Detections

Yara:

AgentTeslaV2

Analysis

Category Package Started Completed Duration Options Log
FILE exe 2020-06-23 06:06:23 2020-06-23 06:11:57 334 seconds Show Options Show Log
route = tor
2020-05-13 09:11:22,719 [root] INFO: Date set to: 20200623T06:06:23, timeout set to: 200
2020-06-23 06:06:23,015 [root] DEBUG: Starting analyzer from: C:\tmp52sk_on6
2020-06-23 06:06:23,015 [root] DEBUG: Storing results at: C:\elXgREWCy
2020-06-23 06:06:23,015 [root] DEBUG: Pipe server name: \\.\PIPE\auzPAOPNj
2020-06-23 06:06:23,015 [root] DEBUG: Python path: C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32
2020-06-23 06:06:23,031 [root] DEBUG: No analysis package specified, trying to detect it automagically.
2020-06-23 06:06:23,031 [root] INFO: Automatically selected analysis package "exe"
2020-06-23 06:06:23,031 [root] DEBUG: Trying to import analysis package "exe"...
2020-06-23 06:06:23,062 [root] DEBUG: Imported analysis package "exe".
2020-06-23 06:06:23,062 [root] DEBUG: Trying to initialize analysis package "exe"...
2020-06-23 06:06:23,062 [root] DEBUG: Initialized analysis package "exe".
2020-06-23 06:06:23,109 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.browser"...
2020-06-23 06:06:23,125 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser".
2020-06-23 06:06:23,125 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.curtain"...
2020-06-23 06:06:23,171 [root] DEBUG: Imported auxiliary module "modules.auxiliary.curtain".
2020-06-23 06:06:23,187 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.digisig"...
2020-06-23 06:06:23,218 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig".
2020-06-23 06:06:23,218 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.disguise"...
2020-06-23 06:06:23,218 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise".
2020-06-23 06:06:23,218 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.human"...
2020-06-23 06:06:23,234 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human".
2020-06-23 06:06:23,234 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.procmon"...
2020-06-23 06:06:23,234 [root] DEBUG: Imported auxiliary module "modules.auxiliary.procmon".
2020-06-23 06:06:23,234 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.screenshots"...
2020-06-23 06:06:23,234 [modules.auxiliary.screenshots] DEBUG: Importing 'time'
2020-06-23 06:06:23,234 [modules.auxiliary.screenshots] DEBUG: Importing 'StringIO'
2020-06-23 06:06:23,234 [modules.auxiliary.screenshots] DEBUG: Importing 'Thread'
2020-06-23 06:06:23,234 [modules.auxiliary.screenshots] DEBUG: Importing 'Auxiliary'
2020-06-23 06:06:23,234 [modules.auxiliary.screenshots] DEBUG: Importing 'NetlogFile'
2020-06-23 06:06:23,234 [modules.auxiliary.screenshots] DEBUG: Importing 'Screenshot'
2020-06-23 06:06:23,265 [lib.api.screenshot] DEBUG: Importing 'math'
2020-06-23 06:06:23,265 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2020-06-23 06:06:24,359 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab'
2020-06-23 06:06:24,375 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw'
2020-06-23 06:06:24,421 [modules.auxiliary.screenshots] DEBUG: Imports OK
2020-06-23 06:06:24,421 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots".
2020-06-23 06:06:24,421 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.sysmon"...
2020-06-23 06:06:24,437 [root] DEBUG: Imported auxiliary module "modules.auxiliary.sysmon".
2020-06-23 06:06:24,437 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.usage"...
2020-06-23 06:06:24,437 [root] DEBUG: Imported auxiliary module "modules.auxiliary.usage".
2020-06-23 06:06:24,437 [root] DEBUG: Trying to initialize auxiliary module "Browser"...
2020-06-23 06:06:24,437 [root] DEBUG: Initialized auxiliary module "Browser".
2020-06-23 06:06:24,437 [root] DEBUG: Trying to start auxiliary module "Browser"...
2020-06-23 06:06:24,437 [root] DEBUG: Started auxiliary module Browser
2020-06-23 06:06:24,437 [root] DEBUG: Trying to initialize auxiliary module "Curtain"...
2020-06-23 06:06:24,453 [root] DEBUG: Initialized auxiliary module "Curtain".
2020-06-23 06:06:24,453 [root] DEBUG: Trying to start auxiliary module "Curtain"...
2020-06-23 06:06:24,453 [root] DEBUG: Started auxiliary module Curtain
2020-06-23 06:06:24,453 [root] DEBUG: Trying to initialize auxiliary module "DigiSig"...
2020-06-23 06:06:24,453 [root] DEBUG: Initialized auxiliary module "DigiSig".
2020-06-23 06:06:24,453 [root] DEBUG: Trying to start auxiliary module "DigiSig"...
2020-06-23 06:06:24,453 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature.
2020-06-23 06:06:24,718 [modules.auxiliary.digisig] DEBUG: File is not signed.
2020-06-23 06:06:24,718 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json
2020-06-23 06:06:24,734 [root] DEBUG: Started auxiliary module DigiSig
2020-06-23 06:06:24,734 [root] DEBUG: Trying to initialize auxiliary module "Disguise"...
2020-06-23 06:06:24,734 [root] DEBUG: Initialized auxiliary module "Disguise".
2020-06-23 06:06:24,734 [root] DEBUG: Trying to start auxiliary module "Disguise"...
2020-06-23 06:06:24,750 [root] DEBUG: Started auxiliary module Disguise
2020-06-23 06:06:24,750 [root] DEBUG: Trying to initialize auxiliary module "Human"...
2020-06-23 06:06:24,750 [root] DEBUG: Initialized auxiliary module "Human".
2020-06-23 06:06:24,750 [root] DEBUG: Trying to start auxiliary module "Human"...
2020-06-23 06:06:24,750 [root] DEBUG: Started auxiliary module Human
2020-06-23 06:06:24,750 [root] DEBUG: Trying to initialize auxiliary module "Procmon"...
2020-06-23 06:06:24,750 [root] DEBUG: Initialized auxiliary module "Procmon".
2020-06-23 06:06:24,750 [root] DEBUG: Trying to start auxiliary module "Procmon"...
2020-06-23 06:06:24,765 [root] DEBUG: Started auxiliary module Procmon
2020-06-23 06:06:24,765 [root] DEBUG: Trying to initialize auxiliary module "Screenshots"...
2020-06-23 06:06:24,765 [root] DEBUG: Initialized auxiliary module "Screenshots".
2020-06-23 06:06:24,765 [root] DEBUG: Trying to start auxiliary module "Screenshots"...
2020-06-23 06:06:24,765 [root] DEBUG: Started auxiliary module Screenshots
2020-06-23 06:06:24,765 [root] DEBUG: Trying to initialize auxiliary module "Sysmon"...
2020-06-23 06:06:24,765 [root] DEBUG: Initialized auxiliary module "Sysmon".
2020-06-23 06:06:24,765 [root] DEBUG: Trying to start auxiliary module "Sysmon"...
2020-06-23 06:06:24,765 [root] DEBUG: Started auxiliary module Sysmon
2020-06-23 06:06:24,765 [root] DEBUG: Trying to initialize auxiliary module "Usage"...
2020-06-23 06:06:24,765 [root] DEBUG: Initialized auxiliary module "Usage".
2020-06-23 06:06:24,765 [root] DEBUG: Trying to start auxiliary module "Usage"...
2020-06-23 06:06:24,765 [root] DEBUG: Started auxiliary module Usage
2020-06-23 06:06:24,765 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL option
2020-06-23 06:06:24,765 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL_64 option
2020-06-23 06:06:24,765 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader option
2020-06-23 06:06:24,765 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader_64 option
2020-06-23 06:06:24,828 [lib.api.process] INFO: Successfully executed process from path "C:\Users\Rebecca\AppData\Local\Temp\MV JIA YU SHAN.exe" with arguments "" with pid 5204
2020-06-23 06:06:24,828 [lib.api.process] INFO: Monitor config for process 5204: C:\tmp52sk_on6\dll\5204.ini
2020-06-23 06:06:24,843 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp52sk_on6\dll\iTiVJiI.dll, loader C:\tmp52sk_on6\bin\rcYoEBv.exe
2020-06-23 06:06:24,890 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\auzPAOPNj.
2020-06-23 06:06:24,890 [root] DEBUG: Loader: Injecting process 5204 (thread 5608) with C:\tmp52sk_on6\dll\iTiVJiI.dll.
2020-06-23 06:06:24,890 [root] DEBUG: Process image base: 0x000E0000
2020-06-23 06:06:24,890 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-23 06:06:24,890 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-23 06:06:24,890 [root] DEBUG: Successfully injected DLL C:\tmp52sk_on6\dll\iTiVJiI.dll.
2020-06-23 06:06:24,906 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 5204
2020-06-23 06:06:26,906 [lib.api.process] INFO: Successfully resumed process with pid 5204
2020-06-23 06:06:27,000 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-23 06:06:27,000 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-23 06:06:27,000 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 5204 at 0x6ae60000, image base 0xe0000, stack from 0x315000-0x320000
2020-06-23 06:06:27,015 [root] DEBUG: Commandline: C:\Users\Rebecca\AppData\Local\Temp\"C:\Users\Rebecca\AppData\Local\Temp\MV JIA YU SHAN.exe".
2020-06-23 06:06:27,015 [root] INFO: Loaded monitor into process with pid 5204
2020-06-23 06:06:27,031 [root] DEBUG: set_caller_info: Adding region at 0x00220000 to caller regions list (advapi32::RegQueryInfoKeyW).
2020-06-23 06:06:27,031 [root] DEBUG: set_caller_info: Adding region at 0x01460000 to caller regions list (ntdll::RtlDispatchException).
2020-06-23 06:06:27,078 [root] DEBUG: DLL loaded at 0x756F0000: C:\Windows\system32\cryptbase (0xc000 bytes).
2020-06-23 06:06:27,078 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x1460000
2020-06-23 06:06:27,078 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x01460000 size 0x400000.
2020-06-23 06:06:27,078 [root] DEBUG: DumpPEsInRange: Scanning range 0x1460000 - 0x1461000.
2020-06-23 06:06:27,078 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x1460000-0x1461000.
2020-06-23 06:06:27,125 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\elXgREWCy\CAPE\5204_134893625227461123262020 (size 0xffe)
2020-06-23 06:06:27,125 [root] DEBUG: DumpRegion: Dumped stack region from 0x01460000, size 0x1000.
2020-06-23 06:06:27,125 [root] DEBUG: set_caller_info: Failed to dumping calling PE image at 0x00220000.
2020-06-23 06:06:27,125 [root] DEBUG: set_caller_info: Adding region at 0x00510000 to caller regions list (kernel32::FindFirstFileExW).
2020-06-23 06:06:27,187 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x60ffff
2020-06-23 06:06:27,187 [root] DEBUG: DumpMemory: Nothing to dump at 0x00510000!
2020-06-23 06:06:27,187 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00510000 size 0x100000.
2020-06-23 06:06:27,187 [root] DEBUG: DumpPEsInRange: Scanning range 0x510000 - 0x541000.
2020-06-23 06:06:27,187 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x510000-0x541000.
2020-06-23 06:06:27,218 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\elXgREWCy\CAPE\5204_31118820627461123262020 (size 0x30ffe)
2020-06-23 06:06:27,218 [root] DEBUG: DumpRegion: Dumped stack region from 0x00510000, size 0x31000.
2020-06-23 06:06:27,218 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xc4 amd local view 0x6BE30000 to global list.
2020-06-23 06:06:27,218 [root] DEBUG: DLL loaded at 0x6BE30000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei (0x7d000 bytes).
2020-06-23 06:06:27,234 [root] DEBUG: DLL unloaded from 0x76970000.
2020-06-23 06:06:27,249 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xd4 amd local view 0x013B0000 to global list.
2020-06-23 06:06:27,249 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xd0 amd local view 0x013B0000 to global list.
2020-06-23 06:06:27,249 [root] DEBUG: DLL loaded at 0x74C70000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-06-23 06:06:27,296 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x68250000 for section view with handle 0xd0.
2020-06-23 06:06:27,312 [root] DEBUG: DLL loaded at 0x68250000: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks (0x5b1000 bytes).
2020-06-23 06:06:27,343 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6A8E0000 for section view with handle 0xd4.
2020-06-23 06:06:27,343 [root] DEBUG: DLL loaded at 0x6A8E0000: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\MSVCR80 (0x9b000 bytes).
2020-06-23 06:06:27,359 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 5204, handle 0xe0.
2020-06-23 06:06:27,359 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xdc amd local view 0x001C0000 to global list.
2020-06-23 06:06:27,359 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xe4 amd local view 0x001D0000 to global list.
2020-06-23 06:06:27,359 [root] INFO: Disabling sleep skipping.
2020-06-23 06:06:27,359 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 5204.
2020-06-23 06:06:27,375 [root] DEBUG: DLL loaded at 0x76B60000: C:\Windows\system32\shell32 (0xc4c000 bytes).
2020-06-23 06:06:27,375 [root] DEBUG: DLL loaded at 0x757A0000: C:\Windows\system32\profapi (0xb000 bytes).
2020-06-23 06:06:27,390 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 5204.
2020-06-23 06:06:27,390 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1a4 amd local view 0x66920000 to global list.
2020-06-23 06:06:27,390 [root] DEBUG: DLL loaded at 0x66920000: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\f8420d8c6ede777377fcff48a4beaa2a\mscorlib.ni (0xafe000 bytes).
2020-06-23 06:06:27,406 [root] DEBUG: DLL unloaded from 0x762F0000.
2020-06-23 06:06:27,609 [root] DEBUG: set_caller_info: Adding region at 0x03420000 to caller regions list (kernel32::SetErrorMode).
2020-06-23 06:06:27,625 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x345ffff
2020-06-23 06:06:27,625 [root] DEBUG: DumpMemory: Nothing to dump at 0x03420000!
2020-06-23 06:06:27,625 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x03420000 size 0x40000.
2020-06-23 06:06:27,625 [root] DEBUG: DumpPEsInRange: Scanning range 0x3420000 - 0x3421000.
2020-06-23 06:06:27,625 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x3420000-0x3421000.
2020-06-23 06:06:27,656 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\elXgREWCy\CAPE\5204_189850959227461123262020 (size 0xffe)
2020-06-23 06:06:27,656 [root] DEBUG: DumpRegion: Dumped stack region from 0x03420000, size 0x1000.
2020-06-23 06:06:27,656 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1b8 amd local view 0x00360000 to global list.
2020-06-23 06:06:27,656 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1b4 amd local view 0x02990000 to global list.
2020-06-23 06:06:27,734 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6A530000 for section view with handle 0x1b4.
2020-06-23 06:06:27,734 [root] DEBUG: DLL loaded at 0x6A530000: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit (0x5b000 bytes).
2020-06-23 06:06:27,843 [root] DEBUG: set_caller_info: Adding region at 0x004B0000 to caller regions list (ntdll::NtQueryPerformanceCounter).
2020-06-23 06:06:27,843 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x4bffff
2020-06-23 06:06:27,843 [root] DEBUG: DumpMemory: Nothing to dump at 0x004B0000!
2020-06-23 06:06:27,843 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x004B0000 size 0x10000.
2020-06-23 06:06:27,843 [root] DEBUG: DumpPEsInRange: Scanning range 0x4b0000 - 0x4b1000.
2020-06-23 06:06:27,859 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x4b0000-0x4b1000.
2020-06-23 06:06:27,875 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\elXgREWCy\CAPE\5204_34995084327461123262020 (size 0xad)
2020-06-23 06:06:27,875 [root] DEBUG: DumpRegion: Dumped stack region from 0x004B0000, size 0x1000.
2020-06-23 06:06:27,937 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1cc amd local view 0x66170000 to global list.
2020-06-23 06:06:27,937 [root] DEBUG: DLL loaded at 0x66170000: C:\Windows\assembly\NativeImages_v2.0.50727_32\System\0a65164b17e5c64bacdc694ea2439c43\System.ni (0x7a5000 bytes).
2020-06-23 06:06:27,937 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x68C10000 for section view with handle 0x1cc.
2020-06-23 06:06:27,937 [root] DEBUG: DLL loaded at 0x68C10000: C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\4ac828c8c4c76f3ba59f8f9c7dab1cb3\Microsoft.VisualBasic.ni (0x19b000 bytes).
2020-06-23 06:06:28,000 [root] DEBUG: set_caller_info: Adding region at 0x001F0000 to caller regions list (ntdll::NtAllocateVirtualMemory).
2020-06-23 06:06:28,000 [root] DEBUG: set_caller_info: Failed to dumping calling PE image at 0x001F0000.
2020-06-23 06:06:28,031 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004D0000 for section view with handle 0x1cc.
2020-06-23 06:06:28,078 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1d4 amd local view 0x00720000 to global list.
2020-06-23 06:06:28,234 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1dc amd local view 0x73600000 to global list.
2020-06-23 06:06:28,234 [root] DEBUG: DLL loaded at 0x73600000: C:\Windows\Microsoft.NET\Framework\v2.0.50727\culture (0x8000 bytes).
2020-06-23 06:06:28,249 [root] DEBUG: DLL unloaded from 0x73600000.
2020-06-23 06:06:28,249 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x02990000 for section view with handle 0x1dc.
2020-06-23 06:06:28,593 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x004E0000 for section view with handle 0x1dc.
2020-06-23 06:06:28,671 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1d8 amd local view 0x688E0000 to global list.
2020-06-23 06:06:28,671 [root] DEBUG: DLL loaded at 0x688E0000: C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\175df210b784212def386595c25caefb\System.Drawing.ni (0x189000 bytes).
2020-06-23 06:06:38,718 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1e0 amd local view 0x740F0000 to global list.
2020-06-23 06:06:38,718 [root] DEBUG: DLL loaded at 0x740F0000: C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035\gdiplus (0x192000 bytes).
2020-06-23 06:06:38,734 [root] DEBUG: DLL loaded at 0x73B20000: C:\Windows\system32\WindowsCodecs (0x131000 bytes).
2020-06-23 06:06:38,750 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1e8 amd local view 0x02A70000 to global list.
2020-06-23 06:06:38,750 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x02A80000 for section view with handle 0x1e8.
2020-06-23 06:06:38,750 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x02A90000 for section view with handle 0x1e8.
2020-06-23 06:06:38,984 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1f0 amd local view 0x033C0000 to global list.
2020-06-23 06:06:39,203 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x204 amd local view 0x65590000 to global list.
2020-06-23 06:06:39,218 [root] DEBUG: DLL loaded at 0x65590000: C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\5669120680b52abf616f3876387ca2cc\System.Windows.Forms.ni (0xbdf000 bytes).
2020-06-23 06:06:39,359 [root] INFO: Announced 32-bit process name: MV JIA YU SHAN.exe pid: 3452
2020-06-23 06:06:39,359 [lib.api.process] INFO: Monitor config for process 3452: C:\tmp52sk_on6\dll\3452.ini
2020-06-23 06:06:39,359 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp52sk_on6\dll\iTiVJiI.dll, loader C:\tmp52sk_on6\bin\rcYoEBv.exe
2020-06-23 06:06:39,375 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\auzPAOPNj.
2020-06-23 06:06:39,375 [root] DEBUG: Loader: Injecting process 3452 (thread 5640) with C:\tmp52sk_on6\dll\iTiVJiI.dll.
2020-06-23 06:06:39,375 [root] DEBUG: Process image base: 0x000E0000
2020-06-23 06:06:39,390 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-23 06:06:39,390 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-23 06:06:39,390 [root] DEBUG: Successfully injected DLL C:\tmp52sk_on6\dll\iTiVJiI.dll.
2020-06-23 06:06:39,406 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3452
2020-06-23 06:06:39,421 [root] DEBUG: DLL loaded at 0x756A0000: C:\Windows\system32\apphelp (0x4c000 bytes).
2020-06-23 06:06:39,453 [root] DEBUG: CreateProcessHandler: Injection info set for new process 3452, ImageBase: 0x000E0000
2020-06-23 06:06:39,468 [root] DEBUG: WriteMemoryHandler: Executable binary injected into process 3452 (ImageBase 0x400000)
2020-06-23 06:06:39,468 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-06-23 06:06:39,468 [root] DEBUG: DumpPE: Instantiating PeParser with address: 0x04A25A48.
2020-06-23 06:06:39,515 [root] DEBUG: DumpPE: PE file in memory dumped successfully - dump size 0x45800.
2020-06-23 06:06:39,515 [root] DEBUG: WriteMemoryHandler: Dumped PE image from buffer at 0x4a25a48, SizeOfImage 0x4c000.
2020-06-23 06:06:39,515 [root] INFO: Announced 32-bit process name: MV JIA YU SHAN.exe pid: 3452
2020-06-23 06:06:39,515 [lib.api.process] INFO: Monitor config for process 3452: C:\tmp52sk_on6\dll\3452.ini
2020-06-23 06:06:39,515 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp52sk_on6\dll\iTiVJiI.dll, loader C:\tmp52sk_on6\bin\rcYoEBv.exe
