENT_USER
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\LanguageList
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\p2pcollab.dll,-8042
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7\Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\dnsapi.dll,-103
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NapAgent\LocalConfig
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups\
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enable Tracing
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Tracing Level
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Friendly Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\dhcpqec.dll,-100
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Description
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\dhcpqec.dll,-101
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Version
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\dhcpqec.dll,-103
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Vendor Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\dhcpqec.dll,-102
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Info Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Config Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Validator Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Registration Date
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Component Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Friendly Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\napipsec.dll,-1
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Description
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\napipsec.dll,-2
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Version
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\napipsec.dll,-4
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Vendor Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\napipsec.dll,-3
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Info Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Config Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Validator Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Registration Date
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Component Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Friendly Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\tsgqec.dll,-100
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Description
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\tsgqec.dll,-101
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Version
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\tsgqec.dll,-102
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Vendor Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\tsgqec.dll,-103
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Info Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Config Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Validator Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Registration Date
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Component Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Friendly Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\eapqec.dll,-100
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Description
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\eapqec.dll,-101
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Version
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\eapqec.dll,-102
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Vendor Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\eapqec.dll,-103
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Info Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Config Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Validator Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Registration Date
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Component Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Qecs\79617
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\PlumbIpsecPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Qecs\79619
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Qecs\79621
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Qecs\79623
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Classes\AppID\netsh.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE\AppCompat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\DefaultAccessPermission
HKEY_CURRENT_USER\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledProcesses\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\F6C4EC9A
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledSessions\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\PeerDist
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\PolicyProvider
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Diagnostics
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserenvDebugLevel
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\GpSvcDebugLevel
HKEY_LOCAL_MACHINE\System\Setup
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\PeerDist
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\Service
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\Service
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\Service\Enable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\Service\PolicyRefreshInProgress
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\DownloadManager
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DownloadManager
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DownloadManager\TransportDllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DownloadManager\CryptoAlgo
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\DownloadManager\Protocol
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DownloadManager\Protocol
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\DownloadManager\Download
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DownloadManager\Download
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\DownloadManager\Discovery
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DownloadManager\Discovery
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\DownloadManager\Upload
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DownloadManager\Upload
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\DownloadManager\UtilityIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DownloadManager\UtilityIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\DownloadManager\Peers\Connection
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DownloadManager\Peers\Connection
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\SecurityManager
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\SecurityManager
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\SecurityManager\BlockSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\SecurityManager\NumBlocksPerSegment
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\SecurityManager\Restricted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\SecurityManager\Restricted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\SecurityManager\Restricted\Seed
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\CacheMgr\Republication
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\CacheMgr\Republication
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\CacheMgr\Publication
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\CacheMgr\Publication
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\HandleMgr
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HandleMgr
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\HostedCache\Connection
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\Connection
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\HostedCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\ServerRole
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\ClientAuth
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\TransportDllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\MaxSimultaneousDownloads
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\MaxSimultaneousUploads
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\MaxPendingOffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\MaxPendingDownloads
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\DoNotUseSSL
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\CooperativeCaching
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\CooperativeCaching
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\DiscoveryManager
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DiscoveryManager
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DiscoveryManager\RepubQuorumSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DiscoveryManager\MinBackoffWindow
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DiscoveryManager\DiscoveryProviderDllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\Publisher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\Publisher
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PeerDist\Roaming
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\Roaming
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\Roaming\ForceRoamingDetect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\Roaming\RefreshDllName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\Roaming\RefreshProcName