2020-06-23 06:06:39,546 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\auzPAOPNj.
2020-06-23 06:06:39,546 [root] DEBUG: Loader: Injecting process 3452 (thread 0) with C:\tmp52sk_on6\dll\iTiVJiI.dll.
2020-06-23 06:06:39,562 [root] DEBUG: Error 0 (0x0) - GetProcessInitialThreadId: Remote PEB 0x7FFD8000 Local PEB 0x7FFDE000 Local TEB 0x7FFDF000: The operation completed successfully.
2020-06-23 06:06:39,562 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-23 06:06:39,562 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-06-23 06:06:39,562 [root] DEBUG: Failed to inject DLL C:\tmp52sk_on6\dll\iTiVJiI.dll.
2020-06-23 06:06:39,562 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 3452, error: 4294967281
2020-06-23 06:06:39,656 [root] DEBUG: WriteMemoryHandler: shellcode at 0x0478A328 (size 0x45000) injected into process 3452.
2020-06-23 06:06:39,703 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\elXgREWCy\CAPE\5204_11285169442471123262020 (size 0x44eb2)
2020-06-23 06:06:39,703 [root] INFO: Announced 32-bit process name: MV JIA YU SHAN.exe pid: 3452
2020-06-23 06:06:39,703 [lib.api.process] INFO: Monitor config for process 3452: C:\tmp52sk_on6\dll\3452.ini
2020-06-23 06:06:39,703 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp52sk_on6\dll\iTiVJiI.dll, loader C:\tmp52sk_on6\bin\rcYoEBv.exe
2020-06-23 06:06:39,718 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\auzPAOPNj.
2020-06-23 06:06:39,718 [root] DEBUG: Loader: Injecting process 3452 (thread 0) with C:\tmp52sk_on6\dll\iTiVJiI.dll.
2020-06-23 06:06:39,734 [root] DEBUG: Error 0 (0x0) - GetProcessInitialThreadId: Remote PEB 0x7FFD8000 Local PEB 0x7FFDF000 Local TEB 0x7FFDE000: The operation completed successfully.
2020-06-23 06:06:39,734 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-23 06:06:39,734 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-06-23 06:06:39,734 [root] DEBUG: Failed to inject DLL C:\tmp52sk_on6\dll\iTiVJiI.dll.
2020-06-23 06:06:39,734 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 3452, error: 4294967281
2020-06-23 06:06:39,734 [root] DEBUG: WriteMemoryHandler: shellcode at 0x0374E204 (size 0x400) injected into process 3452.
2020-06-23 06:06:39,765 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\elXgREWCy\CAPE\5204_14826468022471123262020 (size 0x2e8)
2020-06-23 06:06:39,781 [root] DEBUG: WriteMemoryHandler: Dumped injected code/data from buffer.
2020-06-23 06:06:39,781 [root] INFO: Announced 32-bit process name: MV JIA YU SHAN.exe pid: 3452
2020-06-23 06:06:39,781 [lib.api.process] INFO: Monitor config for process 3452: C:\tmp52sk_on6\dll\3452.ini
2020-06-23 06:06:39,781 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp52sk_on6\dll\iTiVJiI.dll, loader C:\tmp52sk_on6\bin\rcYoEBv.exe
2020-06-23 06:06:39,796 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\auzPAOPNj.
2020-06-23 06:06:39,796 [root] DEBUG: Loader: Injecting process 3452 (thread 0) with C:\tmp52sk_on6\dll\iTiVJiI.dll.
2020-06-23 06:06:39,796 [root] DEBUG: Error 0 (0x0) - GetProcessInitialThreadId: Remote PEB 0x7FFD8000 Local PEB 0x7FFDF000 Local TEB 0x7FFD5000: The operation completed successfully.
2020-06-23 06:06:39,796 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-23 06:06:39,796 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-06-23 06:06:39,796 [root] DEBUG: Failed to inject DLL C:\tmp52sk_on6\dll\iTiVJiI.dll.
2020-06-23 06:06:39,812 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 3452, error: 4294967281
2020-06-23 06:06:39,812 [root] DEBUG: WriteMemoryHandler: shellcode at 0x0374E610 (size 0x200) injected into process 3452.
2020-06-23 06:06:39,828 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\elXgREWCy\CAPE\5204_996400402471123262020 (size 0x9)
2020-06-23 06:06:39,828 [root] DEBUG: WriteMemoryHandler: Dumped injected code/data from buffer.
2020-06-23 06:06:39,828 [root] INFO: Announced 32-bit process name: MV JIA YU SHAN.exe pid: 3452
2020-06-23 06:06:39,828 [lib.api.process] INFO: Monitor config for process 3452: C:\tmp52sk_on6\dll\3452.ini
2020-06-23 06:06:39,828 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp52sk_on6\dll\iTiVJiI.dll, loader C:\tmp52sk_on6\bin\rcYoEBv.exe
2020-06-23 06:06:39,843 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\auzPAOPNj.
2020-06-23 06:06:39,843 [root] DEBUG: Loader: Injecting process 3452 (thread 0) with C:\tmp52sk_on6\dll\iTiVJiI.dll.
2020-06-23 06:06:39,843 [root] DEBUG: Error 0 (0x0) - GetProcessInitialThreadId: Remote PEB 0x7FFD8000 Local PEB 0x7FFDF000 Local TEB 0x7FFDA000: The operation completed successfully.
2020-06-23 06:06:39,843 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-23 06:06:39,843 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-06-23 06:06:39,843 [root] DEBUG: Failed to inject DLL C:\tmp52sk_on6\dll\iTiVJiI.dll.
2020-06-23 06:06:39,843 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 3452, error: 4294967281
2020-06-23 06:06:39,859 [root] INFO: Announced 32-bit process name: MV JIA YU SHAN.exe pid: 3452
2020-06-23 06:06:39,859 [lib.api.process] INFO: Monitor config for process 3452: C:\tmp52sk_on6\dll\3452.ini
2020-06-23 06:06:39,859 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp52sk_on6\dll\iTiVJiI.dll, loader C:\tmp52sk_on6\bin\rcYoEBv.exe
2020-06-23 06:06:39,859 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\auzPAOPNj.
2020-06-23 06:06:39,875 [root] DEBUG: Loader: Injecting process 3452 (thread 0) with C:\tmp52sk_on6\dll\iTiVJiI.dll.
2020-06-23 06:06:39,875 [root] DEBUG: Error 0 (0x0) - GetProcessInitialThreadId: Remote PEB 0x7FFD8000 Local PEB 0x7FFDF000 Local TEB 0x7FFDA000: The operation completed successfully.
2020-06-23 06:06:39,890 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-23 06:06:39,890 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-06-23 06:06:39,890 [root] DEBUG: Failed to inject DLL C:\tmp52sk_on6\dll\iTiVJiI.dll.
2020-06-23 06:06:39,890 [lib.api.process] ERROR: Unable to inject into 32-bit process with pid 3452, error: 4294967281
2020-06-23 06:06:39,890 [root] DEBUG: SetThreadContextHandler: Hollow process entry point reset via NtSetContextThread to 0x00046EAE (process 3452).
2020-06-23 06:06:39,890 [root] INFO: Announced 32-bit process name: MV JIA YU SHAN.exe pid: 3452
2020-06-23 06:06:39,890 [lib.api.process] INFO: Monitor config for process 3452: C:\tmp52sk_on6\dll\3452.ini
2020-06-23 06:06:39,890 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp52sk_on6\dll\iTiVJiI.dll, loader C:\tmp52sk_on6\bin\rcYoEBv.exe
2020-06-23 06:06:39,906 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\auzPAOPNj.
2020-06-23 06:06:39,906 [root] DEBUG: Loader: Injecting process 3452 (thread 5640) with C:\tmp52sk_on6\dll\iTiVJiI.dll.
2020-06-23 06:06:39,906 [root] DEBUG: Process image base: 0x00400000
2020-06-23 06:06:39,906 [root] DEBUG: InjectDllViaIAT: Executable is .NET, injecting via queued APC.
2020-06-23 06:06:39,906 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2020-06-23 06:06:39,906 [root] DEBUG: Successfully injected DLL C:\tmp52sk_on6\dll\iTiVJiI.dll.
2020-06-23 06:06:39,921 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3452
2020-06-23 06:06:39,921 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3452.
2020-06-23 06:06:39,937 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-23 06:06:39,937 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-23 06:06:39,953 [root] INFO: Disabling sleep skipping.
2020-06-23 06:06:39,953 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 3452 at 0x6ae60000, image base 0x400000, stack from 0x296000-0x2a0000
2020-06-23 06:06:39,953 [root] DEBUG: Commandline: C:\Users\Rebecca\AppData\Local\Temp\"{path}".
2020-06-23 06:06:39,968 [root] INFO: Loaded monitor into process with pid 3452
2020-06-23 06:06:39,968 [root] DEBUG: set_caller_info: Adding region at 0x00070000 to caller regions list (ntdll::LdrLoadDll).
2020-06-23 06:06:39,968 [root] DEBUG: set_caller_info: Adding region at 0x016E0000 to caller regions list (kernel32::GetSystemTime).
2020-06-23 06:06:39,984 [root] DEBUG: DLL loaded at 0x756F0000: C:\Windows\system32\cryptbase (0xc000 bytes).
2020-06-23 06:06:39,984 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x16e0000
2020-06-23 06:06:39,984 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x016E0000 size 0x400000.
2020-06-23 06:06:39,984 [root] DEBUG: DumpPEsInRange: Scanning range 0x16e0000 - 0x16e1000.
2020-06-23 06:06:39,984 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x16e0000-0x16e1000.
2020-06-23 06:06:40,015 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\elXgREWCy\CAPE\3452_115963426439461123262020 (size 0x597)
2020-06-23 06:06:40,015 [root] DEBUG: DumpRegion: Dumped stack region from 0x016E0000, size 0x1000.
2020-06-23 06:06:40,046 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\elXgREWCy\CAPE\3452_77749127340461123262020 (size 0x12a)
2020-06-23 06:06:40,046 [root] DEBUG: DumpRegion: Dumped stack region from 0x00070000, size 0x1000.
2020-06-23 06:06:40,046 [root] DEBUG: DLL loaded at 0x00630000: C:\tmp52sk_on6\dll\iTiVJiI (0xd5000 bytes).
2020-06-23 06:06:40,046 [root] DEBUG: DLL unloaded from 0x72070000.
2020-06-23 06:06:40,046 [root] DEBUG: DLL unloaded from 0x76450000.
2020-06-23 06:06:40,046 [root] DEBUG: DLL unloaded from 0x72070000.
2020-06-23 06:06:40,046 [root] DEBUG: DLL unloaded from 0x76450000.
2020-06-23 06:06:40,062 [root] DEBUG: DLL unloaded from 0x00630000.
2020-06-23 06:06:40,062 [root] DEBUG: set_caller_info: Adding region at 0x001A0000 to caller regions list (advapi32::RegQueryInfoKeyW).
2020-06-23 06:06:40,062 [root] DEBUG: set_caller_info: Failed to dumping calling PE image at 0x001A0000.
2020-06-23 06:06:40,062 [root] DEBUG: set_caller_info: Adding region at 0x00530000 to caller regions list (kernel32::FindFirstFileExW).
2020-06-23 06:06:40,078 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x62ffff
2020-06-23 06:06:40,078 [root] DEBUG: DumpMemory: Nothing to dump at 0x00530000!
2020-06-23 06:06:40,078 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00530000 size 0x100000.
2020-06-23 06:06:40,078 [root] DEBUG: DumpPEsInRange: Scanning range 0x530000 - 0x563000.
2020-06-23 06:06:40,078 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x530000-0x563000.
2020-06-23 06:06:40,234 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 5204
2020-06-23 06:06:40,234 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\elXgREWCy\CAPE\3452_10962417240461123262020 (size 0x32ffe)
2020-06-23 06:06:40,234 [root] DEBUG: GetHookCallerBase: thread 5608 (handle 0x0), return address 0x004B0771, allocation base 0x004B0000.
2020-06-23 06:06:40,234 [root] DEBUG: DumpRegion: Dumped stack region from 0x00530000, size 0x33000.
2020-06-23 06:06:40,234 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x000E0000.
2020-06-23 06:06:40,234 [root] DEBUG: LooksLikeSectionBoundary: Exception occured reading around suspected boundary at 0x000E2000
2020-06-23 06:06:40,234 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-06-23 06:06:40,249 [root] DEBUG: set_caller_info: Adding region at 0x000E0000 to caller regions list (advapi32::RegOpenKeyExW).
2020-06-23 06:06:40,249 [root] DEBUG: DumpPE: Instantiating PeParser with address: 0x000E0000.
2020-06-23 06:06:40,249 [root] DEBUG: set_caller_info: Calling region at 0x000E0000 skipped.
2020-06-23 06:06:40,249 [root] DEBUG: DumpPE: Empty or inaccessible last section, file image seems incomplete (from 0x0017E000 to 0x0017E200).
2020-06-23 06:06:40,249 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xc4 amd local view 0x6BE30000 to global list.
2020-06-23 06:06:40,249 [root] DEBUG: DLL loaded at 0x6BE30000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei (0x7d000 bytes).
2020-06-23 06:06:40,265 [root] DEBUG: DLL unloaded from 0x76970000.
2020-06-23 06:06:40,265 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xd4 amd local view 0x00310000 to global list.
2020-06-23 06:06:40,265 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xd0 amd local view 0x00310000 to global list.
2020-06-23 06:06:40,281 [root] DEBUG: DLL loaded at 0x74C70000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-06-23 06:06:40,281 [root] DEBUG: DumpPE: Error: Cannot dump PE file from memory.
2020-06-23 06:06:40,281 [root] DEBUG: DumpImageInCurrentProcess: Failed to dump 'raw' PE image from 0x000E0000, dumping memory region.
2020-06-23 06:06:40,281 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x68250000 for section view with handle 0xd0.
2020-06-23 06:06:40,296 [root] DEBUG: DLL loaded at 0x68250000: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks (0x5b1000 bytes).
2020-06-23 06:06:40,296 [root] DEBUG: DLL unloaded from 0x75C80000.
2020-06-23 06:06:40,296 [root] DEBUG: DLL unloaded from 0x68250000.
2020-06-23 06:06:40,296 [root] DEBUG: DLL unloaded from 0x6BE30000.
2020-06-23 06:06:40,296 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 5204
2020-06-23 06:06:40,312 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6A8E0000 for section view with handle 0xd4.
2020-06-23 06:06:40,328 [root] DEBUG: GetHookCallerBase: thread 5608 (handle 0x0), return address 0x004B0771, allocation base 0x004B0000.
2020-06-23 06:06:40,343 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x000E0000.
2020-06-23 06:06:40,343 [root] DEBUG: DLL loaded at 0x6A8E0000: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\MSVCR80 (0x9b000 bytes).
2020-06-23 06:06:40,375 [root] DEBUG: LooksLikeSectionBoundary: Exception occured reading around suspected boundary at 0x000E2000
2020-06-23 06:06:40,375 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-06-23 06:06:40,406 [root] DEBUG: DLL loaded at 0x757A0000: C:\Windows\system32\profapi (0xb000 bytes).
2020-06-23 06:06:40,421 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3452.
2020-06-23 06:06:40,453 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1a0 amd local view 0x65E20000 to global list.
2020-06-23 06:06:40,468 [root] DEBUG: DLL loaded at 0x65E20000: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\f8420d8c6ede777377fcff48a4beaa2a\mscorlib.ni (0xafe000 bytes).
2020-06-23 06:06:40,515 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1a4 amd local view 0x00370000 to global list.
2020-06-23 06:06:40,515 [root] DEBUG: DLL unloaded from 0x762F0000.
2020-06-23 06:06:40,531 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1a8 amd local view 0x02AF0000 to global list.
2020-06-23 06:06:40,546 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6A4D0000 for section view with handle 0x1a8.
2020-06-23 06:06:40,546 [root] DEBUG: DLL loaded at 0x6A4D0000: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit (0x5b000 bytes).
2020-06-23 06:06:40,593 [root] DEBUG: set_caller_info: Adding region at 0x02B10000 to caller regions list (ntdll::NtAllocateVirtualMemory).
2020-06-23 06:06:40,593 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x2b1ffff
2020-06-23 06:06:40,609 [root] DEBUG: DumpMemory: Nothing to dump at 0x02B10000!
2020-06-23 06:06:40,609 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x02B10000 size 0x10000.
2020-06-23 06:06:40,609 [root] DEBUG: DumpPEsInRange: Scanning range 0x2b10000 - 0x2b1d000.
2020-06-23 06:06:40,609 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x2b10000-0x2b1d000.
2020-06-23 06:06:40,671 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\elXgREWCy\CAPE\3452_86498113240461123262020 (size 0xce7a)
2020-06-23 06:06:40,671 [root] DEBUG: DumpRegion: Dumped stack region from 0x02B10000, size 0xd000.
2020-06-23 06:06:40,750 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1c4 amd local view 0x66C70000 to global list.
2020-06-23 06:06:40,750 [root] DEBUG: DLL loaded at 0x66C70000: C:\Windows\assembly\NativeImages_v2.0.50727_32\System\0a65164b17e5c64bacdc694ea2439c43\System.ni (0x7a5000 bytes).
2020-06-23 06:06:40,765 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x68C20000 for section view with handle 0x1c4.
2020-06-23 06:06:40,765 [root] DEBUG: DLL loaded at 0x68C20000: C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\175df210b784212def386595c25caefb\System.Drawing.ni (0x189000 bytes).
2020-06-23 06:06:40,781 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x65240000 for section view with handle 0x1c4.
2020-06-23 06:06:40,781 [root] DEBUG: DLL loaded at 0x65240000: C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\5669120680b52abf616f3876387ca2cc\System.Windows.Forms.ni (0xbdf000 bytes).
2020-06-23 06:06:40,859 [root] DEBUG: set_caller_info: Adding region at 0x00190000 to caller regions list (ntdll::memcpy).
2020-06-23 06:06:40,875 [root] DEBUG: set_caller_info: Failed to dumping calling PE image at 0x00190000.
2020-06-23 06:06:40,875 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x003D0000 for section view with handle 0x1c4.
2020-06-23 06:06:40,890 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1cc amd local view 0x00630000 to global list.
2020-06-23 06:06:40,906 [root] DEBUG: DLL loaded at 0x75310000: C:\Windows\system32\bcrypt (0x17000 bytes).
2020-06-23 06:06:41,000 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1e0 amd local view 0x688D0000 to global list.
2020-06-23 06:06:41,015 [root] DEBUG: DLL loaded at 0x688D0000: C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\4ac828c8c4c76f3ba59f8f9c7dab1cb3\Microsoft.VisualBasic.ni (0x19b000 bytes).
2020-06-23 06:06:52,140 [root] DEBUG: DLL loaded at 0x751C0000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-06-23 06:06:52,140 [root] DEBUG: DLL loaded at 0x74F50000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-06-23 06:06:52,171 [root] DEBUG: DLL loaded at 0x75790000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2020-06-23 06:06:52,187 [root] DEBUG: DLL loaded at 0x76130000: C:\Windows\system32\CLBCatQ (0x83000 bytes).
2020-06-23 06:06:52,187 [root] DEBUG: DLL loaded at 0x75CB0000: C:\Windows\system32\OLEAUT32 (0x91000 bytes).
2020-06-23 06:06:52,234 [root] DEBUG: DLL loaded at 0x6B3B0000: C:\Windows\system32\wbem\wbemdisp (0x31000 bytes).
2020-06-23 06:06:52,249 [root] DEBUG: DLL loaded at 0x6A530000: C:\Windows\system32\wbemcomn (0x5c000 bytes).
2020-06-23 06:06:52,249 [root] DEBUG: DLL loaded at 0x75D50000: C:\Windows\system32\WS2_32 (0x35000 bytes).
2020-06-23 06:06:52,265 [root] DEBUG: DLL loaded at 0x779C0000: C:\Windows\system32\NSI (0x6000 bytes).
2020-06-23 06:06:52,265 [root] INFO: Stopping WMI Service
2020-06-23 06:07:00,000 [root] INFO: Stopped WMI Service
2020-06-23 06:07:00,312 [lib.api.process] INFO: Monitor config for process 584: C:\tmp52sk_on6\dll\584.ini
2020-06-23 06:07:00,328 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp52sk_on6\dll\iTiVJiI.dll, loader C:\tmp52sk_on6\bin\rcYoEBv.exe
2020-06-23 06:07:00,343 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\auzPAOPNj.
2020-06-23 06:07:00,343 [root] DEBUG: Loader: Injecting process 584 (thread 0) with C:\tmp52sk_on6\dll\iTiVJiI.dll.
2020-06-23 06:07:00,375 [root] DEBUG: Error 0 (0x0) - GetProcessInitialThreadId: Remote PEB 0x7FFD8000 Local PEB 0x7FFDE000 Local TEB 0x7FFDF000: The operation completed successfully.
2020-06-23 06:07:00,375 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 616, handle 0xa4
2020-06-23 06:07:00,390 [root] DEBUG: Process image base: 0x00280000
2020-06-23 06:07:00,390 [root] DEBUG: InjectDllViaIAT: Not a new process, aborting IAT patch
2020-06-23 06:07:00,421 [root] DEBUG: InjectDll: IAT patching failed, falling back to thread injection.
2020-06-23 06:07:00,421 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-23 06:07:00,437 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-23 06:07:00,437 [root] INFO: Disabling sleep skipping.
2020-06-23 06:07:00,453 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 584 at 0x6ae60000, image base 0x280000, stack from 0xbc6000-0xbd0000
2020-06-23 06:07:00,453 [root] DEBUG: Commandline: C:\Windows\System32\svchost.exe -k DcomLaunch.
2020-06-23 06:07:00,484 [root] INFO: Loaded monitor into process with pid 584
2020-06-23 06:07:00,500 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-23 06:07:00,500 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-23 06:07:00,500 [root] DEBUG: Successfully injected DLL C:\tmp52sk_on6\dll\iTiVJiI.dll.
2020-06-23 06:07:02,500 [root] INFO: Starting WMI Service
2020-06-23 06:07:02,593 [root] INFO: Started WMI Service
2020-06-23 06:07:02,593 [lib.api.process] INFO: Monitor config for process 1600: C:\tmp52sk_on6\dll\1600.ini
2020-06-23 06:07:02,609 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp52sk_on6\dll\iTiVJiI.dll, loader C:\tmp52sk_on6\bin\rcYoEBv.exe
2020-06-23 06:07:02,640 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\auzPAOPNj.
2020-06-23 06:07:02,640 [root] DEBUG: Loader: Injecting process 1600 (thread 0) with C:\tmp52sk_on6\dll\iTiVJiI.dll.
2020-06-23 06:07:02,640 [root] DEBUG: Error 0 (0x0) - GetProcessInitialThreadId: Remote PEB 0x7FFDD000 Local PEB 0x7FFDF000 Local TEB 0x7FFD9000: The operation completed successfully.
2020-06-23 06:07:02,640 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-23 06:07:02,640 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed, falling back to thread injection.
2020-06-23 06:07:02,656 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-23 06:07:02,671 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-23 06:07:02,687 [root] INFO: Disabling sleep skipping.
2020-06-23 06:07:02,687 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 1600 at 0x6ae60000, image base 0x280000, stack from 0x7a6000-0x7b0000
2020-06-23 06:07:02,687 [root] DEBUG: Commandline: C:\Windows\System32\svchost.exe -k netsvcs.
2020-06-23 06:07:02,703 [root] INFO: Loaded monitor into process with pid 1600
2020-06-23 06:07:02,703 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-23 06:07:02,703 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-23 06:07:02,718 [root] DEBUG: Successfully injected DLL C:\tmp52sk_on6\dll\iTiVJiI.dll.
2020-06-23 06:07:04,718 [root] DEBUG: DLL loaded at 0x6EDB0000: C:\Windows\system32\wbem\wbemprox (0xb000 bytes).
2020-06-23 06:07:04,734 [root] DEBUG: DLL loaded at 0x6F170000: C:\Windows\system32\wbemcomn2 (0x61000 bytes).
2020-06-23 06:07:04,734 [root] DEBUG: DLL loaded at 0x6E180000: C:\Windows\system32\wbem\wmiutils (0x1a000 bytes).
2020-06-23 06:07:04,750 [root] DEBUG: DLL loaded at 0x6F1E0000: C:\Windows\system32\VSSAPI (0x116000 bytes).
2020-06-23 06:07:04,765 [root] DEBUG: DLL loaded at 0x73D30000: C:\Windows\system32\ATL (0x14000 bytes).
2020-06-23 06:07:04,765 [root] DEBUG: DLL loaded at 0x6F160000: C:\Windows\system32\VssTrace (0x10000 bytes).
2020-06-23 06:07:04,765 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1bc amd local view 0x00590000 to global list.
2020-06-23 06:07:04,781 [root] DEBUG: DLL loaded at 0x736D0000: C:\Windows\system32\samcli (0xf000 bytes).
2020-06-23 06:07:04,781 [root] DEBUG: DLL loaded at 0x742D0000: C:\Windows\system32\SAMLIB (0x12000 bytes).
2020-06-23 06:07:04,796 [root] DEBUG: DLL loaded at 0x73F20000: C:\Windows\system32\netutils (0x9000 bytes).
2020-06-23 06:07:04,828 [root] DEBUG: DLL loaded at 0x73CE0000: C:\Windows\system32\es (0x47000 bytes).
2020-06-23 06:07:04,843 [root] DEBUG: DLL loaded at 0x743C0000: C:\Windows\system32\PROPSYS (0xf5000 bytes).
2020-06-23 06:07:04,875 [root] DEBUG: DLL loaded at 0x6E6A0000: C:\Windows\system32\wbem\wbemcore (0xf1000 bytes).
2020-06-23 06:07:04,875 [root] DEBUG: DLL loaded at 0x74C70000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-06-23 06:07:04,875 [root] DEBUG: DLL loaded at 0x6E640000: C:\Windows\system32\wbem\esscli (0x4a000 bytes).
2020-06-23 06:07:04,890 [root] DEBUG: DLL loaded at 0x6EC50000: C:\Windows\system32\wbem\FastProx (0xa6000 bytes).
2020-06-23 06:07:04,890 [root] DEBUG: DLL loaded at 0x6EBF0000: C:\Windows\system32\NTDSAPI (0x18000 bytes).
2020-06-23 06:07:04,906 [root] DEBUG: DLL unloaded from 0x6E6A0000.
2020-06-23 06:07:04,906 [root] DEBUG: DLL loaded at 0x6E600000: C:\Windows\system32\wbem\wbemsvc (0xf000 bytes).
2020-06-23 06:07:04,906 [root] DEBUG: DLL loaded at 0x6E600000: C:\Windows\system32\wbem\wbemsvc (0xf000 bytes).
2020-06-23 06:07:04,921 [root] DEBUG: DLL loaded at 0x75370000: C:\Windows\system32\authZ (0x1b000 bytes).
2020-06-23 06:07:04,937 [root] DEBUG: DLL loaded at 0x6E180000: C:\Windows\system32\wbem\wmiutils (0x1a000 bytes).
2020-06-23 06:07:04,953 [root] DEBUG: DLL loaded at 0x6E0B0000: C:\Windows\system32\wbem\repdrvfs (0x47000 bytes).
2020-06-23 06:07:04,968 [root] DEBUG: DLL loaded at 0x753C0000: C:\Windows\system32\Wevtapi (0x42000 bytes).
2020-06-23 06:07:04,984 [root] DEBUG: DLL unloaded from 0x753C0000.
2020-06-23 06:07:05,390 [root] DEBUG: DLL loaded at 0x6D7F0000: C:\Windows\system32\wbem\wmiprvsd (0x91000 bytes).
2020-06-23 06:07:05,406 [root] DEBUG: DLL loaded at 0x6D790000: C:\Windows\system32\NCObjAPI (0xf000 bytes).
2020-06-23 06:07:05,437 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 584, handle 0x2c8.
2020-06-23 06:07:05,468 [root] DEBUG: DLL loaded at 0x6ED50000: C:\Windows\system32\wbem\wbemess (0x5b000 bytes).
2020-06-23 06:07:05,718 [root] DEBUG: DLL loaded at 0x6EC50000: C:\Windows\system32\wbem\fastprox (0xa6000 bytes).
2020-06-23 06:07:05,718 [root] DEBUG: DLL loaded at 0x6EBF0000: C:\Windows\system32\NTDSAPI (0x18000 bytes).
2020-06-23 06:07:05,734 [root] DEBUG: DLL loaded at 0x75700000: C:\Windows\system32\SXS (0x5f000 bytes).
2020-06-23 06:07:05,812 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x2b0 amd local view 0x006A0000 to global list.
2020-06-23 06:07:05,812 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x2a0 amd local view 0x06070000 to global list.
2020-06-23 06:07:05,953 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x73560000 for section view with handle 0x2a8.
2020-06-23 06:07:05,953 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x006F0000 for section view with handle 0x2a8.
2020-06-23 06:07:05,953 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x2bc amd local view 0x73560000 to global list.
2020-06-23 06:07:05,968 [root] DEBUG: DLL loaded at 0x73560000: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers (0x15000 bytes).
2020-06-23 06:07:05,984 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x2c0 amd local view 0x007D0000 to global list.
2020-06-23 06:07:05,984 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x007D0000 for section view with handle 0x2bc.
2020-06-23 06:07:06,000 [root] DEBUG: DLL loaded at 0x73420000: C:\Windows\system32\wbem\ncprov (0x12000 bytes).
2020-06-23 06:07:06,156 [root] DEBUG: DLL unloaded from 0x6E6A0000.
2020-06-23 06:07:06,296 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x67FF0000 for section view with handle 0x2bc.
2020-06-23 06:07:06,312 [root] DEBUG: DLL loaded at 0x67FF0000: C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\81ab4c39c6a7c9f50721aca2db09b417\System.Management.ni (0x106000 bytes).
2020-06-23 06:07:06,312 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3452.
2020-06-23 06:07:06,343 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3452.
2020-06-23 06:07:06,359 [root] DEBUG: set_caller_info: Adding region at 0x007E0000 to caller regions list (ntdll::LdrLoadDll).
2020-06-23 06:07:06,359 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x7effff
2020-06-23 06:07:06,359 [root] DEBUG: DumpMemory: Nothing to dump at 0x007E0000!
2020-06-23 06:07:06,359 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x007E0000 size 0x10000.
2020-06-23 06:07:06,375 [root] DEBUG: DumpPEsInRange: Scanning range 0x7e0000 - 0x7e1000.
2020-06-23 06:07:06,390 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x7e0000-0x7e1000.
2020-06-23 06:07:06,468 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\elXgREWCy\CAPE\3452_2913116626491123262020 (size 0xe5)
2020-06-23 06:07:06,468 [root] DEBUG: DumpRegion: Dumped stack region from 0x007E0000, size 0x1000.
2020-06-23 06:07:06,468 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x318 amd local view 0x71100000 to global list.
2020-06-23 06:07:06,500 [root] DEBUG: DLL loaded at 0x71100000: C:\Windows\Microsoft.NET\Framework\v2.0.50727\wminet_utils (0x1e000 bytes).
2020-06-23 06:07:06,500 [root] DEBUG: set_caller_info: Adding region at 0x01550000 to caller regions list (ole32::CoCreateInstance).
2020-06-23 06:07:06,515 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x155ffff
2020-06-23 06:07:06,515 [root] DEBUG: DumpMemory: Nothing to dump at 0x01550000!
2020-06-23 06:07:06,531 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x01550000 size 0x10000.
2020-06-23 06:07:06,531 [root] DEBUG: DumpPEsInRange: Scanning range 0x1550000 - 0x1554000.
2020-06-23 06:07:06,531 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x1550000-0x1554000.
2020-06-23 06:07:06,609 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\elXgREWCy\CAPE\3452_13056791046491123262020 (size 0x3a88)
2020-06-23 06:07:06,625 [root] DEBUG: DumpRegion: Dumped stack region from 0x01550000, size 0x4000.
2020-06-23 06:07:08,031 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3452.
2020-06-23 06:07:14,218 [root] INFO: Added new file to list with pid None and path C:\Users\Rebecca\AppData\Roaming\DsWhv\DsWhv.exe
2020-06-23 06:07:21,187 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3452.
2020-06-23 06:07:21,203 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x324 amd local view 0x01560000 to global list.
2020-06-23 06:07:21,218 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x31c amd local view 0x01570000 to global list.
2020-06-23 06:07:21,218 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x01560000 for section view with handle 0x31c.
2020-06-23 06:07:21,218 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x01570000 for section view with handle 0x324.
2020-06-23 06:07:29,312 [root] DEBUG: set_caller_info: Adding region at 0x02B40000 to caller regions list (kernel32::SetErrorMode).
2020-06-23 06:07:29,312 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x2b4ffff
2020-06-23 06:07:29,312 [root] DEBUG: DumpMemory: Nothing to dump at 0x02B40000!
2020-06-23 06:07:29,312 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x02B40000 size 0x10000.
2020-06-23 06:07:29,328 [root] DEBUG: DumpPEsInRange: Scanning range 0x2b40000 - 0x2b44000.
2020-06-23 06:07:29,343 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x2b40000-0x2b44000.
2020-06-23 06:07:29,437 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\elXgREWCy\CAPE\3452_6264524965921223262020 (size 0x3817)
2020-06-23 06:07:29,437 [root] DEBUG: DumpRegion: Dumped stack region from 0x02B40000, size 0x4000.
2020-06-23 06:07:29,468 [root] DEBUG: DLL loaded at 0x6F320000: C:\Windows\system32\shfolder (0x5000 bytes).
2020-06-23 06:07:29,578 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x6F310000 for section view with handle 0x324.
2020-06-23 06:07:29,578 [root] DEBUG: DLL loaded at 0x6F310000: C:\Windows\Microsoft.NET\Framework\v2.0.50727\culture (0x8000 bytes).
2020-06-23 06:07:29,593 [root] DEBUG: DLL unloaded from 0x6F310000.
2020-06-23 06:07:29,609 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x02B50000 for section view with handle 0x324.
2020-06-23 06:07:29,656 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x328 amd local view 0x64D00000 to global list.
2020-06-23 06:07:29,671 [root] DEBUG: DLL loaded at 0x64D00000: C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\b065f84b49a27b648015c08fab8cd00e\System.Xml.ni (0x53b000 bytes).
2020-06-23 06:07:29,750 [root] DEBUG: set_caller_info: Adding region at 0x02F10000 to caller regions list (ntdll::NtQueryPerformanceCounter).
2020-06-23 06:07:29,765 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x2f1ffff
2020-06-23 06:07:29,781 [root] DEBUG: DumpMemory: Nothing to dump at 0x02F10000!
2020-06-23 06:07:29,781 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x02F10000 size 0x10000.
2020-06-23 06:07:29,781 [root] DEBUG: DumpPEsInRange: Scanning range 0x2f10000 - 0x2f17000.
2020-06-23 06:07:29,781 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x2f10000-0x2f17000.
2020-06-23 06:07:29,890 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\elXgREWCy\CAPE\3452_8299353635921223262020 (size 0x682b)
2020-06-23 06:07:29,890 [root] DEBUG: DumpRegion: Dumped stack region from 0x02F10000, size 0x7000.
2020-06-23 06:07:29,906 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x01570000 for section view with handle 0x328.
2020-06-23 06:07:30,015 [root] DEBUG: DLL loaded at 0x6D5C0000: C:\Windows\system32\wshom.ocx (0x21000 bytes).
2020-06-23 06:07:30,031 [root] DEBUG: DLL loaded at 0x71E60000: C:\Windows\system32\MPR (0x12000 bytes).
2020-06-23 06:07:30,031 [root] DEBUG: DLL loaded at 0x6D590000: C:\Windows\system32\ScrRun (0x2a000 bytes).
2020-06-23 06:07:30,078 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x414 amd local view 0x00690000 to global list.
2020-06-23 06:07:30,125 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x404 amd local view 0x01590000 to global list.
2020-06-23 06:07:30,265 [root] DEBUG: set_caller_info: Adding region at 0x016D0000 to caller regions list (ntdll::NtAllocateVirtualMemory).
2020-06-23 06:07:30,281 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x16dffff
2020-06-23 06:07:30,281 [root] DEBUG: DumpMemory: Nothing to dump at 0x016D0000!
2020-06-23 06:07:30,296 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x016D0000 size 0x10000.
2020-06-23 06:07:30,296 [root] DEBUG: DumpPEsInRange: Scanning range 0x16d0000 - 0x16d2000.
2020-06-23 06:07:30,296 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x16d0000-0x16d2000.
2020-06-23 06:07:30,437 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\elXgREWCy\CAPE\3452_1135995104031223262020 (size 0x10b7)
2020-06-23 06:07:30,437 [root] DEBUG: DumpRegion: Dumped stack region from 0x016D0000, size 0x2000.
2020-06-23 06:07:30,515 [root] DEBUG: DLL loaded at 0x6F310000: C:\Windows\system32\vaultcli (0xc000 bytes).
2020-06-23 06:07:30,531 [root] DEBUG: DLL unloaded from 0x75D90000.
2020-06-23 06:07:30,640 [root] INFO: Announced starting service "b'VaultSvc'"
2020-06-23 06:07:30,640 [lib.api.process] INFO: Monitor config for process 460: C:\tmp52sk_on6\dll\460.ini
2020-06-23 06:07:30,656 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp52sk_on6\dll\iTiVJiI.dll, loader C:\tmp52sk_on6\bin\rcYoEBv.exe
2020-06-23 06:07:30,687 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\auzPAOPNj.
2020-06-23 06:07:30,703 [root] DEBUG: Loader: Injecting process 460 (thread 0) with C:\tmp52sk_on6\dll\iTiVJiI.dll.
2020-06-23 06:07:30,734 [root] DEBUG: Error 0 (0x0) - GetProcessInitialThreadId: Remote PEB 0x7FFD4000 Local PEB 0x7FFDF000 Local TEB 0x7FFDA000: The operation completed successfully.
2020-06-23 06:07:30,734 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-23 06:07:30,734 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed, falling back to thread injection.
2020-06-23 06:07:30,734 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-23 06:07:30,734 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-23 06:07:30,750 [root] INFO: Disabling sleep skipping.
2020-06-23 06:07:30,781 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 460 at 0x6ae60000, image base 0x9a0000, stack from 0xbd6000-0xbe0000
2020-06-23 06:07:30,781 [root] DEBUG: Commandline: C:\Windows\System32\services.exe.
2020-06-23 06:07:30,796 [root] INFO: Loaded monitor into process with pid 460
2020-06-23 06:07:30,796 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-23 06:07:30,812 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-23 06:07:30,812 [root] DEBUG: Successfully injected DLL C:\tmp52sk_on6\dll\iTiVJiI.dll.
2020-06-23 06:07:31,203 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3452.
2020-06-23 06:07:31,828 [root] INFO: Announced 32-bit process name: lsass.exe pid: 592
2020-06-23 06:07:31,828 [lib.api.process] INFO: Monitor config for process 592: C:\tmp52sk_on6\dll\592.ini
2020-06-23 06:07:31,843 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp52sk_on6\dll\iTiVJiI.dll, loader C:\tmp52sk_on6\bin\rcYoEBv.exe
2020-06-23 06:07:31,875 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\auzPAOPNj.
2020-06-23 06:07:31,906 [root] DEBUG: Loader: Injecting process 592 (thread 472) with C:\tmp52sk_on6\dll\iTiVJiI.dll.
2020-06-23 06:07:31,906 [root] DEBUG: Process image base: 0x00DD0000
2020-06-23 06:07:31,921 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmp52sk_on6\dll\iTiVJiI.dll.
2020-06-23 06:07:31,937 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-23 06:07:31,937 [root] DEBUG: Successfully injected DLL C:\tmp52sk_on6\dll\iTiVJiI.dll.
2020-06-23 06:07:31,968 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 592
2020-06-23 06:07:31,984 [root] DEBUG: CreateProcessHandler: using lpCommandLine: C:\Windows\system32\lsass.exe.
2020-06-23 06:07:32,000 [root] DEBUG: CreateProcessHandler: Injection info set for new process 592, ImageBase: 0x00DD0000
2020-06-23 06:07:32,015 [root] INFO: Announced 32-bit process name: lsass.exe pid: 592
2020-06-23 06:07:32,015 [lib.api.process] INFO: Monitor config for process 592: C:\tmp52sk_on6\dll\592.ini
2020-06-23 06:07:32,046 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp52sk_on6\dll\iTiVJiI.dll, loader C:\tmp52sk_on6\bin\rcYoEBv.exe
2020-06-23 06:07:32,093 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\auzPAOPNj.
2020-06-23 06:07:32,093 [root] DEBUG: Loader: Injecting process 592 (thread 472) with C:\tmp52sk_on6\dll\iTiVJiI.dll.
2020-06-23 06:07:32,109 [root] DEBUG: Process image base: 0x00DD0000
2020-06-23 06:07:32,125 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmp52sk_on6\dll\iTiVJiI.dll.
2020-06-23 06:07:32,140 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-06-23 06:07:32,140 [root] DEBUG: Successfully injected DLL C:\tmp52sk_on6\dll\iTiVJiI.dll.
2020-06-23 06:07:32,140 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 592
2020-06-23 06:07:32,171 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 592.
2020-06-23 06:07:32,171 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-23 06:07:32,203 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-23 06:07:32,203 [root] INFO: Disabling sleep skipping.
2020-06-23 06:07:32,218 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-06-23 06:07:32,218 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 592 at 0x6ae60000, image base 0xdd0000, stack from 0xa6000-0xb0000
2020-06-23 06:07:32,218 [root] DEBUG: Commandline: C:\Windows\System32\lsass.exe.
2020-06-23 06:07:32,234 [root] INFO: Loaded monitor into process with pid 592
2020-06-23 06:07:34,921 [root] DEBUG: DLL unloaded from 0x762F0000.
2020-06-23 06:08:02,187 [root] INFO: Process with pid 592 has terminated
2020-06-23 06:09:47,296 [root] INFO: Analysis timeout hit, terminating analysis.
2020-06-23 06:09:47,296 [lib.api.process] ERROR: Failed to open terminate event for pid 5204
2020-06-23 06:09:47,296 [root] INFO: Terminate event set for process 5204.
2020-06-23 06:09:47,296 [lib.api.process] INFO: Terminate event set for process 3452
2020-06-23 06:09:52,296 [lib.api.process] INFO: Termination confirmed for process 3452
2020-06-23 06:09:52,296 [root] INFO: Terminate event set for process 3452.
2020-06-23 06:09:52,296 [lib.api.process] INFO: Terminate event set for process 584
2020-06-23 06:09:52,984 [root] DEBUG: Terminate Event: Attempting to dump process 3452
2020-06-23 06:09:53,000 [lib.api.process] INFO: Termination confirmed for process 584
2020-06-23 06:09:53,000 [root] INFO: Terminate event set for process 584.
2020-06-23 06:09:53,000 [lib.api.process] INFO: Terminate event set for process 1600
2020-06-23 06:09:53,078 [lib.api.process] INFO: Termination confirmed for process 1600
2020-06-23 06:09:53,078 [root] INFO: Terminate event set for process 1600.
2020-06-23 06:09:53,078 [lib.api.process] INFO: Terminate event set for process 460
2020-06-23 06:09:53,218 [root] DEBUG: Terminate Event: Attempting to dump process 460
2020-06-23 06:09:58,078 [lib.api.process] INFO: Termination confirmed for process 460
2020-06-23 06:09:58,078 [root] INFO: Terminate event set for process 460.
2020-06-23 06:09:58,078 [root] INFO: Created shutdown mutex.
2020-06-23 06:09:58,984 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x009A0000.
2020-06-23 06:09:59,078 [root] INFO: Shutting down package.
2020-06-23 06:09:59,078 [root] INFO: Stopping auxiliary modules.
2020-06-23 06:09:59,078 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-06-23 06:10:04,984 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x009A0000.
2020-06-23 06:10:25,015 [lib.common.results] WARNING: File C:\elXgREWCy\bin\procmon.xml doesn't exist anymore
2020-06-23 06:10:25,015 [root] INFO: Finishing auxiliary modules.
2020-06-23 06:10:25,015 [root] INFO: Shutting down pipe server and dumping dropped files.
2020-06-23 06:10:26,062 [root] WARNING: Folder at path "C:\elXgREWCy\debugger" does not exist, skip.
2020-06-23 06:10:26,078 [root] INFO: Analysis completed.