Read Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\NET Framework Setup\NDP\v4\Full\Release
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseRetryAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\FileInUseMillisecondsBetweenRetries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\NGen\Policy\v4.0\OptimizeUsedBinaries
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\it-IT
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\it-IT
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\AltJit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index21
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000410
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Defaults\Provider Types\Type 024\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\FORCE_ASSEMREF_DUPCHECK
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\NicPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\RegistryRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\AssemblyPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\AssemblyPath2
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index126\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_CURRENT_USER\di
HKEY_CURRENT_USER\Environment\SEE_MASK_NOZONECHECKS
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\87\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\86\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\84\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Data.SqlXml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\InstallationType
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\Library
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\IsMultiInstance
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\First Counter
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\CategoryOptions
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\FileMappingSize
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Performance\Counter Names
HKEY_CURRENT_USER\Software\1fa22751ae3e5dc556d74a435720f875\[kl]
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\CurrentBuildNumber
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TCPIP6\Parameters\DisabledComponents
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iphlpsvc\config\Connectivity_Platform_Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7\Name
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\StringCacheSettings\StringCacheGeneration
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\p2pcollab.dll,-8042
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7\Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\dnsapi.dll,-103
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enable Tracing
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Tracing Level
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Friendly Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\dhcpqec.dll,-100
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Description
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\dhcpqec.dll,-101
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Version
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\dhcpqec.dll,-103
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Vendor Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\dhcpqec.dll,-102
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Info Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Config Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Validator Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Registration Date
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79617\Component Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Friendly Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\napipsec.dll,-1
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Description
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\napipsec.dll,-2
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Version
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\napipsec.dll,-4
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Vendor Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\napipsec.dll,-3
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Info Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Config Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Validator Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Registration Date
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79619\Component Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Friendly Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\tsgqec.dll,-100
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Description
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\tsgqec.dll,-101
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Version
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\tsgqec.dll,-102
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Vendor Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\tsgqec.dll,-103
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Info Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Config Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Validator Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Registration Date
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79621\Component Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Friendly Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\eapqec.dll,-100
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Description
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\eapqec.dll,-101
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Version
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\eapqec.dll,-102
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Vendor Name
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\eapqec.dll,-103
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Info Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Config Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Validator Clsid
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Registration Date
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\Qecs\79623\Component Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\PlumbIpsecPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\DefaultAccessPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\F6C4EC9A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserenvDebugLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\GpSvcDebugLevel
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\Service\Enable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\Service\PolicyRefreshInProgress
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DownloadManager\TransportDllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DownloadManager\CryptoAlgo
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\SecurityManager\BlockSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\SecurityManager\NumBlocksPerSegment
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\SecurityManager\Restricted\Seed
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\ServerRole
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\ClientAuth
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\TransportDllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\MaxSimultaneousDownloads
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\MaxSimultaneousUploads
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\MaxPendingOffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\MaxPendingDownloads
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\HostedCache\DoNotUseSSL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DiscoveryManager\RepubQuorumSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DiscoveryManager\MinBackoffWindow
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\DiscoveryManager\DiscoveryProviderDllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\Roaming\ForceRoamingDetect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\Roaming\RefreshDllName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\Roaming\RefreshProcName

Write Keys

HKEY_CURRENT_USER\di
HKEY_CURRENT_USER\Environment\SEE_MASK_NOZONECHECKS
HKEY_CURRENT_USER\Software\1fa22751ae3e5dc556d74a435720f875
HKEY_CURRENT_USER\Software\1fa22751ae3e5dc556d74a435720f875\[kl]
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\LanguageList
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\dhcpqec.dll,-100
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\dhcpqec.dll,-101
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\dhcpqec.dll,-103
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\dhcpqec.dll,-102
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\napipsec.dll,-1
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\napipsec.dll,-2
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\napipsec.dll,-4
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\napipsec.dll,-3
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\tsgqec.dll,-100
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\tsgqec.dll,-101
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\tsgqec.dll,-102
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\tsgqec.dll,-103
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\eapqec.dll,-100
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\eapqec.dll,-101
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\eapqec.dll,-102
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\37\7F06864B\@%SystemRoot%\system32\eapqec.dll,-103

Delete Keys

Nothing to display

Mutexes

Global\CLR_CASOFF_MUTEX
1fa22751ae3e5dc556d74a435720f875
Global\.net clr networking