Machine

Name Label Manager Started On Shutdown On
win7_3 win7_3 KVM 2020-06-23 06:06:24 2020-06-23 06:11:57

File Details

File Name MV JIA YU SHAN.exe
File Size 647680 bytes
File Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
PE timestamp 2020-06-23 04:12:29
MD5 925cba90f4d807751f01b7fa44d67af1
SHA1 bb1d25fd09e913b2df365601ad9a15cdc9ae7955
SHA256 61f5d152caf6b824cc52b2f674caaa87d14163fff7af6186f7a380a451d244ec
SHA512 9483ca6acf9696d406dfea128c77e15506ca1bea1e10f3eddefc3e55b4fb58787f2f8d9cb8926df188b33d864ef8a61d4f71262db907507f2be01ae6db79afd0
CRC32 8B995630
Ssdeep 12288:4BDpei9FlYd2di6BaPAl3IIcMbnATVs+M6qZNfYzIxNh8k757:4BDpNFlYdWFBaPEIIcMbn6VtMFMzIrWw
Download Download ZIP Resubmit sample

Signatures

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction - unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Hit: PID 5204 trigged the Yara rule 'AgentTeslaV2'
Hit: PID 5204 trigged the Yara rule 'embedded_win_api'
Hit: PID 5204 trigged the Yara rule 'embedded_pe'
Creates RWX memory
Guard pages use detected - possible anti-debugging.
A process attempted to delay the analysis task.
Process: MV JIA YU SHAN.exe tried to sleep 876.5 seconds, actually delayed analysis time by 0.0 seconds
Dynamic (imported) function loading detected
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionEx
DynamicLoader: KERNEL32.dll/CreateEventExW
DynamicLoader: KERNEL32.dll/CreateSemaphoreExW
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/CreateThreadpoolTimer
DynamicLoader: KERNEL32.dll/SetThreadpoolTimer
DynamicLoader: KERNEL32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: KERNEL32.dll/CloseThreadpoolTimer
DynamicLoader: KERNEL32.dll/CreateThreadpoolWait
DynamicLoader: KERNEL32.dll/SetThreadpoolWait
DynamicLoader: KERNEL32.dll/CloseThreadpoolWait
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: KERNEL32.dll/GetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/GetLogicalProcessorInformation
DynamicLoader: KERNEL32.dll/CreateSymbolicLinkW
DynamicLoader: KERNEL32.dll/SetDefaultDllDirectories
DynamicLoader: KERNEL32.dll/EnumSystemLocalesEx
DynamicLoader: KERNEL32.dll/CompareStringEx
DynamicLoader: KERNEL32.dll/GetDateFormatEx
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/GetTimeFormatEx
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/IsValidLocaleName
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/GetCurrentPackageId
DynamicLoader: KERNEL32.dll/GetTickCount64
DynamicLoader: KERNEL32.dll/GetFileInformationByHandleExW
DynamicLoader: KERNEL32.dll/SetFileInformationByHandleW
DynamicLoader: KERNEL32.dll/AcquireSRWLockExclusive
DynamicLoader: KERNEL32.dll/ReleaseSRWLockExclusive
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: MSCOREE.DLL/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/_CorExeMain_RetAddr
DynamicLoader: mscoreei.dll/_CorExeMain
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: VERSION.dll/GetFileVersionInfoSizeW
DynamicLoader: VERSION.dll/GetFileVersionInfoW
DynamicLoader: VERSION.dll/VerQueryValueW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionAndSpinCount
DynamicLoader: KERNEL32.dll/IsProcessorFeaturePresent
DynamicLoader: msvcrt.dll/_set_error_mode
DynamicLoader: msvcrt.dll/[email protected]@[email protected]
DynamicLoader: msvcrt.dll/_get_terminate
DynamicLoader: KERNEL32.dll/FindActCtxSectionStringW
DynamicLoader: KERNEL32.dll/GetSystemWindowsDirectoryW
DynamicLoader: MSCOREE.DLL/GetProcessExecutableHeap
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap_RetAddr
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap
DynamicLoader: mscorwks.dll/SetLoadedByMscoree
DynamicLoader: USER32.dll/GetProcessWindowStation
DynamicLoader: USER32.dll/GetUserObjectInformationW
DynamicLoader: mscorwks.dll/_CorExeMain
DynamicLoader: mscorwks.dll/GetCLRFunction
DynamicLoader: ADVAPI32.dll/RegisterTraceGuidsW
DynamicLoader: ADVAPI32.dll/UnregisterTraceGuids
DynamicLoader: ADVAPI32.dll/GetTraceLoggerHandle
DynamicLoader: ADVAPI32.dll/GetTraceEnableLevel
DynamicLoader: ADVAPI32.dll/GetTraceEnableFlags
DynamicLoader: ADVAPI32.dll/TraceEvent
DynamicLoader: MSCOREE.DLL/IEE
DynamicLoader: mscoreei.dll/IEE_RetAddr
DynamicLoader: mscoreei.dll/IEE
DynamicLoader: mscorwks.dll/IEE
DynamicLoader: MSCOREE.DLL/GetStartupFlags
DynamicLoader: mscoreei.dll/GetStartupFlags_RetAddr
DynamicLoader: mscoreei.dll/GetStartupFlags
DynamicLoader: MSCOREE.DLL/GetHostConfigurationFile
DynamicLoader: mscoreei.dll/GetHostConfigurationFile_RetAddr
DynamicLoader: mscoreei.dll/GetHostConfigurationFile
DynamicLoader: mscoreei.dll/GetCORVersion_RetAddr
DynamicLoader: mscoreei.dll/GetCORVersion
DynamicLoader: MSCOREE.DLL/GetCORSystemDirectory
DynamicLoader: mscoreei.dll/GetCORSystemDirectory_RetAddr
DynamicLoader: mscoreei.dll/CreateConfigStream_RetAddr
DynamicLoader: mscoreei.dll/CreateConfigStream
DynamicLoader: ntdll.dll/RtlUnwind
DynamicLoader: KERNEL32.dll/IsWow64Process
DynamicLoader: KERNEL32.dll/GetSystemWindowsDirectoryW
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/AddVectoredContinueHandler
DynamicLoader: KERNEL32.dll/RemoveVectoredContinueHandler
DynamicLoader: ADVAPI32.dll/ConvertSidToStringSidW
DynamicLoader: shell32.dll/SHGetFolderPathW
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/GetWriteWatch
DynamicLoader: KERNEL32.dll/ResetWriteWatch
DynamicLoader: KERNEL32.dll/CreateMemoryResourceNotification
DynamicLoader: KERNEL32.dll/QueryMemoryResourceNotification
DynamicLoader: KERNEL32.dll/QueryActCtxW
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: ole32.dll/CoGetContextToken
DynamicLoader: KERNEL32.dll/GetFullPathName
DynamicLoader: KERNEL32.dll/GetFullPathNameW
DynamicLoader: KERNEL32.dll/GetVersionEx
DynamicLoader: KERNEL32.dll/GetVersionExW
DynamicLoader: KERNEL32.dll/GetVersionEx
DynamicLoader: KERNEL32.dll/GetVersionExW
DynamicLoader: ADVAPI32.dll/CryptAcquireContextA
DynamicLoader: ADVAPI32.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/CryptCreateHash
DynamicLoader: ADVAPI32.dll/CryptDestroyHash
DynamicLoader: ADVAPI32.dll/CryptHashData
DynamicLoader: ADVAPI32.dll/CryptGetHashParam
DynamicLoader: ADVAPI32.dll/CryptImportKey
DynamicLoader: ADVAPI32.dll/CryptExportKey
DynamicLoader: ADVAPI32.dll/CryptGenKey
DynamicLoader: ADVAPI32.dll/CryptGetKeyParam
DynamicLoader: ADVAPI32.dll/CryptDestroyKey
DynamicLoader: ADVAPI32.dll/CryptVerifySignatureA
DynamicLoader: ADVAPI32.dll/CryptSignHashA
DynamicLoader: ADVAPI32.dll/CryptGetProvParam
DynamicLoader: ADVAPI32.dll/CryptGetUserKey
DynamicLoader: ADVAPI32.dll/CryptEnumProvidersA
DynamicLoader: MSCOREE.DLL/GetMetaDataInternalInterface
DynamicLoader: mscoreei.dll/GetMetaDataInternalInterface_RetAddr
DynamicLoader: mscoreei.dll/GetMetaDataInternalInterface
DynamicLoader: mscorwks.dll/GetMetaDataInternalInterface
DynamicLoader: mscorjit.dll/getJit
DynamicLoader: KERNEL32.dll/IsWow64Process
DynamicLoader: KERNEL32.dll/GetUserDefaultUILanguage
DynamicLoader: KERNEL32.dll/SetErrorMode
DynamicLoader: KERNEL32.dll/GetFileAttributesEx
DynamicLoader: KERNEL32.dll/GetFileAttributesExW
DynamicLoader: mscoreei.dll/LoadLibraryShim_RetAddr
DynamicLoader: mscoreei.dll/LoadLibraryShim
DynamicLoader: culture.dll/ConvertLangIdToCultureName
DynamicLoader: KERNEL32.dll/GetCurrentProcessId
DynamicLoader: KERNEL32.dll/GetCurrentProcessIdW
DynamicLoader: KERNEL32.dll/FindAtom
DynamicLoader: KERNEL32.dll/FindAtomW
DynamicLoader: KERNEL32.dll/AddAtom
DynamicLoader: KERNEL32.dll/AddAtomW
DynamicLoader: MSCOREE.DLL/LoadLibraryShim
DynamicLoader: gdiplus.dll/GdiplusStartup
DynamicLoader: KERNEL32.dll/IsProcessorFeaturePresent
DynamicLoader: USER32.dll/GetWindowInfo
DynamicLoader: USER32.dll/GetAncestor
DynamicLoader: USER32.dll/GetMonitorInfoA
DynamicLoader: USER32.dll/EnumDisplayMonitors
DynamicLoader: USER32.dll/EnumDisplayDevicesA
DynamicLoader: GDI32.dll/ExtTextOutW
DynamicLoader: GDI32.dll/GdiIsMetaPrintDC
DynamicLoader: gdiplus.dll/GdipLoadImageFromStream
DynamicLoader: WindowsCodecs.dll/DllGetClassObject
DynamicLoader: gdiplus.dll/GdipImageForceValidation
DynamicLoader: gdiplus.dll/GdipGetImageType
DynamicLoader: gdiplus.dll/GdipGetImageRawFormat
DynamicLoader: gdiplus.dll/GdipGetImageWidth
DynamicLoader: gdiplus.dll/GdipGetImageHeight
DynamicLoader: gdiplus.dll/GdipBitmapGetPixel
DynamicLoader: KERNEL32.dll/GlobalMemoryStatusEx
DynamicLoader: gdiplus.dll/GdipDisposeImage
DynamicLoader: KERNEL32.dll/OpenMutex
DynamicLoader: KERNEL32.dll/OpenMutexW
DynamicLoader: KERNEL32.dll/CloseHandle
DynamicLoader: KERNEL32.dll/ReleaseMutex
DynamicLoader: KERNEL32.dll/CreateMutex
DynamicLoader: KERNEL32.dll/CreateMutexW
DynamicLoader: KERNEL32.dll/CreateProcess
DynamicLoader: KERNEL32.dll/CreateProcessW
DynamicLoader: KERNEL32.dll/GetThreadContext
DynamicLoader: KERNEL32.dll/ReadProcessMemory
DynamicLoader: KERNEL32.dll/VirtualAllocEx
DynamicLoader: KERNEL32.dll/WriteProcessMemory
DynamicLoader: KERNEL32.dll/SetThreadContext
DynamicLoader: KERNEL32.dll/ResumeThread
DynamicLoader: KERNEL32.dll/DeleteAtom
DynamicLoader: KERNEL32.dll/DeleteAtomW
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: KERNEL32.dll/CreateActCtxW
DynamicLoader: KERNEL32.dll/AddRefActCtx
DynamicLoader: KERNEL32.dll/ReleaseActCtx
DynamicLoader: KERNEL32.dll/ActivateActCtx
DynamicLoader: KERNEL32.dll/DeactivateActCtx
DynamicLoader: KERNEL32.dll/GetCurrentActCtx
DynamicLoader: KERNEL32.dll/QueryActCtxW
DynamicLoader: ADVAPI32.dll/EventUnregister
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionEx
DynamicLoader: KERNEL32.dll/CreateEventExW
DynamicLoader: KERNEL32.dll/CreateSemaphoreExW
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/CreateThreadpoolTimer
DynamicLoader: KERNEL32.dll/SetThreadpoolTimer
DynamicLoader: KERNEL32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: KERNEL32.dll/CloseThreadpoolTimer
DynamicLoader: KERNEL32.dll/CreateThreadpoolWait
DynamicLoader: KERNEL32.dll/SetThreadpoolWait
DynamicLoader: KERNEL32.dll/CloseThreadpoolWait
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: KERNEL32.dll/GetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/GetLogicalProcessorInformation
DynamicLoader: KERNEL32.dll/CreateSymbolicLinkW
DynamicLoader: KERNEL32.dll/SetDefaultDllDirectories
DynamicLoader: KERNEL32.dll/EnumSystemLocalesEx
DynamicLoader: KERNEL32.dll/CompareStringEx
DynamicLoader: KERNEL32.dll/GetDateFormatEx
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/GetTimeFormatEx
DynamicLoader: KERNEL32.dll/GetUserDefaultLocaleName
DynamicLoader: KERNEL32.dll/IsValidLocaleName
DynamicLoader: KERNEL32.dll/LCMapStringEx
DynamicLoader: KERNEL32.dll/GetCurrentPackageId
DynamicLoader: KERNEL32.dll/GetTickCount64
DynamicLoader: KERNEL32.dll/GetFileInformationByHandleExW
DynamicLoader: KERNEL32.dll/SetFileInformationByHandleW
DynamicLoader: KERNEL32.dll/AcquireSRWLockExclusive
DynamicLoader: KERNEL32.dll/ReleaseSRWLockExclusive
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: ADVAPI32.dll/EventSetInformation
DynamicLoader: MSCOREE.DLL/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/_CorExeMain_RetAddr
DynamicLoader: mscoreei.dll/_CorExeMain
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: VERSION.dll/GetFileVersionInfoSizeW
DynamicLoader: VERSION.dll/GetFileVersionInfoW
DynamicLoader: VERSION.dll/VerQueryValueW
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/InitializeCriticalSectionAndSpinCount
DynamicLoader: KERNEL32.dll/IsProcessorFeaturePresent
DynamicLoader: msvcrt.dll/_set_error_mode
DynamicLoader: msvcrt.dll/[email protected]@[email protected]
DynamicLoader: msvcrt.dll/_get_terminate
DynamicLoader: KERNEL32.dll/FindActCtxSectionStringW
DynamicLoader: KERNEL32.dll/GetSystemWindowsDirectoryW
DynamicLoader: MSCOREE.DLL/GetProcessExecutableHeap
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap_RetAddr
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap
DynamicLoader: mscorwks.dll/SetLoadedByMscoree
DynamicLoader: USER32.dll/GetProcessWindowStation
DynamicLoader: USER32.dll/GetUserObjectInformationW
DynamicLoader: mscorwks.dll/_CorExeMain
DynamicLoader: mscorwks.dll/GetCLRFunction
DynamicLoader: ADVAPI32.dll/RegisterTraceGuidsW
DynamicLoader: ADVAPI32.dll/UnregisterTraceGuids
DynamicLoader: ADVAPI32.dll/GetTraceLoggerHandle
DynamicLoader: ADVAPI32.dll/GetTraceEnableLevel
DynamicLoader: ADVAPI32.dll/GetTraceEnableFlags
DynamicLoader: ADVAPI32.dll/TraceEvent
DynamicLoader: MSCOREE.DLL/IEE
DynamicLoader: mscoreei.dll/IEE_RetAddr
DynamicLoader: mscoreei.dll/IEE
DynamicLoader: mscorwks.dll/IEE
DynamicLoader: MSCOREE.DLL/GetStartupFlags
DynamicLoader: mscoreei.dll/GetStartupFlags_RetAddr
DynamicLoader: mscoreei.dll/GetStartupFlags
DynamicLoader: MSCOREE.DLL/GetHostConfigurationFile
DynamicLoader: mscoreei.dll/GetHostConfigurationFile_RetAddr
DynamicLoader: mscoreei.dll/GetHostConfigurationFile
DynamicLoader: mscoreei.dll/GetCORVersion_RetAddr
DynamicLoader: mscoreei.dll/GetCORVersion
DynamicLoader: MSCOREE.DLL/GetCORSystemDirectory
DynamicLoader: mscoreei.dll/GetCORSystemDirectory_RetAddr
DynamicLoader: mscoreei.dll/CreateConfigStream_RetAddr
DynamicLoader: mscoreei.dll/CreateConfigStream
DynamicLoader: ntdll.dll/RtlUnwind
DynamicLoader: KERNEL32.dll/IsWow64Process
DynamicLoader: KERNEL32.dll/GetSystemWindowsDirectoryW
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: KERNEL32.dll/SetThreadStackGuarantee
DynamicLoader: KERNEL32.dll/FlsSetValue
DynamicLoader: KERNEL32.dll/FlsGetValue
DynamicLoader: KERNEL32.dll/FlsAlloc
DynamicLoader: KERNEL32.dll/FlsFree
DynamicLoader: KERNEL32.dll/AddVectoredContinueHandler
DynamicLoader: KERNEL32.dll/RemoveVectoredContinueHandler
DynamicLoader: ADVAPI32.dll/ConvertSidToStringSidW
DynamicLoader: shell32.dll/SHGetFolderPathW
DynamicLoader: KERNEL32.dll/FlushProcessWriteBuffers
DynamicLoader: KERNEL32.dll/GetWriteWatch
DynamicLoader: KERNEL32.dll/ResetWriteWatch
DynamicLoader: KERNEL32.dll/CreateMemoryResourceNotification
DynamicLoader: KERNEL32.dll/QueryMemoryResourceNotification
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: KERNEL32.dll/QueryActCtxW
DynamicLoader: KERNEL32.dll/GetFullPathName
DynamicLoader: KERNEL32.dll/GetFullPathNameW
DynamicLoader: KERNEL32.dll/GetVersionEx
DynamicLoader: KERNEL32.dll/GetVersionExW
DynamicLoader: KERNEL32.dll/GetVersionEx
DynamicLoader: KERNEL32.dll/GetVersionExW
DynamicLoader: ole32.dll/CoGetContextToken
DynamicLoader: ADVAPI32.dll/CryptAcquireContextA
DynamicLoader: ADVAPI32.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/CryptCreateHash
DynamicLoader: ADVAPI32.dll/CryptDestroyHash
DynamicLoader: ADVAPI32.dll/CryptHashData
DynamicLoader: ADVAPI32.dll/CryptGetHashParam
DynamicLoader: ADVAPI32.dll/CryptImportKey
DynamicLoader: ADVAPI32.dll/CryptExportKey
DynamicLoader: ADVAPI32.dll/CryptGenKey
DynamicLoader: ADVAPI32.dll/CryptGetKeyParam
DynamicLoader: ADVAPI32.dll/CryptDestroyKey
DynamicLoader: ADVAPI32.dll/CryptVerifySignatureA
DynamicLoader: ADVAPI32.dll/CryptSignHashA
DynamicLoader: ADVAPI32.dll/CryptGetProvParam
DynamicLoader: ADVAPI32.dll/CryptGetUserKey
DynamicLoader: ADVAPI32.dll/CryptEnumProvidersA
DynamicLoader: MSCOREE.DLL/GetMetaDataInternalInterface
DynamicLoader: mscoreei.dll/GetMetaDataInternalInterface_RetAddr
DynamicLoader: mscoreei.dll/GetMetaDataInternalInterface
DynamicLoader: mscorwks.dll/GetMetaDataInternalInterface
DynamicLoader: mscorjit.dll/getJit
DynamicLoader: KERNEL32.dll/IsWow64Process
DynamicLoader: KERNEL32.dll/GetUserDefaultUILanguage
DynamicLoader: KERNEL32.dll/SetErrorMode
DynamicLoader: KERNEL32.dll/GetFileAttributesEx
DynamicLoader: KERNEL32.dll/GetFileAttributesExW
DynamicLoader: bcrypt.dll/BCryptGetFipsAlgorithmMode
DynamicLoader: KERNEL32.dll/lstrlen
DynamicLoader: KERNEL32.dll/lstrlenW
DynamicLoader: KERNEL32.dll/GetModuleHandle
DynamicLoader: KERNEL32.dll/GetModuleHandleW
DynamicLoader: KERNEL32.dll/GetProcAddress
DynamicLoader: USER32.dll/DefWindowProcW
DynamicLoader: GDI32.dll/GetStockObject
DynamicLoader: USER32.dll/RegisterClass
DynamicLoader: USER32.dll/RegisterClassW
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: USER32.dll/CreateWindowEx
DynamicLoader: USER32.dll/CreateWindowExW
DynamicLoader: USER32.dll/SetWindowLong
DynamicLoader: USER32.dll/SetWindowLongW
DynamicLoader: USER32.dll/GetWindowLong
DynamicLoader: USER32.dll/GetWindowLongW
DynamicLoader: KERNEL32.dll/GetCurrentProcess
DynamicLoader: KERNEL32.dll/GetCurrentThread
DynamicLoader: KERNEL32.dll/DuplicateHandle
DynamicLoader: KERNEL32.dll/GetCurrentThreadId
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegOpenKeyEx
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueEx
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: USER32.dll/SetWindowLong
DynamicLoader: USER32.dll/SetWindowLongW
DynamicLoader: USER32.dll/CallWindowProc
DynamicLoader: USER32.dll/CallWindowProcW
DynamicLoader: USER32.dll/RegisterWindowMessage
DynamicLoader: USER32.dll/RegisterWindowMessageW
DynamicLoader: KERNEL32.dll/CloseHandle
DynamicLoader: KERNEL32.dll/GetCurrentProcessId
DynamicLoader: KERNEL32.dll/GetCurrentProcessIdW
DynamicLoader: ADVAPI32.dll/LookupPrivilegeValue
DynamicLoader: ADVAPI32.dll/LookupPrivilegeValueW
DynamicLoader: KERNEL32.dll/GetCurrentProcess
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/OpenProcessTokenW
DynamicLoader: ADVAPI32.dll/AdjustTokenPrivileges
DynamicLoader: ADVAPI32.dll/AdjustTokenPrivilegesW
DynamicLoader: KERNEL32.dll/CloseHandle
DynamicLoader: ntdll.dll/NtQuerySystemInformation
DynamicLoader: ntdll.dll/NtQuerySystemInformationW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptCreateHash
DynamicLoader: ole32.dll/CreateBindCtx
DynamicLoader: ole32.dll/CoGetObjectContext
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: ole32.dll/NdrOleInitializeExtension
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: RpcRtRemote.dll/I_RpcExtInitializeExtensionPoint
DynamicLoader: ole32.dll/MkParseDisplayName
DynamicLoader: KERNEL32.dll/GetThreadPreferredUILanguages
DynamicLoader: KERNEL32.dll/SetThreadPreferredUILanguages
DynamicLoader: KERNEL32.dll/LocaleNameToLCID
DynamicLoader: KERNEL32.dll/GetLocaleInfoEx
DynamicLoader: KERNEL32.dll/LCIDToLocaleName
DynamicLoader: KERNEL32.dll/GetSystemDefaultLocaleName
DynamicLoader: fastprox.dll/DllGetClassObject
DynamicLoader: fastprox.dll/DllCanUnloadNow
DynamicLoader: ole32.dll/BindMoniker
DynamicLoader: SXS.DLL/SxsOleAut32RedirectTypeLibrary
DynamicLoader: ADVAPI32.dll/RegOpenKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyW
DynamicLoader: ADVAPI32.dll/RegQueryValueW
DynamicLoader: SXS.DLL/SxsOleAut32MapConfiguredClsidToReferenceClsid
DynamicLoader: SXS.DLL/SxsLookupClrGuid
DynamicLoader: KERNEL32.dll/ReleaseActCtx
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: mscoreei.dll/_CorDllMain_RetAddr
DynamicLoader: mscoreei.dll/_CorDllMain
DynamicLoader: MSCOREE.DLL/GetTokenForVTableEntry
DynamicLoader: MSCOREE.DLL/SetTargetForVTableEntry
DynamicLoader: MSCOREE.DLL/GetTargetForVTableEntry
DynamicLoader: mscoreei.dll/GetTokenForVTableEntry_RetAddr
DynamicLoader: mscoreei.dll/GetTokenForVTableEntry
DynamicLoader: mscoreei.dll/SetTargetForVTableEntry_RetAddr
DynamicLoader: mscoreei.dll/SetTargetForVTableEntry
DynamicLoader: mscoreei.dll/GetTargetForVTableEntry_RetAddr
DynamicLoader: mscoreei.dll/GetTargetForVTableEntry
DynamicLoader: KERNEL32.dll/GetLastError
DynamicLoader: KERNEL32.dll/LocalAlloc
DynamicLoader: OLEAUT32.dll/VariantInit
DynamicLoader: OLEAUT32.dll/VariantClear
DynamicLoader: KERNEL32.dll/CreateEvent
DynamicLoader: KERNEL32.dll/CreateEventW
DynamicLoader: KERNEL32.dll/SwitchToThread
DynamicLoader: KERNEL32.dll/SetEvent
DynamicLoader: ole32.dll/CoWaitForMultipleHandles
DynamicLoader: ole32.dll/IIDFromString
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: KERNEL32.dll/LoadLibrary
DynamicLoader: KERNEL32.dll/LoadLibraryA
DynamicLoader: KERNEL32.dll/GetProcAddress
DynamicLoader: wminet_utils.dll/ResetSecurity
DynamicLoader: wminet_utils.dll/SetSecurity
DynamicLoader: wminet_utils.dll/BlessIWbemServices
DynamicLoader: wminet_utils.dll/BlessIWbemServicesObject
DynamicLoader: wminet_utils.dll/GetPropertyHandle
DynamicLoader: wminet_utils.dll/WritePropertyValue
DynamicLoader: wminet_utils.dll/Clone
DynamicLoader: wminet_utils.dll/VerifyClientKey
DynamicLoader: wminet_utils.dll/GetQualifierSet
DynamicLoader: wminet_utils.dll/Get
DynamicLoader: wminet_utils.dll/Put
DynamicLoader: wminet_utils.dll/Delete
DynamicLoader: wminet_utils.dll/GetNames
DynamicLoader: wminet_utils.dll/BeginEnumeration
DynamicLoader: wminet_utils.dll/Next
DynamicLoader: wminet_utils.dll/EndEnumeration
DynamicLoader: wminet_utils.dll/GetPropertyQualifierSet
DynamicLoader: wminet_utils.dll/Clone
DynamicLoader: wminet_utils.dll/GetObjectText
DynamicLoader: wminet_utils.dll/SpawnDerivedClass
DynamicLoader: wminet_utils.dll/SpawnInstance
DynamicLoader: wminet_utils.dll/CompareTo
DynamicLoader: wminet_utils.dll/GetPropertyOrigin
DynamicLoader: wminet_utils.dll/InheritsFrom
DynamicLoader: wminet_utils.dll/GetMethod
DynamicLoader: wminet_utils.dll/PutMethod
DynamicLoader: wminet_utils.dll/DeleteMethod
DynamicLoader: wminet_utils.dll/BeginMethodEnumeration
DynamicLoader: wminet_utils.dll/NextMethod
DynamicLoader: wminet_utils.dll/EndMethodEnumeration
DynamicLoader: wminet_utils.dll/GetMethodQualifierSet
DynamicLoader: wminet_utils.dll/GetMethodOrigin
DynamicLoader: wminet_utils.dll/QualifierSet_Get
DynamicLoader: wminet_utils.dll/QualifierSet_Put
DynamicLoader: wminet_utils.dll/QualifierSet_Delete
DynamicLoader: wminet_utils.dll/QualifierSet_GetNames
DynamicLoader: wminet_utils.dll/QualifierSet_BeginEnumeration
DynamicLoader: wminet_utils.dll/QualifierSet_Next
DynamicLoader: wminet_utils.dll/QualifierSet_EndEnumeration
DynamicLoader: wminet_utils.dll/GetCurrentApartmentType
DynamicLoader: wminet_utils.dll/GetDemultiplexedStub
DynamicLoader: wminet_utils.dll/CreateInstanceEnumWmi
DynamicLoader: wminet_utils.dll/CreateClassEnumWmi
DynamicLoader: wminet_utils.dll/ExecQueryWmi
DynamicLoader: wminet_utils.dll/ExecNotificationQueryWmi
DynamicLoader: wminet_utils.dll/PutInstanceWmi
DynamicLoader: wminet_utils.dll/PutClassWmi
DynamicLoader: wminet_utils.dll/CloneEnumWbemClassObject
DynamicLoader: wminet_utils.dll/ConnectServerWmi
DynamicLoader: wminet_utils.dll/GetErrorInfo
DynamicLoader: wminet_utils.dll/Initialize
DynamicLoader: OLEAUT32.dll/SysStringLen
DynamicLoader: KERNEL32.dll/ZeroMemory
DynamicLoader: KERNEL32.dll/ZeroMemoryA
DynamicLoader: KERNEL32.dll/RtlZeroMemory
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: KERNEL32.dll/RegOpenKeyExW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: CRYPTSP.dll/CryptHashData
DynamicLoader: CRYPTSP.dll/CryptGetHashParam
DynamicLoader: CRYPTSP.dll/CryptDestroyHash
DynamicLoader: KERNEL32.dll/GetEnvironmentVariable
DynamicLoader: KERNEL32.dll/GetEnvironmentVariableW
DynamicLoader: ADVAPI32.dll/GetUserName
DynamicLoader: ADVAPI32.dll/GetUserNameW
DynamicLoader: KERNEL32.dll/GetComputerName
DynamicLoader: KERNEL32.dll/GetComputerNameW
DynamicLoader: KERNEL32.dll/CreateIoCompletionPort
DynamicLoader: KERNEL32.dll/PostQueuedCompletionStatus
DynamicLoader: ntdll.dll/NtQueryInformationThread
DynamicLoader: ntdll.dll/NtQuerySystemInformation
DynamicLoader: ntdll.dll/NtGetCurrentProcessorNumber
DynamicLoader: KERNEL32.dll/CreateDirectory
DynamicLoader: KERNEL32.dll/CreateDirectoryW
DynamicLoader: KERNEL32.dll/CopyFile
DynamicLoader: KERNEL32.dll/CopyFileW
DynamicLoader: ADVAPI32.dll/RegSetValueEx
DynamicLoader: ADVAPI32.dll/RegSetValueExW
DynamicLoader: KERNEL32.dll/DeleteFile
DynamicLoader: KERNEL32.dll/DeleteFileW
DynamicLoader: KERNEL32.dll/GetSystemTimeAsFileTime
DynamicLoader: USER32.dll/GetLastInputInfo
DynamicLoader: shfolder.dll/SHGetFolderPath
DynamicLoader: shfolder.dll/SHGetFolderPathW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: KERNEL32.dll/CreateFile
DynamicLoader: KERNEL32.dll/CreateFileW
DynamicLoader: mscoreei.dll/LoadLibraryShim_RetAddr
DynamicLoader: mscoreei.dll/LoadLibraryShim
DynamicLoader: culture.dll/ConvertLangIdToCultureName
DynamicLoader: KERNEL32.dll/GetFileType
DynamicLoader: KERNEL32.dll/ReadFile
DynamicLoader: KERNEL32.dll/GetFileSize
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: KERNEL32.dll/GetACP
DynamicLoader: KERNEL32.dll/UnmapViewOfFile
DynamicLoader: ole32.dll/CLSIDFromProgIDEx
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: KERNEL32.dll/FindFirstFile
DynamicLoader: KERNEL32.dll/FindFirstFileW
DynamicLoader: KERNEL32.dll/FindClose
DynamicLoader: KERNEL32.dll/FindNextFile
DynamicLoader: KERNEL32.dll/FindNextFileW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: vaultcli.dll/VaultEnumerateVaults
DynamicLoader: OLEAUT32.dll/
DynamicLoader: USER32.dll/GetSystemMetrics
DynamicLoader: USER32.dll/GetClientRect
DynamicLoader: USER32.dll/GetWindowRect
DynamicLoader: USER32.dll/GetParent
DynamicLoader: ole32.dll/OleInitialize
DynamicLoader: ole32.dll/CoRegisterMessageFilter
DynamicLoader: USER32.dll/PeekMessage
DynamicLoader: USER32.dll/PeekMessageW
DynamicLoader: USER32.dll/WaitMessage
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: kernel32.dll/ResolveDelayLoadedAPI
DynamicLoader: VSSAPI.DLL/CreateWriter
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ADVAPI32.dll/LookupAccountNameW
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: samcli.dll/NetLocalGroupGetMembers
DynamicLoader: SAMLIB.dll/SamConnect
DynamicLoader: RPCRT4.dll/NdrClientCall2
DynamicLoader: RPCRT4.dll/RpcStringBindingComposeW
DynamicLoader: RPCRT4.dll/RpcBindingFromStringBindingW
DynamicLoader: RPCRT4.dll/RpcStringFreeW
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: SAMLIB.dll/SamOpenDomain
DynamicLoader: SAMLIB.dll/SamLookupNamesInDomain
DynamicLoader: SAMLIB.dll/SamOpenAlias
DynamicLoader: SAMLIB.dll/SamFreeMemory
DynamicLoader: SAMLIB.dll/SamCloseHandle
DynamicLoader: SAMLIB.dll/SamGetMembersInAlias
DynamicLoader: netutils.dll/NetApiBufferFree
DynamicLoader: ole32.dll/CoCreateGuid
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/StringFromCLSID
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyW
DynamicLoader: PROPSYS.dll/VariantToPropVariant
DynamicLoader: OLEAUT32.dll/
DynamicLoader: wbemcore.dll/Reinitialize
DynamicLoader: wbemsvc.dll/DllGetClassObject
DynamicLoader: wbemsvc.dll/DllCanUnloadNow
DynamicLoader: authZ.dll/AuthzInitializeContextFromToken
DynamicLoader: authZ.dll/AuthzInitializeObjectAccessAuditEvent2
DynamicLoader: authZ.dll/AuthzAccessCheck
DynamicLoader: authZ.dll/AuthzFreeAuditEvent
DynamicLoader: authZ.dll/AuthzFreeContext
DynamicLoader: authZ.dll/AuthzInitializeResourceManager
DynamicLoader: authZ.dll/AuthzFreeResourceManager
DynamicLoader: RPCRT4.dll/NdrClientCall2
DynamicLoader: RPCRT4.dll/RpcBindingCreateW
DynamicLoader: RPCRT4.dll/RpcBindingBind
DynamicLoader: RPCRT4.dll/I_RpcMapWin32Status
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: ADVAPI32.dll/EventUnregister
DynamicLoader: ADVAPI32.dll/EventWrite
DynamicLoader: ADVAPI32.dll/EventActivityIdControl
DynamicLoader: ADVAPI32.dll/EventWriteTransfer
DynamicLoader: ADVAPI32.dll/EventEnabled
DynamicLoader: kernel32.dll/RegCloseKey
DynamicLoader: kernel32.dll/RegSetValueExW
DynamicLoader: kernel32.dll/RegOpenKeyExW
DynamicLoader: kernel32.dll/RegQueryValueExW
DynamicLoader: kernel32.dll/RegCloseKey
DynamicLoader: wmisvc.dll/IsImproperShutdownDetected
DynamicLoader: Wevtapi.dll/EvtRender
DynamicLoader: Wevtapi.dll/EvtNext
DynamicLoader: Wevtapi.dll/EvtClose
DynamicLoader: Wevtapi.dll/EvtQuery
DynamicLoader: Wevtapi.dll/EvtCreateRenderContext
DynamicLoader: RPCRT4.dll/RpcStringBindingComposeW
DynamicLoader: RPCRT4.dll/RpcBindingFromStringBindingW
DynamicLoader: RPCRT4.dll/RpcBindingSetAuthInfoExW
DynamicLoader: RPCRT4.dll/RpcBindingSetOption
DynamicLoader: RPCRT4.dll/RpcStringFreeW
DynamicLoader: RPCRT4.dll/NdrClientCall2
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: kernel32.dll/ResolveDelayLoadedAPI
DynamicLoader: ole32.dll/CoCreateFreeThreadedMarshaler
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CreateStreamOnHGlobal
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: KERNELBASE.dll/InitializeAcl
DynamicLoader: KERNELBASE.dll/AddAce
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: kernel32.dll/OpenProcessToken
DynamicLoader: KERNELBASE.dll/GetTokenInformation
DynamicLoader: KERNELBASE.dll/DuplicateTokenEx
DynamicLoader: KERNELBASE.dll/AdjustTokenPrivileges
DynamicLoader: KERNELBASE.dll/AllocateAndInitializeSid
DynamicLoader: KERNELBASE.dll/CheckTokenMembership
DynamicLoader: kernel32.dll/SetThreadToken
DynamicLoader: ole32.dll/CLSIDFromString
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: authZ.dll/AuthzInitializeContextFromToken
DynamicLoader: authZ.dll/AuthzInitializeResourceManager
DynamicLoader: authZ.dll/AuthzInitializeContextFromSid
DynamicLoader: authZ.dll/AuthzInitializeContextFromToken
DynamicLoader: authZ.dll/AuthzAccessCheck
DynamicLoader: authZ.dll/AuthzFreeContext
DynamicLoader: authZ.dll/AuthzFreeResourceManager
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetCallContext
DynamicLoader: ole32.dll/StringFromGUID2
DynamicLoader: ole32.dll/CoImpersonateClient
DynamicLoader: ole32.dll/CoRevertToSelf
DynamicLoader: ole32.dll/CoSwitchCallContext
DynamicLoader: ole32.dll/CoCreateGuid
DynamicLoader: SspiCli.dll/LogonUserExExW
DynamicLoader: kernel32.dll/ResolveDelayLoadedAPI
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: wbemcore.dll/Reinitialize
DynamicLoader: wbemcore.dll/Reinitialize
DynamicLoader: wbemcore.dll/Reinitialize
DynamicLoader: OLEAUT32.dll/
DynamicLoader: wbemcore.dll/Reinitialize
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ole32.dll/CoUninitialize
CAPE extracted potentially suspicious content
MV JIA YU SHAN.exe: Unpacked Shellcode
MV JIA YU SHAN.exe: Unpacked Shellcode
MV JIA YU SHAN.exe: Injected Shellcode/Data
MV JIA YU SHAN.exe: Unpacked Shellcode
MV JIA YU SHAN.exe: AgentTeslaV2 Payload: 32-bit executable
MV JIA YU SHAN.exe: AgentTeslaV2
MV JIA YU SHAN.exe: Injected Shellcode/Data
MV JIA YU SHAN.exe: Unpacked Shellcode
MV JIA YU SHAN.exe: Unpacked Shellcode
MV JIA YU SHAN.exe: AgentTeslaV2 Payload
MV JIA YU SHAN.exe: AgentTeslaV2
MV JIA YU SHAN.exe: Unpacked Shellcode
MV JIA YU SHAN.exe: Unpacked Shellcode
MV JIA YU SHAN.exe: Unpacked Shellcode
MV JIA YU SHAN.exe: Unpacked Shellcode
MV JIA YU SHAN.exe: Unpacked Shellcode
MV JIA YU SHAN.exe: Unpacked Shellcode
MV JIA YU SHAN.exe: Unpacked Shellcode
MV JIA YU SHAN.exe: Unpacked Shellcode
Queries or connects to DNS-Over-HTTPS/DNS-Over-TLS domain or IP address
ip: 1.1.1.1
The binary likely contains encrypted or compressed data.
section: name: .text, entropy: 7.91, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00060600, virtual_size: 0x000605a8
section: name: .rsrc, entropy: 6.93, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x0003d800, virtual_size: 0x0003d7a8
Authenticode signature is invalid
authenticode error: No signature found. SignTool Error File not valid C\Users\Rebecca\AppData\Local\Temp\MV JIA YU SHAN.exe
Behavioural detection: Injection (Process Hollowing)
Injection: MV JIA YU SHAN.exe(5204) -> MV JIA YU SHAN.exe(3452)
Executed a process and injected code into it, probably while unpacking
Injection: MV JIA YU SHAN.exe(5204) -> MV JIA YU SHAN.exe(3452)
Attempts to remove evidence of file being downloaded from the Internet
file: C:\Users\Rebecca\AppData\Roaming\DsWhv\DsWhv.exe:Zone.Identifier
Behavioural detection: Injection (inter-process)
Behavioural detection: Injection with CreateRemoteThread in a remote process
Attempts to repeatedly call a single API many times in order to delay analysis time
Spam: services.exe (460) called API GetSystemTimeAsFileTime 10222490 times
Steals private information from local Internet browsers
file: C:\Users\Rebecca\AppData\Local\Google\Chrome\User Data\Default\Login Data
file: C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\profiles.ini
file: C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\48wgv2fv.default\key4.db
Installs itself for autorun at Windows startup
key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\DsWhv
data: C:\Users\Rebecca\AppData\Roaming\DsWhv\DsWhv.exe
Network activity detected but not expressed in API logs
CAPE detected the AgentTeslaV2 malware family
File has been identified by 14 Antiviruses on VirusTotal as malicious
FireEye: Generic.mg.925cba90f4d80775
Cylance: Unsafe
Sangfor: Malware
Cybereason: malicious.d09e91
BitDefenderTheta: Gen:[email protected]
APEX: Malicious
Kaspersky: UDS:DangerousObject.Multi.Generic
Endgame: malicious (high confidence)
McAfee-GW-Edition: BehavesLike.Win32.Generic.jc
SentinelOne: DFI - Malicious PE
eGambit: Unsafe.AI_Score_98%
ZoneAlarm: UDS:DangerousObject.Multi.Generic
ESET-NOD32: a variant of MSIL/Kryptik.WMH
CrowdStrike: win/malicious_confidence_60% (D)
Creates a copy of itself
copy: C:\Users\Rebecca\AppData\Roaming\DsWhv\DsWhv.exe
Harvests credentials from local FTP client softwares
file: C:\Users\Rebecca\AppData\Roaming\FileZilla\recentservers.xml
file: C:\Users\Rebecca\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\
file: C:\Users\Rebecca\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\*.xml
file: C:\Users\Rebecca\AppData\Roaming\FTPGetter\servers.xml
file: C:\Users\Rebecca\AppData\Roaming\Ipswitch\WS_FTP\Sites\ws_ftp.ini
file: C:\cftp\Ftplist.txt
key: HKEY_CURRENT_USER\Software\FTPWare\COREFTP\Sites
Harvests information related to installed mail clients
file: C:\Users\Rebecca\AppData\Roaming\Thunderbird\profiles.ini
key: HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
key: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
key: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Screenshots