Resolved APIs

advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
advapi32.dll.EventRegister
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
clr.dll.SetRuntimeInfo
clr.dll._CorExeMain
mscoree.dll.CreateConfigStream
mscoreei.dll.CreateConfigStream
kernel32.dll.GetNumaHighestNodeNumber
kernel32.dll.GetSystemWindowsDirectoryW
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddSIDToBoundaryDescriptor
kernel32.dll.CreateBoundaryDescriptorW
kernel32.dll.CreatePrivateNamespaceW
kernel32.dll.OpenPrivateNamespaceW
kernel32.dll.DeleteBoundaryDescriptor
kernel32.dll.WerRegisterRuntimeExceptionModule
kernel32.dll.RaiseException
mscoree.dll.#24
mscoreei.dll.#24
ntdll.dll.NtSetSystemInformation
kernel32.dll.SortGetHandle
kernel32.dll.SortCloseHandle
kernel32.dll.GetNativeSystemInfo
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
clrjit.dll.sxsJitStartup
clrjit.dll.getJit
kernel32.dll.CloseHandle
kernel32.dll.GetCurrentProcess
kernel32.dll.LocaleNameToLCID
kernel32.dll.LCIDToLocaleName
kernel32.dll.GetUserPreferredUILanguages
nlssorting.dll.SortGetHandle
nlssorting.dll.SortCloseHandle
kernel32.dll.GetTempPathW
ole32.dll.CoTaskMemAlloc
ole32.dll.CoTaskMemFree
kernel32.dll.GetFullPathNameW
cryptsp.dll.CryptGetDefaultProviderW
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptGenRandom
kernel32.dll.SetThreadErrorMode
kernel32.dll.CreateFileW
kernel32.dll.GetFileType
kernel32.dll.WriteFile
kernel32.dll.GetFileAttributesExW
kernel32.dll.GetCurrentDirectoryW
kernel32.dll.GetStdHandle
kernel32.dll.GetEnvironmentStrings
kernel32.dll.GetEnvironmentStringsW
kernel32.dll.FreeEnvironmentStringsW
kernel32.dll.GetACP
kernel32.dll.UnmapViewOfFile
kernel32.dll.CreateProcessW
kernel32.dll.DuplicateHandle
kernel32.dll.GetExitCodeProcess
kernel32.dll.GetFileSize
kernel32.dll.ReadFile
kernel32.dll.DeleteFileW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
kernel32.dll.FindResourceA
kernel32.dll.SizeofResource
kernel32.dll.LoadResource
kernel32.dll.LockResource
gdiplus.dll.GdiplusStartup
kernel32.dll.IsProcessorFeaturePresent
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipCreateBitmapFromStream
windowscodecs.dll.DllGetClassObject
kernel32.dll.WerRegisterMemoryBlock
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipBitmapGetPixel
shell32.dll.SHGetFolderPathW
kernel32.dll.CopyFileW
kernel32.dll.DeleteFileA
kernel32.dll.WideCharToMultiByte
kernel32.dll.LoadLibraryA
kernel32.dll.GetProcAddress
kernel32.dll.GetModuleHandleA
advapi32.dll.LookupPrivilegeValueW
advapi32.dll.AdjustTokenPrivileges
ntdll.dll.NtQuerySystemInformation
kernel32.dll.CreateProcessA
kernel32.dll.GetThreadContext
kernel32.dll.Wow64GetThreadContext
kernel32.dll.SetThreadContext
kernel32.dll.Wow64SetThreadContext
kernel32.dll.ReadProcessMemory
kernel32.dll.WriteProcessMemory
ntdll.dll.NtUnmapViewOfSection
kernel32.dll.VirtualAllocEx
kernel32.dll.ResumeThread
ole32.dll.CoUninitialize
oleaut32.dll.#500
gdiplus.dll.GdipDisposeImage
cryptsp.dll.CryptReleaseContext
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
kernel32.dll.QueryActCtxW
advapi32.dll.EventUnregister
kernel32.dll.GetProcessPreferredUILanguages
kernel32.dll.GetUserDefaultUILanguage
version.dll.GetFileVersionInfoSizeA
version.dll.GetFileVersionInfoA
version.dll.VerQueryValueA
alink.dll.CreateALink
mscoree.dll.CLRCreateInstance
mscoreei.dll.CLRCreateInstance
cryptsp.dll.CryptAcquireContextA
cryptsp.dll.CryptCreateHash
cryptsp.dll.CryptHashData
cryptsp.dll.CryptGetHashParam
cryptsp.dll.CryptDestroyHash
clr.dll.DllGetClassObjectInternal
clr.dll.StrongNameTokenFromPublicKey
clr.dll.StrongNameFreeBuffer
clr.dll.CompareAssemblyIdentityWithConfig
clr.dll.CreateAssemblyConfigCookie
clr.dll.DestroyAssemblyConfigCookie
clr.dll.CreateAssemblyNameObject
cryptsp.dll.CryptImportKey
cryptsp.dll.CryptExportKey
cryptsp.dll.CryptDestroyKey
mscorpehost.dll.InitializeSxS
mscorpehost.dll.CreateICeeFileGen
mscorpehost.dll.DestroyICeeFileGen
ole32.dll.CoCreateGuid
diasymreader.dll.DllGetClassObject
rpcrt4.dll.UuidCreate
kernel32.dll.NlsGetCacheUpdateCount
ole32.dll.CreateStreamOnHGlobal
mscoree.dll.CorExitProcess
mscoreei.dll.CorExitProcess
kernel32.dll.InitializeCriticalSectionAndSpinCount