Hosts

Direct IP Country Name
Y 8.8.8.8 [VT] United States
Y 1.1.1.1 [VT] Australia

DNS

No domains contacted.


Summary

C:\Windows\System32\MSCOREE.DLL.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Rebecca\AppData\Local\Temp\MV JIA YU SHAN.exe.config
C:\Users\Rebecca\AppData\Local\Temp\MV JIA YU SHAN.exe
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-2.dll
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-0.dll
C:\Users\Rebecca\AppData\Local\Temp\MV JIA YU SHAN.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
C:\Windows
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Rebecca\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Rebecca\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index38e.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\f8420d8c6ede777377fcff48a4beaa2a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Users
C:\Users\Rebecca
C:\Users\Rebecca\AppData
C:\Users\Rebecca\AppData\Local
C:\Users\Rebecca\AppData\Local\Temp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
C:\Users\Rebecca\AppData\Local\Temp\MV JIA YU SHAN.config
C:\Users\Rebecca\AppData\Local\Temp\MV JIA YU SHAN.INI
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol224.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\0a65164b17e5c64bacdc694ea2439c43\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\4ac828c8c4c76f3ba59f8f9c7dab1cb3\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Users\Rebecca\AppData\Local\Temp\en-US\bEPx.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en-US\bEPx.resources\bEPx.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en-US\bEPx.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\en-US\bEPx.resources\bEPx.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
C:\Windows\Globalization\en.nlp
C:\Users\Rebecca\AppData\Local\Temp\en\bEPx.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en\bEPx.resources\bEPx.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en\bEPx.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\en\bEPx.resources\bEPx.resources.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\175df210b784212def386595c25caefb\System.Drawing.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Gdiplus.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035\GdiPlus.dll
C:\Users\Rebecca\AppData\Local\Temp\en-US\ReZer0V2.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en-US\ReZer0V2.resources\ReZer0V2.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en-US\ReZer0V2.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\en-US\ReZer0V2.resources\ReZer0V2.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\en\ReZer0V2.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en\ReZer0V2.resources\ReZer0V2.resources.dll
C:\Users\Rebecca\AppData\Local\Temp\en\ReZer0V2.resources.exe
C:\Users\Rebecca\AppData\Local\Temp\en\ReZer0V2.resources\ReZer0V2.resources.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\5669120680b52abf616f3876387ca2cc\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.5204.28838000
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.5204.28838000
C:\Users\Rebecca\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.5204.28838000
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bcrypt.dll
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll
C:\Windows\System32\wbem\wbemdisp.tlb
C:\Windows\System32\en-US\KERNELBASE.dll.mui
C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\aa404966f6e5a3d1f9d0fe3ba1d13ec1\CustomMarshalers.ni.dll
C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.INI
C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\oleaut32.DLL
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\81ab4c39c6a7c9f50721aca2db09b417\System.Management.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\wminet_utils.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\oleaut32.dll
C:\Users\Rebecca\AppData\Roaming\DsWhv\
C:\Users\Rebecca\AppData\Roaming\DsWhv
C:\Users\Rebecca\AppData\Roaming
C:\Users\Rebecca\AppData\Roaming\DsWhv\DsWhv.exe
C:\Users\Rebecca\AppData\Roaming\DsWhv\DsWhv.exe:Zone.Identifier
C:\Windows\System32\tzres.dll
C:\Windows\System32\en-US\tzres.dll.mui
C:\Users\Rebecca\AppData\Local\Sputnik\Sputnik\User Data
C:\Users\Rebecca\AppData\Local\360Chrome\Chrome\User Data
C:\Users\Rebecca\AppData\Local\MapleStudio\ChromePlus\User Data
C:\Users\Rebecca\AppData\Local\Yandex\YandexBrowser\User Data
C:\Users\Rebecca\AppData\Local\liebao\User Data
C:\Users\Rebecca\AppData\Local\Amigo\User Data
C:\Users\Rebecca\AppData\Local\CentBrowser\User Data
C:\Users\Rebecca\AppData\Local\Kometa\User Data
C:\Users\Rebecca\AppData\Local\CocCoc\Browser\User Data
C:\Users\Rebecca\AppData\Roaming\Opera Software\Opera Stable
C:\Users\Rebecca\AppData\Local\uCozMedia\Uran\User Data
C:\Users\Rebecca\AppData\Local\Chromium\User Data
C:\Users\Rebecca\AppData\Local\Torch\User Data
C:\Users\Rebecca\AppData\Local\Vivaldi\User Data
C:\Users\Rebecca\AppData\Local\Coowon\Coowon\User Data
C:\Users\Rebecca\AppData\Local\Epic Privacy Browser\User Data
C:\Users\Rebecca\AppData\Local\QIP Surf\User Data
C:\Users\Rebecca\AppData\Local\Chedot\User Data
C:\Users\Rebecca\AppData\Local\CatalinaGroup\Citrio\User Data
C:\Users\Rebecca\AppData\Local\Orbitum\User Data
C:\Users\Rebecca\AppData\Local\7Star\7Star\User Data
C:\Users\Rebecca\AppData\Local\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
C:\Users\Rebecca\AppData\Local\Elements Browser\User Data
C:\Users\Rebecca\AppData\Local\Iridium\User Data
C:\Users\Rebecca\AppData\Local\BraveSoftware\Brave-Browser\User Data
C:\Users\Rebecca\AppData\Local\Comodo\Dragon\User Data
C:\Users\Rebecca\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
C:\Users\Rebecca\AppData\Local\Temp\Folder.lst
C:\Users\All Users\AppData\Roaming\FlashFXP\3quick.dat
C:\Users\Rebecca\AppData\Roaming\Claws-mail
C:\Users\Rebecca\AppData\Roaming\Claws-mail\clawsrc
C:\Users\Rebecca\AppData\Roaming\K-Meleon\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Waterfox\profiles.ini
C:\Program Files\Common Files\Apple\Apple Application Support\plutil.exe
C:\Users\Rebecca\AppData\Roaming\Thunderbird\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Opera Mail\Opera Mail\wand.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\b065f84b49a27b648015c08fab8cd00e\System.Xml.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.INI
C:\Users\Rebecca\AppData\Roaming\Psi\profiles
C:\Users\Rebecca\AppData\Roaming\Psi+\profiles
C:\FTP Navigator\Ftplist.txt
C:\Program Files\jDownloader\config\database.script
C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\48wgv2fv.default\logins.json
C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\48wgv2fv.default\key4.db
C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\48wgv2fv.default\signons.sqlite
C:\Users\Rebecca\AppData\Roaming\CoreFTP\sites.idx
C:\Windows\System32\wshom.ocx
C:\Windows\System32\en-US\wshom.ocx.mui
C:\Users\Rebecca\AppData\Local\Google\Chrome\User Data\
C:\Users\Rebecca\AppData\Local\Google\Chrome\User Data\*
C:\Users\Rebecca\AppData\Local\Google\Chrome\User Data\Default\Login Data
C:\Users\Rebecca\AppData\Local\Google\Chrome\User Data\Login Data
C:\cftp\Ftplist.txt
C:\Users\Rebecca\AppData\Local\Tencent\QQBrowser\User Data
C:\Users\Rebecca\AppData\Local\Tencent\QQBrowser\User Data\Default\EncryptedStorage
C:\Storage\
C:\mail\
C:\Users\Rebecca\AppData\Local\VirtualStore\Program Files\Foxmail\mail\
C:\Users\Rebecca\AppData\Local\VirtualStore\Program Files (x86)\Foxmail\mail\
C:\Users\Rebecca\AppData\Roaming\FTPGetter\servers.xml
C:\Users\Rebecca\AppData\Local\UCBrowser\*
C:\Users\Rebecca\AppData\Roaming\Postbox\profiles.ini
C:\Users\Rebecca\AppData\Roaming\The Bat!
C:\Users\Rebecca\AppData\Local\falkon\profiles\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Mozilla\icecat\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Pocomail\accounts.ini
C:\Users\Rebecca\AppData\Roaming\Ipswitch\WS_FTP\Sites\ws_ftp.ini
C:\Users\Rebecca\AppData\Roaming\Trillian\users\global\accounts.dat
C:\Users\Rebecca\AppData\Roaming\FileZilla\recentservers.xml
C:\Users\Rebecca\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Flock\Browser\profiles.ini
C:\Users\Rebecca\AppData\Local\Microsoft\Edge\User Data
C:\Users\Rebecca\AppData\Local\Temp\vaultcli.dll
C:\Users\Rebecca\AppData\Roaming\Comodo\IceDragon\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Mozilla\SeaMonkey\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Moonchild Productions\Pale Moon\profiles.ini
C:\Users\Rebecca\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\*.xml
C:\Users\Rebecca\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\
C:\Windows\System32\en-US\VssTrace.DLL.mui
\??\PIPE\samr
C:\DosDevices\pipe\
C:\Windows\System32\wbem\repository
C:\Windows\System32\wbem\Logs
C:\Windows\System32\wbem\AutoRecover
C:\Windows\System32\wbem\MOF
C:\Windows\System32\wbem\repository\INDEX.BTR
C:\Windows\System32\wbem\repository\WRITABLE.TST
C:\Windows\System32\wbem\repository\MAPPING1.MAP
C:\Windows\System32\wbem\repository\MAPPING2.MAP
C:\Windows\System32\wbem\repository\MAPPING3.MAP
C:\Windows\System32\wbem\repository\OBJECTS.DATA
\??\pipe\PIPE_EVENTROOT\CIMV2PROVIDERSUBSYSTEM
\??\pipe\PIPE_EVENTROOT\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER
C:\Windows\Temp
C:\Windows\System32\LogFiles\Scm\a1cfa52f-06f2-418d-addb-cd6456d66f43
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\Rebecca\AppData\Local\Temp\MV JIA YU SHAN.exe.config
C:\Users\Rebecca\AppData\Local\Temp\MV JIA YU SHAN.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\Rebecca\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\Rebecca\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index38e.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\f8420d8c6ede777377fcff48a4beaa2a\mscorlib.ni.dll
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol224.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\0a65164b17e5c64bacdc694ea2439c43\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\4ac828c8c4c76f3ba59f8f9c7dab1cb3\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\175df210b784212def386595c25caefb\System.Drawing.ni.dll
C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24308_none_5c028e37a0121035\GdiPlus.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\5669120680b52abf616f3876387ca2cc\System.Windows.Forms.ni.dll
C:\Windows\System32\wbem\wbemdisp.tlb
C:\Windows\System32\en-US\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\aa404966f6e5a3d1f9d0fe3ba1d13ec1\CustomMarshalers.ni.dll
C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\81ab4c39c6a7c9f50721aca2db09b417\System.Management.ni.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\wminet_utils.dll
C:\Windows\System32\tzres.dll
C:\Windows\System32\en-US\tzres.dll.mui
C:\Users\Rebecca\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
C:\Users\Rebecca\AppData\Roaming\K-Meleon\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Waterfox\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Thunderbird\profiles.ini
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\b065f84b49a27b648015c08fab8cd00e\System.Xml.ni.dll
C:\FTP Navigator\Ftplist.txt
C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\48wgv2fv.default\key4.db
C:\Users\Rebecca\AppData\Roaming\CoreFTP\sites.idx
C:\Windows\System32\wshom.ocx
C:\Windows\System32\en-US\wshom.ocx.mui
C:\Users\Rebecca\AppData\Local\Google\Chrome\User Data\Default\Login Data
C:\Users\Rebecca\AppData\Roaming\Postbox\profiles.ini
C:\Users\Rebecca\AppData\Local\falkon\profiles\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Mozilla\icecat\profiles.ini
C:\Users\Rebecca\AppData\Roaming\FileZilla\recentservers.xml
C:\Users\Rebecca\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Flock\Browser\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Comodo\IceDragon\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Mozilla\SeaMonkey\profiles.ini
C:\Users\Rebecca\AppData\Roaming\Moonchild Productions\Pale Moon\profiles.ini
C:\Windows\System32\en-US\VssTrace.DLL.mui
\??\PIPE\samr
C:\Windows\System32\wbem\repository\MAPPING1.MAP
C:\Windows\System32\wbem\repository\MAPPING2.MAP
C:\Windows\System32\wbem\repository\MAPPING3.MAP
C:\Windows\System32\wbem\repository\OBJECTS.DATA
C:\Windows\System32\wbem\repository\INDEX.BTR
\??\pipe\PIPE_EVENTROOT\CIMV2PROVIDERSUBSYSTEM
\??\pipe\PIPE_EVENTROOT\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER
C:\Windows\System32\LogFiles\Scm\a1cfa52f-06f2-418d-addb-cd6456d66f43
C:\Users\Rebecca\AppData\Roaming\DsWhv\DsWhv.exe
\??\PIPE\samr
C:\Windows\System32\wbem\repository\WRITABLE.TST
C:\Windows\System32\wbem\repository\MAPPING1.MAP
C:\Windows\System32\wbem\repository\MAPPING2.MAP
C:\Windows\System32\wbem\repository\MAPPING3.MAP
C:\Windows\System32\wbem\repository\OBJECTS.DATA
C:\Windows\System32\wbem\repository\INDEX.BTR
\??\pipe\PIPE_EVENTROOT\CIMV2PROVIDERSUBSYSTEM
\??\pipe\PIPE_EVENTROOT\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.5204.28838000
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.5204.28838000
C:\Users\Rebecca\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.5204.28838000
C:\Users\Rebecca\AppData\Roaming\DsWhv\DsWhv.exe:Zone.Identifier
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MV JIA YU SHAN.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\NGen\Policy\v2.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-479431668-4257340731-3059248302-1002
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index38e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index38e\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index38e\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\6d
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\6d\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\6d\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\6d\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\6d\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\6d\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c8230b\15e00776
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\DotNetClient\v3.5
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index224
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.8.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\61
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\5c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\5c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\5c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\5c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\5c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\5c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\53
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\53\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\53\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\53\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\53\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\53\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\58
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\58\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\58\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\58\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\58\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\58\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\b5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\b5\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\b5\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\b5\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\b5\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\b5\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\63
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\63\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\63\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\63\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\63\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\63\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\bb
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\bb\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\bb\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\bb\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\bb\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\bb\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\6e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\6e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\6e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\6e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\6e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\6e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\6f
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\6f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\6f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\6f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\6f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\6f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\70
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\70\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\70\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\70\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\70\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\70\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Web__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5636e2a2\70d0fa57
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-479431668-4257340731-3059248302-1002\Installer\Assemblies\C:|Users|Rebecca|AppData|Local|Temp|MV JIA YU SHAN.exe
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\C:|Users|Rebecca|AppData|Local|Temp|MV JIA YU SHAN.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Users|Rebecca|AppData|Local|Temp|MV JIA YU SHAN.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-479431668-4257340731-3059248302-1002\Installer\Assemblies\Global
HKEY_CURRENT_USER\Software\Microsoft\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5636e2a2\79312c55
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\MissingDependencies
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\25fd5cf0\fe3ad34
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\25fd5cf0\21bb12f8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\65
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\65\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\65\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\65\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\65\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\65\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\54
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\54\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\54\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\54\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\54\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\54\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\57
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\57\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\57\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\57\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\57\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\57\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SQMClient\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPSampledIn
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1a7be159\686cef59
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Classes\AppID\MV JIA YU SHAN.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE\AppCompat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\DefaultAccessPermission
HKEY_CURRENT_USER\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledProcesses\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\9465F3ED
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledSessions\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_CURRENT_USER\Software\Classes\WinMgmts
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WINMGMTS\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WINMGMTS\CLSID\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Scripting
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Scripting\Default Namespace
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Hostname
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\System\DNSclient
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Domain
HKEY_CURRENT_USER\Software\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en
HKEY_CURRENT_USER\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocHandler
HKEY_CURRENT_USER\Software\Classes\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0\win32\(Default)
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CMF\Config
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CMF\Config\SYSTEM
HKEY_CLASSES_ROOT\CLSID\{62E522DC-8CF3-40A8-8B2E-37D595651E40}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\409
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\9
HKEY_CURRENT_USER\Software\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocHandler
HKEY_CURRENT_USER\Software\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}\ProxyStubClsid32\(Default)
HKEY_CLASSES_ROOT\CLSID\{04B83D61-21AE-11D2-8B33-00600806D9B6}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.CustomMarshalers__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\109d7e79\357ee49a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\109d7e79\357ee49a\28
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\109d7e79\357ee49a\28\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\109d7e79\357ee49a\28\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\109d7e79\357ee49a\28\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\109d7e79\357ee49a\28\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\109d7e79\357ee49a\28\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\109d7e79\357ee49a\28\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\109d7e79\357ee49a\28\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\109d7e79\357ee49a\28\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\109d7e79\357ee49a\28\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\6c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\357ee49a\34724983\16
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\357ee49a\34724983\16\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\357ee49a\34724983\16\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\357ee49a\34724983\16\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\357ee49a\34724983\16\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\357ee49a\34724983\16\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\CustomMarshalers,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.8.0.Microsoft.VisualC__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualC,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\9e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\9e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\9e\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\9e\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\9e\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\9e\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\9e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\9e\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\9e\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\9e\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\52
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\52\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\52\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\52\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\52\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\52\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\b4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\b4\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\b4\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\b4\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\b4\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\b4\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.8.0.Microsoft.JScript__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.JScript,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration.Install__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\WMIDisableCOMSecurity
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\FinalizerActivityBypass
HKEY_LOCAL_MACHINE\Software\Microsoft\OleAut
HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\CIMOM
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\EnableObjectValidation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\DsWhv
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run
HKEY_CURRENT_USER\Software\RimArts\B2\Settings
HKEY_CURRENT_USER\Software\Qualcomm\Eudora\CommandLine
HKEY_CURRENT_USER\Software\OpenVPN-GUI\configs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\75
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\75\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\75\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\75\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\75\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\75\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\75\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\75\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\75\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\75\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\64
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\64\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\64\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\64\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\64\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\64\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Data.SqlXml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Data.SqlXml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_CLASSES_ROOT\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32\Class
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\409
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\9
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\0\win32\(Default)
HKEY_CURRENT_USER\Software\FTPWare\COREFTP\Sites
HKEY_CURRENT_USER\Software\IncrediMail\Identities
HKEY_CURRENT_USER\Software\Aerofox\FoxmailPreview
HKEY_CURRENT_USER\Software\Aerofox\Foxmail\V3.1
HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
HKEY_CURRENT_USER\Software\DownloadManager\Passwords
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LocalService
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\ServiceParameters
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\RunAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\ActivateAtStorage
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\ROTFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\AppIDFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LaunchPermission
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\LegacyAuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\LegacyImpersonationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\AuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\RemoteServerName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\SRPTrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\PreferredServerBitness
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LoadUserSettings
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Power\PowerRequestOverride
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Power\PowerRequestOverride
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Power\PowerRequestOverride\Driver
HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\Tracing\WMI
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\SessionEnabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\AreaFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\Session
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\LogFile
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\MinimumBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\MaximumBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\MaximumFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\LogFileMode
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\FlushTimer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\AgeLimit
HKEY_LOCAL_MACHINE\SYSTEM\Setup
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\SYSTEM\Setup\UpgradeInProgress
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Safeboot\Option
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Rpc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Settings
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Settings\ActiveWriterStateTimeout
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\(Default)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag\WMI Writer
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Settings\TornComponentsMax
HKEY_LOCAL_MACHINE\Software\Classes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000100-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000100-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000100-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9555-4FB6-11D1-9971-00C04FBBB345}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9555-4FB6-11D1-9971-00C04FBBB345}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9555-4FB6-11D1-9971-00C04FBBB345}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9557-4FB6-11D1-9971-00C04FBBB345}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9557-4FB6-11D1-9971-00C04FBBB345}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9557-4FB6-11D1-9971-00C04FBBB345}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\IdentifierLimit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\QueryLimit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\PathLimit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbThrottlingEnabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighMaxLimitFactor
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbTaskMaxSleep
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold1Mult
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold2Mult
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold3Mult
HKEY_LOCAL_MACHINE\system\Setup
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Unchecked Task Count
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\LastServiceStart
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Working Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Repository Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Build
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Logging Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\MOF Self-Install Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Default Repository Driver
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueCoreFsrepVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Repository Cache Spill Ratio
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\CheckPointValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\SnapShotValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\CheckRepositoryOnNextStartup
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\NumWriteIdCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Class Cache Size
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Class Cache Item Age (ms)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\NextAutoRecoverFile
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Enable Provider Subsystem
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Transports\Decoupled\Client
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Transports\Decoupled\Client\{226569DD-1D90-4B04-9C03-6793B6D991F7}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{226569DD-1D90-4B04-9C03-6793B6D991F7}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{226569DD-1D90-4B04-9C03-6793B6D991F7}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{226569DD-1D90-4B04-9C03-6793B6D991F7}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{226569DD-1D90-4B04-9C03-6793B6D991F7}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{226569DD-1D90-4B04-9C03-6793B6D991F7}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{226569DD-1D90-4B04-9C03-6793B6D991F7}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{226569DD-1D90-4B04-9C03-6793B6D991F7}\ProcessIdentifier
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Transports\Decoupled\Client\{28086039-BCB3-4F24-BEE9-1E964DEDE9B1}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{28086039-BCB3-4F24-BEE9-1E964DEDE9B1}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{28086039-BCB3-4F24-BEE9-1E964DEDE9B1}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{28086039-BCB3-4F24-BEE9-1E964DEDE9B1}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{28086039-BCB3-4F24-BEE9-1E964DEDE9B1}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{28086039-BCB3-4F24-BEE9-1E964DEDE9B1}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{28086039-BCB3-4F24-BEE9-1E964DEDE9B1}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{28086039-BCB3-4F24-BEE9-1E964DEDE9B1}\ProcessIdentifier
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Transports\Decoupled\Client\{56BD4BED-F318-4059-B8D5-F7380EC296A0}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{56BD4BED-F318-4059-B8D5-F7380EC296A0}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{56BD4BED-F318-4059-B8D5-F7380EC296A0}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{56BD4BED-F318-4059-B8D5-F7380EC296A0}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{56BD4BED-F318-4059-B8D5-F7380EC296A0}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{56BD4BED-F318-4059-B8D5-F7380EC296A0}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{56BD4BED-F318-4059-B8D5-F7380EC296A0}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{56BD4BED-F318-4059-B8D5-F7380EC296A0}\ProcessIdentifier
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Transports\Decoupled\Client\{998B0BE7-B4BC-46E1-94D4-C9F9B28DC669}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{998B0BE7-B4BC-46E1-94D4-C9F9B28DC669}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{998B0BE7-B4BC-46E1-94D4-C9F9B28DC669}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{998B0BE7-B4BC-46E1-94D4-C9F9B28DC669}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{998B0BE7-B4BC-46E1-94D4-C9F9B28DC669}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{998B0BE7-B4BC-46E1-94D4-C9F9B28DC669}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{998B0BE7-B4BC-46E1-94D4-C9F9B28DC669}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{998B0BE7-B4BC-46E1-94D4-C9F9B28DC669}\ProcessIdentifier
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Transports\Decoupled\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Server\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Server\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Server\ProcessIdentifier
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\EnableEvents
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueEssToBeInitialized
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Low Threshold On Events (B)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\High Threshold On Events (B)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Wait On Events (ms)
HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\ESS