msvcrt.dll._set_error_mode
msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z
kernel32.dll.FindActCtxSectionStringW
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
uxtheme.dll.ThemeInitApiHook
user32.dll.IsProcessDPIAware
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
cryptsp.dll.CryptVerifySignatureA
mscorjit.dll.getJit
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
advapi32.dll.RegSetValueExW
kernel32.dll.ReleaseMutex
kernel32.dll.CreateMutexW
user32.dll.SendMessageTimeoutA
kernel32.dll.GetStartupInfoW
kernel32.dll.WaitForSingleObject
kernel32.dll.SwitchToThread
kernel32.dll.SetErrorMode
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
user32.dll.GetAsyncKeyState
user32.dll.RegisterWindowMessageW
user32.dll.GetKeyState
kernel32.dll.GetCurrentThread
kernel32.dll.GetCurrentThreadId
user32.dll.GetSystemMetrics
kernel32.dll.GetModuleHandleW
user32.dll.DefWindowProcW
gdi32.dll.GetStockObject
user32.dll.RegisterClassW
user32.dll.CreateWindowExW
user32.dll.SetWindowLongW
user32.dll.GetWindowLongW
user32.dll.CallWindowProcW
user32.dll.GetClientRect
user32.dll.GetWindowRect
user32.dll.GetParent
ole32.dll.OleInitialize
ole32.dll.CoRegisterMessageFilter
user32.dll.PeekMessageW
user32.dll.GetKeyboardState
user32.dll.MapVirtualKeyA
user32.dll.GetForegroundWindow
user32.dll.GetWindowThreadProcessId
user32.dll.GetKeyboardLayout
user32.dll.ToUnicodeEx
mscoree.dll.ND_RI2
mscoreei.dll.ND_RI2
ws2_32.dll.WSAStartup
ws2_32.dll.WSASocketW
ws2_32.dll.setsockopt
ws2_32.dll.WSAEventSelect
ws2_32.dll.ioctlsocket
ws2_32.dll.closesocket
kernel32.dll.GetCurrentProcessId
kernel32.dll.GetComputerNameW
advapi32.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW
kernel32.dll.LocalFree
kernel32.dll.CreateFileMappingW
kernel32.dll.MapViewOfFile
kernel32.dll.VirtualQuery
advapi32.dll.CreateWellKnownSid
kernel32.dll.OpenMutexW
kernel32.dll.OpenProcess
kernel32.dll.GetProcessTimes
ws2_32.dll.inet_addr
ws2_32.dll.WSAConnect
kernel32.dll.FormatMessageW
kernel32.dll.GetProcessWorkingSetSize
kernel32.dll.SetProcessWorkingSetSize
ws2_32.dll.shutdown
user32.dll.GetWindowTextLengthA
user32.dll.GetWindowTextA
advapi32.dll.RegCreateKeyExW
rasmontr.dll.InitHelperDll
nshwfp.dll.InitHelperDll
dhcpcmonitor.dll.InitHelperDll
wshelper.dll.InitHelperDll
nshhttp.dll.InitHelperDll
fwcfg.dll.InitHelperDll
authfwcfg.dll.InitHelperDll
ifmon.dll.InitHelperDll
netiohlp.dll.InitHelperDll
whhelper.dll.InitHelperDll
hnetmon.dll.InitHelperDll
rpcnsh.dll.InitHelperDll
dot3cfg.dll.InitHelperDll
napmontr.dll.InitHelperDll
nshipsec.dll.InitHelperDll
p2pnetsh.dll.InitHelperDll
wlancfg.dll.InitHelperDll
peerdistsh.dll.InitHelperDll
cryptsp.dll.CryptEnumProvidersW
user32.dll.LoadStringW
sechost.dll.OpenSCManagerW
sechost.dll.OpenServiceW
sechost.dll.QueryServiceConfigW
sechost.dll.CloseServiceHandle
sechost.dll.QueryServiceStatus
sechost.dll.LookupAccountNameLocalW
advapi32.dll.LookupAccountSidW
sechost.dll.LookupAccountSidLocalW
rpcrtremote.dll.I_RpcExtInitializeExtensionPoint
httpapi.dll.HttpInitialize
userenv.dll.RegisterGPNotification
userenv.dll.UnregisterGPNotification
gpapi.dll.RegisterGPNotificationInternal
bcryptprimitives.dll.GetHashInterface
bcryptprimitives.dll.GetCipherInterface
kernel32.dll.SetThreadUILanguage
mprmsg.dll.MprmsgGetErrorString
httpapi.dll.HttpTerminate
gpapi.dll.UnregisterGPNotificationInternal
oleaut32.dll.#9
comctl32.dll.#388

Execute Commands

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Seven01\AppData\Local\Temp\chmcm1qm.cmdline"
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Seven01\AppData\Local\Temp\RESB0B2.tmp" "c:\Users\Seven01\AppData\Local\Temp\CSC86A43FABE8D74F4A81475554FCCBD42.TMP"
netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE

Started Services

Nothing to display

Created Services

Nothing to display
Behavior analysis details
Machine name Machine label Machine manager Started Ended Duration
Seven02_64 Seven02_64 VirtualBox 2018-05-24 03:19:15 2018-05-24 03:22:08 173

1 Host(s) detected

IP Address Hostname Reverse DNS
60.48.39.240 Malaysia 240.39.48.60.klj03-home.tm.net.my.

Host(s) by Country

Hosts Country 1
1 Malaysia Malaysia

#infosec #automation

TheSystem Itself @ 2018-05-24 03:21:10