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Merger Query Arbitration Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueEssNeedsLoading
HKEY_LOCAL_MACHINE\software\microsoft\wbem\cimom
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\SetupDate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Async Result Queue Size
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\List of event-active namespaces
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\ESS\//./root/subscription
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\ESS\//./root/CIMV2
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\CIMOM
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\FinalizerBatchSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ClientCallbackTimeout
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\FinalizerQueueThreshold
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Tasks
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\cimv2
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\cimv2
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}
HKEY_CLASSES_ROOT\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InprocServer32\Synchronization
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InprocServer32\(Default)
HKEY_CLASSES_ROOT\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\LocalServer32
HKEY_CLASSES_ROOT\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\AppId
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\ESS\//./root/CIMV2\SCM Event Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\minint
HKEY_CLASSES_ROOT\CLSID\{d63a5850-8f16-11cf-9f47-00aa00bf345c}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\InprocServer32\Synchronization
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\InprocServer32\(Default)
HKEY_CLASSES_ROOT\CLSID\{d63a5850-8f16-11cf-9f47-00aa00bf345c}\LocalServer32
HKEY_CLASSES_ROOT\CLSID\{d63a5850-8f16-11cf-9f47-00aa00bf345c}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\AppId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\SecuredHostProviders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\SecuredHostProviders\ROOT\CIMV2:__Win32Provider.Name="CIMWin32"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\Root
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\Root
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7B31DF9-D515-11D3-A11C-00105A1F515A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{07435309-D440-41B7-83F3-EB82DB6C622F}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{07435309-D440-41B7-83F3-EB82DB6C622F}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{07435309-D440-41B7-83F3-EB82DB6C622F}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F50A28CF-5C9C-4F7E-9D80-E25E16E18C59}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F50A28CF-5C9C-4F7E-9D80-E25E16E18C59}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F50A28CF-5C9C-4F7E-9D80-E25E16E18C59}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6B3FC272-BF37-4968-933A-6DF9222A2607}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6B3FC272-BF37-4968-933A-6DF9222A2607}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6B3FC272-BF37-4968-933A-6DF9222A2607}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0FC8C622-1728-4149-A57F-AD19D0970710}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0FC8C622-1728-4149-A57F-AD19D0970710}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0FC8C622-1728-4149-A57F-AD19D0970710}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FEC1B0AC-5808-4033-A915-C0185934581E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FEC1B0AC-5808-4033-A915-C0185934581E}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FEC1B0AC-5808-4033-A915-C0185934581E}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EB658B8A-7A64-4DDC-9B8D-A92610DB0206}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EB658B8A-7A64-4DDC-9B8D-A92610DB0206}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EB658B8A-7A64-4DDC-9B8D-A92610DB0206}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocHandler
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ImagePath
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Public
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Default
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_USERS\S-1-5-18
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_USERS\.DEFAULT\Environment
HKEY_USERS\.DEFAULT\Volatile Environment
HKEY_USERS\.DEFAULT\Volatile Environment\0
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\Environment
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\RequiredPrivileges
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\OnlyUseLatestCLR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index38e\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index38e\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\74\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\6d\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\6d\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\6d\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\6d\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\780ee13f\6d\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index224
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\a4\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\61\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\61\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\61\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\61\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\5086dba8\61\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\5c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\5c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\5c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\5c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\12d2be49\5c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\53\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\53\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\53\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\53\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\3dc46903\53\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\58\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\58\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\58\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\58\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\3e045c21\58\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\b5\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\b5\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\b5\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\b5\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\23e7306f\b5\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\63\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\63\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\63\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\63\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\6e527edf\63\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\bb\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\bb\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\bb\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\bb\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\191b956f\bb\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\78\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\6e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\6e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\6e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\6e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\324708cb\6e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\6f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\6f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\6f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\6f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\46ad1249\6f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\70\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\70\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\70\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\70\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\257bdb20\70\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\6f\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\66\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\65\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\65\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\65\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\65\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\304b33ae\65\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\54\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\54\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\54\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\54\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\553abeb3\54\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\57\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\57\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\57\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\57\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\4bf62c79\57\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPSampledIn
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\DefaultAccessPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\9465F3ED
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WINMGMTS\CLSID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Scripting\Default Namespace
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Hostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Domain
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0\win32\(Default)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CMF\Config\SYSTEM
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\109d7e79\357ee49a\28\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\109d7e79\357ee49a\28\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\109d7e79\357ee49a\28\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\109d7e79\357ee49a\28\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\109d7e79\357ee49a\28\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\109d7e79\357ee49a\28\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\109d7e79\357ee49a\28\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\109d7e79\357ee49a\28\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\109d7e79\357ee49a\28\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\6c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\6c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\6c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\6c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\6c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\357ee49a\34724983\16\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\357ee49a\34724983\16\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\357ee49a\34724983\16\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\357ee49a\34724983\16\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\357ee49a\34724983\16\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\CustomMarshalers,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualC,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\9e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\9e\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\9e\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\9e\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\9e\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\9e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\9e\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\9e\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\9e\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\52\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\52\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\52\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\52\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\61f4f6f6\52\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\b4\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\b4\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\b4\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\b4\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\41a2a33b\b4\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.JScript,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\WMIDisableCOMSecurity
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\FinalizerActivityBypass
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\EnableObjectValidation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\DsWhv
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\75\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\75\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\75\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\75\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\75\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\75\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\75\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\75\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\75\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\64\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\64\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\64\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\64\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\658578aa\64\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Data.SqlXml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32\Class
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\0\win32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LocalService
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\ServiceParameters
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\RunAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\ActivateAtStorage
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\ROTFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\AppIDFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LaunchPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\LegacyAuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\LegacyImpersonationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\AuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\RemoteServerName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\SRPTrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\PreferredServerBitness
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LoadUserSettings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\SessionEnabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\Level
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\AreaFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\Session
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\LogFile
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\BufferSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\MinimumBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\MaximumBuffers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\MaximumFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\LogFileMode
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\FlushTimer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI\AgeLimit
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\SYSTEM\Setup\UpgradeInProgress
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Settings\ActiveWriterStateTimeout
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\(Default)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Settings\TornComponentsMax
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000100-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9555-4FB6-11D1-9971-00C04FBBB345}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609B9557-4FB6-11D1-9971-00C04FBBB345}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\IdentifierLimit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\QueryLimit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\PathLimit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbThrottlingEnabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighMaxLimitFactor
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbTaskMaxSleep
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold1Mult
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold2Mult
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ArbSystemHighThreshold3Mult
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Unchecked Task Count
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\LastServiceStart
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Working Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Repository Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Build
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Logging Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\MOF Self-Install Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Default Repository Driver
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueCoreFsrepVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Repository Cache Spill Ratio
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\CheckPointValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\SnapShotValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\CheckRepositoryOnNextStartup
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\NumWriteIdCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Class Cache Size
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Class Cache Item Age (ms)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\NextAutoRecoverFile
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Enable Provider Subsystem
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{226569DD-1D90-4B04-9C03-6793B6D991F7}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{226569DD-1D90-4B04-9C03-6793B6D991F7}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{226569DD-1D90-4B04-9C03-6793B6D991F7}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{226569DD-1D90-4B04-9C03-6793B6D991F7}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{226569DD-1D90-4B04-9C03-6793B6D991F7}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{226569DD-1D90-4B04-9C03-6793B6D991F7}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{226569DD-1D90-4B04-9C03-6793B6D991F7}\ProcessIdentifier
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{28086039-BCB3-4F24-BEE9-1E964DEDE9B1}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{28086039-BCB3-4F24-BEE9-1E964DEDE9B1}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{28086039-BCB3-4F24-BEE9-1E964DEDE9B1}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{28086039-BCB3-4F24-BEE9-1E964DEDE9B1}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{28086039-BCB3-4F24-BEE9-1E964DEDE9B1}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{28086039-BCB3-4F24-BEE9-1E964DEDE9B1}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{28086039-BCB3-4F24-BEE9-1E964DEDE9B1}\ProcessIdentifier
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{56BD4BED-F318-4059-B8D5-F7380EC296A0}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{56BD4BED-F318-4059-B8D5-F7380EC296A0}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{56BD4BED-F318-4059-B8D5-F7380EC296A0}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{56BD4BED-F318-4059-B8D5-F7380EC296A0}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{56BD4BED-F318-4059-B8D5-F7380EC296A0}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{56BD4BED-F318-4059-B8D5-F7380EC296A0}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{56BD4BED-F318-4059-B8D5-F7380EC296A0}\ProcessIdentifier
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{998B0BE7-B4BC-46E1-94D4-C9F9B28DC669}\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{998B0BE7-B4BC-46E1-94D4-C9F9B28DC669}\Provider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{998B0BE7-B4BC-46E1-94D4-C9F9B28DC669}\Scope
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{998B0BE7-B4BC-46E1-94D4-C9F9B28DC669}\Locale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{998B0BE7-B4BC-46E1-94D4-C9F9B28DC669}\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{998B0BE7-B4BC-46E1-94D4-C9F9B28DC669}\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Client\{998B0BE7-B4BC-46E1-94D4-C9F9B28DC669}\ProcessIdentifier
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\EnableEvents
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueEssToBeInitialized
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Low Threshold On Events (B)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\High Threshold On Events (B)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Wait On Events (ms)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Merger Query Arbitration Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\SetupDate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Async Result Queue Size
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\FinalizerBatchSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ClientCallbackTimeout
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\FinalizerQueueThreshold
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Max Tasks
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\cimv2
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\cimv2
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InprocServer32\Synchronization
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\AppId
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\InprocServer32\Synchronization
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D63A5850-8F16-11CF-9F47-00AA00BF345C}\AppId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\SecuredHostProviders\ROOT\CIMV2:__Win32Provider.Name="CIMWin32"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\Root
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\Root
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{07435309-D440-41B7-83F3-EB82DB6C622F}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F50A28CF-5C9C-4F7E-9D80-E25E16E18C59}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6B3FC272-BF37-4968-933A-6DF9222A2607}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0FC8C622-1728-4149-A57F-AD19D0970710}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FEC1B0AC-5808-4033-A915-C0185934581E}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EB658B8A-7A64-4DDC-9B8D-A92610DB0206}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueEssNeedsLoading
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ImagePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Public
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\Environment
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\RequiredPrivileges
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\DsWhv
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\LastServiceStart
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Transports\Decoupled\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Server\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Server\MarshaledProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Transports\Decoupled\Server\ProcessIdentifier
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\ConfigValueEssNeedsLoading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\List of event-active namespaces
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\ESS\//./root/CIMV2\SCM Event Provider
advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
advapi32.dll.RegEnumKeyExW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
kernel32.dll.FlsAlloc
kernel32.dll.FlsFree
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.InitializeCriticalSectionEx
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.SetThreadStackGuarantee
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.GetLogicalProcessorInformation
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.SetDefaultDllDirectories
kernel32.dll.EnumSystemLocalesEx
kernel32.dll.CompareStringEx
kernel32.dll.GetDateFormatEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.GetTimeFormatEx
kernel32.dll.GetUserDefaultLocaleName
kernel32.dll.IsValidLocaleName
kernel32.dll.LCMapStringEx
kernel32.dll.GetTickCount64
kernel32.dll.AcquireSRWLockExclusive
kernel32.dll.ReleaseSRWLockExclusive
advapi32.dll.EventRegister
advapi32.dll.EventSetInformation
mscoree.dll.#142
mscoreei.dll.RegisterShimImplCallback
mscoreei.dll.OnShimDllMainCalled
mscoreei.dll._CorExeMain
shlwapi.dll.UrlIsW
version.dll.GetFileVersionInfoSizeW
version.dll.GetFileVersionInfoW
version.dll.VerQueryValueW
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
msvcrt.dll._set_error_mode
[email protected]@[email protected]
kernel32.dll.FindActCtxSectionStringW
kernel32.dll.GetSystemWindowsDirectoryW
mscoree.dll.GetProcessExecutableHeap
mscoreei.dll.GetProcessExecutableHeap
user32.dll.GetProcessWindowStation
user32.dll.GetUserObjectInformationW
mscorwks.dll._CorExeMain
mscorwks.dll.GetCLRFunction
advapi32.dll.RegisterTraceGuidsW
advapi32.dll.UnregisterTraceGuids
advapi32.dll.GetTraceLoggerHandle
advapi32.dll.GetTraceEnableLevel
advapi32.dll.GetTraceEnableFlags
advapi32.dll.TraceEvent
mscoree.dll.IEE
mscoreei.dll.IEE
mscorwks.dll.IEE
mscoree.dll.GetStartupFlags
mscoreei.dll.GetStartupFlags
mscoree.dll.GetHostConfigurationFile
mscoreei.dll.GetHostConfigurationFile
mscoreei.dll.GetCORVersion
mscoree.dll.GetCORSystemDirectory
mscoreei.dll.GetCORSystemDirectory_RetAddr
mscoreei.dll.CreateConfigStream
ntdll.dll.RtlUnwind
kernel32.dll.IsWow64Process
advapi32.dll.AllocateAndInitializeSid
advapi32.dll.OpenProcessToken
advapi32.dll.GetTokenInformation
advapi32.dll.InitializeAcl
advapi32.dll.AddAccessAllowedAce
advapi32.dll.FreeSid
kernel32.dll.AddVectoredContinueHandler
kernel32.dll.RemoveVectoredContinueHandler
advapi32.dll.ConvertSidToStringSidW
shell32.dll.SHGetFolderPathW
kernel32.dll.GetWriteWatch
kernel32.dll.ResetWriteWatch
kernel32.dll.CreateMemoryResourceNotification
kernel32.dll.QueryMemoryResourceNotification
kernel32.dll.QueryActCtxW
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
ole32.dll.CoGetContextToken
kernel32.dll.GetFullPathNameW
kernel32.dll.GetVersionExW
advapi32.dll.CryptAcquireContextA
advapi32.dll.CryptReleaseContext
advapi32.dll.CryptCreateHash
advapi32.dll.CryptDestroyHash
advapi32.dll.CryptHashData
advapi32.dll.CryptGetHashParam
advapi32.dll.CryptImportKey
advapi32.dll.CryptExportKey
advapi32.dll.CryptGenKey
advapi32.dll.CryptGetKeyParam
advapi32.dll.CryptDestroyKey
advapi32.dll.CryptVerifySignatureA
advapi32.dll.CryptSignHashA
advapi32.dll.CryptGetProvParam
advapi32.dll.CryptGetUserKey
advapi32.dll.CryptEnumProvidersA
mscoree.dll.GetMetaDataInternalInterface
mscoreei.dll.GetMetaDataInternalInterface
mscorwks.dll.GetMetaDataInternalInterface
mscorjit.dll.getJit
kernel32.dll.GetUserDefaultUILanguage
kernel32.dll.SetErrorMode
kernel32.dll.GetFileAttributesExW
mscoreei.dll.LoadLibraryShim
culture.dll.ConvertLangIdToCultureName
kernel32.dll.GetCurrentProcessId
kernel32.dll.FindAtomW
kernel32.dll.AddAtomW
mscoree.dll.LoadLibraryShim
gdiplus.dll.GdiplusStartup
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
gdiplus.dll.GdipLoadImageFromStream
windowscodecs.dll.DllGetClassObject
gdiplus.dll.GdipImageForceValidation
gdiplus.dll.GdipGetImageType
gdiplus.dll.GdipGetImageRawFormat
gdiplus.dll.GdipGetImageWidth
gdiplus.dll.GdipGetImageHeight
gdiplus.dll.GdipBitmapGetPixel
kernel32.dll.GlobalMemoryStatusEx
gdiplus.dll.GdipDisposeImage
kernel32.dll.OpenMutexW
kernel32.dll.CloseHandle
kernel32.dll.ReleaseMutex
kernel32.dll.CreateMutexW
kernel32.dll.CreateProcessW
kernel32.dll.GetThreadContext
kernel32.dll.ReadProcessMemory
kernel32.dll.VirtualAllocEx
kernel32.dll.WriteProcessMemory
kernel32.dll.SetThreadContext
kernel32.dll.ResumeThread
kernel32.dll.DeleteAtom
ole32.dll.CoUninitialize
kernel32.dll.CreateActCtxW
kernel32.dll.AddRefActCtx
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
kernel32.dll.GetCurrentActCtx
advapi32.dll.EventUnregister
bcrypt.dll.BCryptGetFipsAlgorithmMode
kernel32.dll.lstrlen
kernel32.dll.lstrlenW
kernel32.dll.GetModuleHandleW
kernel32.dll.GetProcAddress
user32.dll.DefWindowProcW
gdi32.dll.GetStockObject
user32.dll.RegisterClassW
ole32.dll.CoTaskMemAlloc
ole32.dll.CoTaskMemFree
user32.dll.CreateWindowExW
user32.dll.SetWindowLongW
user32.dll.GetWindowLongW
kernel32.dll.GetCurrentProcess
kernel32.dll.GetCurrentThread
kernel32.dll.DuplicateHandle
kernel32.dll.GetCurrentThreadId
user32.dll.CallWindowProcW
user32.dll.RegisterWindowMessageW
advapi32.dll.LookupPrivilegeValueW
advapi32.dll.AdjustTokenPrivileges
ntdll.dll.NtQuerySystemInformation
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptCreateHash
ole32.dll.CreateBindCtx
ole32.dll.CoGetObjectContext
sechost.dll.LookupAccountNameLocalW
advapi32.dll.LookupAccountSidW
sechost.dll.LookupAccountSidLocalW
cryptsp.dll.CryptGenRandom
ole32.dll.NdrOleInitializeExtension
ole32.dll.CoGetClassObject
ole32.dll.CoGetMarshalSizeMax
ole32.dll.CoMarshalInterface
ole32.dll.CoUnmarshalInterface
ole32.dll.StringFromIID
ole32.dll.CoGetPSClsid
ole32.dll.CoCreateInstance
ole32.dll.CoReleaseMarshalData
ole32.dll.DcomChannelSetHResult
rpcrtremote.dll.I_RpcExtInitializeExtensionPoint
ole32.dll.MkParseDisplayName
kernel32.dll.GetThreadPreferredUILanguages
kernel32.dll.SetThreadPreferredUILanguages
kernel32.dll.LocaleNameToLCID
kernel32.dll.LCIDToLocaleName
kernel32.dll.GetSystemDefaultLocaleName
fastprox.dll.DllGetClassObject
fastprox.dll.DllCanUnloadNow
ole32.dll.BindMoniker
sxs.dll.SxsOleAut32RedirectTypeLibrary
advapi32.dll.RegOpenKeyW
advapi32.dll.RegEnumKeyW
advapi32.dll.RegQueryValueW
sxs.dll.SxsOleAut32MapConfiguredClsidToReferenceClsid
sxs.dll.SxsLookupClrGuid
oleaut32.dll.#9
oleaut32.dll.#4
mscoreei.dll._CorDllMain
mscoree.dll.GetTokenForVTableEntry
mscoree.dll.SetTargetForVTableEntry
mscoree.dll.GetTargetForVTableEntry
mscoreei.dll.GetTokenForVTableEntry
mscoreei.dll.SetTargetForVTableEntry
mscoreei.dll.GetTargetForVTableEntry
kernel32.dll.GetLastError
kernel32.dll.LocalAlloc
oleaut32.dll.VariantInit
oleaut32.dll.VariantClear
kernel32.dll.CreateEventW
kernel32.dll.SwitchToThread
kernel32.dll.SetEvent
ole32.dll.CoWaitForMultipleHandles
ole32.dll.IIDFromString
kernel32.dll.LoadLibraryA
wminet_utils.dll.ResetSecurity
wminet_utils.dll.SetSecurity
wminet_utils.dll.BlessIWbemServices
wminet_utils.dll.BlessIWbemServicesObject
wminet_utils.dll.GetPropertyHandle
wminet_utils.dll.WritePropertyValue
wminet_utils.dll.Clone
wminet_utils.dll.VerifyClientKey
wminet_utils.dll.GetQualifierSet
wminet_utils.dll.Get
wminet_utils.dll.Put
wminet_utils.dll.Delete
wminet_utils.dll.GetNames
wminet_utils.dll.BeginEnumeration
wminet_utils.dll.Next
wminet_utils.dll.EndEnumeration
wminet_utils.dll.GetPropertyQualifierSet
wminet_utils.dll.GetObjectText
wminet_utils.dll.SpawnDerivedClass
wminet_utils.dll.SpawnInstance
wminet_utils.dll.CompareTo
wminet_utils.dll.GetPropertyOrigin
wminet_utils.dll.InheritsFrom
wminet_utils.dll.GetMethod
wminet_utils.dll.PutMethod
wminet_utils.dll.DeleteMethod
wminet_utils.dll.BeginMethodEnumeration
wminet_utils.dll.NextMethod
wminet_utils.dll.EndMethodEnumeration
wminet_utils.dll.GetMethodQualifierSet
wminet_utils.dll.GetMethodOrigin
wminet_utils.dll.QualifierSet_Get
wminet_utils.dll.QualifierSet_Put
wminet_utils.dll.QualifierSet_Delete
wminet_utils.dll.QualifierSet_GetNames
wminet_utils.dll.QualifierSet_BeginEnumeration
wminet_utils.dll.QualifierSet_Next
wminet_utils.dll.QualifierSet_EndEnumeration
wminet_utils.dll.GetCurrentApartmentType
wminet_utils.dll.GetDemultiplexedStub
wminet_utils.dll.CreateInstanceEnumWmi
wminet_utils.dll.CreateClassEnumWmi
wminet_utils.dll.ExecQueryWmi
wminet_utils.dll.ExecNotificationQueryWmi
wminet_utils.dll.PutInstanceWmi
wminet_utils.dll.PutClassWmi
wminet_utils.dll.CloneEnumWbemClassObject
wminet_utils.dll.ConnectServerWmi
wminet_utils.dll.GetErrorInfo
wminet_utils.dll.Initialize
oleaut32.dll.SysStringLen
kernel32.dll.RtlZeroMemory
oleaut32.dll.#500
kernel32.dll.RegOpenKeyExW
oleaut32.dll.#7
cryptsp.dll.CryptHashData
cryptsp.dll.CryptGetHashParam
cryptsp.dll.CryptDestroyHash
kernel32.dll.GetEnvironmentVariableW
advapi32.dll.GetUserNameW
kernel32.dll.GetComputerNameW
kernel32.dll.CreateIoCompletionPort
kernel32.dll.PostQueuedCompletionStatus
ntdll.dll.NtQueryInformationThread
ntdll.dll.NtGetCurrentProcessorNumber
kernel32.dll.CreateDirectoryW
kernel32.dll.CopyFileW
advapi32.dll.RegSetValueExW
kernel32.dll.DeleteFileW
kernel32.dll.GetSystemTimeAsFileTime
user32.dll.GetLastInputInfo
shfolder.dll.SHGetFolderPathW
kernel32.dll.CreateFileW
kernel32.dll.GetFileType
kernel32.dll.ReadFile
kernel32.dll.GetFileSize
oleaut32.dll.#204
oleaut32.dll.#203
kernel32.dll.GetACP
kernel32.dll.UnmapViewOfFile
ole32.dll.CLSIDFromProgIDEx
oleaut32.dll.#2
oleaut32.dll.#6
kernel32.dll.FindFirstFileW
kernel32.dll.FindClose
kernel32.dll.FindNextFileW
oleaut32.dll.#179
vaultcli.dll.VaultEnumerateVaults
oleaut32.dll.#201
user32.dll.GetSystemMetrics
user32.dll.GetClientRect
user32.dll.GetWindowRect
user32.dll.GetParent
ole32.dll.OleInitialize
ole32.dll.CoRegisterMessageFilter
user32.dll.PeekMessageW
user32.dll.WaitMessage
vssapi.dll.CreateWriter
advapi32.dll.LookupAccountNameW
samcli.dll.NetLocalGroupGetMembers
samlib.dll.SamConnect
rpcrt4.dll.NdrClientCall2
rpcrt4.dll.RpcStringBindingComposeW
rpcrt4.dll.RpcBindingFromStringBindingW
rpcrt4.dll.RpcStringFreeW
rpcrt4.dll.RpcBindingFree
samlib.dll.SamOpenDomain
samlib.dll.SamLookupNamesInDomain
samlib.dll.SamOpenAlias
samlib.dll.SamFreeMemory
samlib.dll.SamCloseHandle
samlib.dll.SamGetMembersInAlias
netutils.dll.NetApiBufferFree
ole32.dll.CoCreateGuid
ole32.dll.StringFromCLSID
propsys.dll.VariantToPropVariant
wbemcore.dll.Reinitialize
wbemsvc.dll.DllGetClassObject
wbemsvc.dll.DllCanUnloadNow
authz.dll.AuthzInitializeContextFromToken
authz.dll.AuthzInitializeObjectAccessAuditEvent2
authz.dll.AuthzAccessCheck
authz.dll.AuthzFreeAuditEvent
authz.dll.AuthzFreeContext
authz.dll.AuthzInitializeResourceManager
authz.dll.AuthzFreeResourceManager
rpcrt4.dll.RpcBindingCreateW
rpcrt4.dll.RpcBindingBind
rpcrt4.dll.I_RpcMapWin32Status
advapi32.dll.EventWrite
advapi32.dll.EventActivityIdControl
advapi32.dll.EventWriteTransfer
advapi32.dll.EventEnabled
kernel32.dll.RegCloseKey
kernel32.dll.RegSetValueExW
kernel32.dll.RegQueryValueExW
wmisvc.dll.IsImproperShutdownDetected
wevtapi.dll.EvtRender
wevtapi.dll.EvtNext
wevtapi.dll.EvtClose
wevtapi.dll.EvtQuery
wevtapi.dll.EvtCreateRenderContext
rpcrt4.dll.RpcBindingSetAuthInfoExW
rpcrt4.dll.RpcBindingSetOption
ole32.dll.CoCreateFreeThreadedMarshaler
ole32.dll.CreateStreamOnHGlobal
cryptsp.dll.CryptReleaseContext
kernelbase.dll.InitializeAcl
kernelbase.dll.AddAce
kernel32.dll.OpenProcessToken
kernelbase.dll.GetTokenInformation
kernelbase.dll.DuplicateTokenEx
kernelbase.dll.AdjustTokenPrivileges
kernelbase.dll.AllocateAndInitializeSid
kernelbase.dll.CheckTokenMembership
kernel32.dll.SetThreadToken
ole32.dll.CLSIDFromString
authz.dll.AuthzInitializeContextFromSid
ole32.dll.CoGetCallContext
ole32.dll.StringFromGUID2
ole32.dll.CoImpersonateClient
ole32.dll.CoRevertToSelf
ole32.dll.CoSwitchCallContext
sspicli.dll.LogonUserExExW
"{path}"
C:\Users\Rebecca\AppData\Local\Temp\MV JIA YU SHAN.exe "{path}"
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
C:\Windows\system32\lsass.exe
Global\CLR_CASOFF_MUTEX
OwERkVGvCrCg
VaultSvc

PE Information

Image Base Entry Point Reported Checksum Actual Checksum Minimum OS Version Compile Time Import Hash Icon Icon Exact Hash Icon Similarity Hash
0x00400000 0x004625a2 0x00000000 0x0009f000 4.0 2020-06-23 04:12:29 f34d5f2d4577ed6d9ceec516c1f5a744 56780a67eae1d00b481ace00e5697cdb ebe7ae77e67829ee10e85ba0bcfb1fce

Sections

Name RAW Address Virtual Address Virtual Size Size of Raw Data Characteristics Entropy
.text 0x00000200 0x00002000 0x000605a8 0x00060600 IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 7.91
.rsrc 0x00060800 0x00064000 0x0003d7a8 0x0003d800 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 6.93
.reloc 0x0009e000 0x000a2000 0x0000000c 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 0.10

Resources

Name Offset Size Language Sub-language Entropy File type
RT_ICON 0x000a0d8c 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL 6.09 None
RT_ICON 0x000a0d8c 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL 6.09 None
RT_ICON 0x000a0d8c 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL 6.09 None
RT_ICON 0x000a0d8c 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL 6.09 None
RT_ICON 0x000a0d8c 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL 6.09 None
RT_ICON 0x000a0d8c 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL 6.09 None
RT_ICON 0x000a0d8c 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL 6.09 None
RT_ICON 0x000a0d8c 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL 6.09 None
RT_ICON 0x000a0d8c 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL 6.09 None
RT_GROUP_ICON 0x000a11f4 0x00000084 LANG_NEUTRAL SUBLANG_NEUTRAL 2.58 None
RT_VERSION 0x000a1278 0x00000344 LANG_NEUTRAL SUBLANG_NEUTRAL 3.35 None
RT_MANIFEST 0x000a15bc 0x000001ea LANG_NEUTRAL SUBLANG_NEUTRAL 5.00 None

Imports


Assembly Information

Name bEPx
Version 10.0.12.0

Assembly References

Name Version
mscorlib 2.0.0.0
System.Windows.Forms 2.0.0.0
System 2.0.0.0
System.Drawing 2.0.0.0
Microsoft.VisualBasic 8.0.0.0

Custom Attributes

Type Name Value
Assembly [mscorlib]System.Reflection.AssemblyTitleAttribute Sokob
Assembly [mscorlib]System.Reflection.AssemblyCompanyAttribute Microso
Assembly [mscorlib]System.Reflection.AssemblyProductAttribute Sokob
Assembly [mscorlib]System.Reflection.AssemblyCopyrightAttribute Copyright \xa9 Microsoft 2017 - 20
Assembly [mscorlib]System.Runtime.InteropServices.GuidAttribute 429743e8-20b5-4b12-81a0-3de82a7d30
Assembly [mscorlib]System.Reflection.AssemblyFileVersionAttribute 10.0.12

Type References

Assembly Type Name
mscorlib System.Runtime.CompilerServices.CompilationRelaxationsAttribute
mscorlib System.Runtime.CompilerServices.RuntimeCompatibilityAttribute
mscorlib System.Diagnostics.DebuggableAttribute
mscorlib System.Diagnostics.DebuggableAttribute/DebuggingModes
mscorlib System.Reflection.AssemblyTitleAttribute
mscorlib System.Reflection.AssemblyDescriptionAttribute
mscorlib System.Reflection.AssemblyConfigurationAttribute
mscorlib System.Reflection.AssemblyCompanyAttribute
mscorlib System.Reflection.AssemblyProductAttribute
mscorlib System.Reflection.AssemblyCopyrightAttribute
mscorlib System.Reflection.AssemblyTrademarkAttribute
mscorlib System.Runtime.InteropServices.ComVisibleAttribute
mscorlib System.Runtime.InteropServices.GuidAttribute
mscorlib System.Reflection.AssemblyFileVersionAttribute
mscorlib System.Object
mscorlib System.IO.FileStream
mscorlib System.IO.StreamReader
mscorlib System.Collections.Generic.List`1
System.Windows.Forms System.Windows.Forms.Form
System System.ComponentModel.IContainer
System.Windows.Forms System.Windows.Forms.MenuStrip
System.Windows.Forms System.Windows.Forms.ToolStrip
System.Windows.Forms System.Windows.Forms.StatusStrip
System.Windows.Forms System.Windows.Forms.ToolStripSeparator
System.Windows.Forms System.Windows.Forms.ToolStripMenuItem
System.Windows.Forms System.Windows.Forms.ToolStripStatusLabel
System.Windows.Forms System.Windows.Forms.ToolStripButton
System.Windows.Forms System.Windows.Forms.ToolTip
mscorlib System.EventArgs
System.Windows.Forms System.Windows.Forms.OpenFileDialog
System.Windows.Forms System.Windows.Forms.SaveFileDialog
System System.ComponentModel.ComponentResourceManager
mscorlib System.Random
mscorlib System.Runtime.CompilerServices.CompilerGeneratedAttribute
mscorlib System.Diagnostics.DebuggerBrowsableState
mscorlib System.Diagnostics.DebuggerBrowsableAttribute
mscorlib System.Collections.Generic.List`1/Enumerator
mscorlib System.ConsoleKeyInfo
mscorlib System.ConsoleKey
System System.CodeDom.Compiler.GeneratedCodeAttribute
mscorlib System.Diagnostics.DebuggerNonUserCodeAttribute
mscorlib System.Resources.ResourceManager
mscorlib System.Globalization.CultureInfo
System.Drawing System.Drawing.Bitmap
System System.ComponentModel.EditorBrowsableState
System System.ComponentModel.EditorBrowsableAttribute
mscorlib System.AppDomain
Microsoft.VisualBasic Microsoft.VisualBasic.CompilerServices.LateBinding
mscorlib System.Type
mscorlib System.Int32
mscorlib System.String
mscorlib System.IO.FileMode
mscorlib System.IO.FileAccess
mscorlib System.IO.Stream
mscorlib System.IO.TextReader
mscorlib System.Console
System.Windows.Forms System.Windows.Forms.Control
mscorlib System.Environment
mscorlib System.Environment/SpecialFolder
System.Windows.Forms System.Windows.Forms.FileDialog
System.Windows.Forms System.Windows.Forms.CommonDialog
System.Windows.Forms System.Windows.Forms.DialogResult
System.Windows.Forms System.Windows.Forms.IWin32Window
System.Windows.Forms System.Windows.Forms.MdiLayout
mscorlib System.IDisposable
System System.ComponentModel.Container
mscorlib System.RuntimeTypeHandle
System.Windows.Forms System.Windows.Forms.ToolStripItemCollection
System.Windows.Forms System.Windows.Forms.ToolStripItem
System.Drawing System.Drawing.Point
System.Drawing System.Drawing.Size
System.Windows.Forms System.Windows.Forms.ToolStripDropDownItem
System.Drawing System.Drawing.SystemColors
System.Drawing System.Drawing.Color
System.Drawing System.Drawing.Image
System.Windows.Forms System.Windows.Forms.Keys
mscorlib System.EventHandler
System.Windows.Forms System.Windows.Forms.CheckState
System.Windows.Forms System.Windows.Forms.ToolStripItemDisplayStyle
System.Windows.Forms System.Windows.Forms.ToolStripLayoutStyle
System.Drawing System.Drawing.SizeF
System.Windows.Forms System.Windows.Forms.ContainerControl
System.Windows.Forms System.Windows.Forms.AutoScaleMode
System.Windows.Forms System.Windows.Forms.Control/ControlCollection
mscorlib System.Char
mscorlib System.Reflection.Assembly

!This program cannot be run in DOS mode.
.text
`.rsrc
@.reloc
v2.0.50727
#Strings
#GUID
#Blob
_23561
List`1
toolStripSeparator1
MDIParent1
Int32
toolStripSeparator2
get_MusicPlay2
toolStripSeparator3
toolStripSeparator4
toolStripSeparator5
toolStripSeparator6
toolStripSeparator7
toolStripSeparator8
<Module>
<PrivateImplementationDetails>
SizeF
WIDTH
MoveBM
BOXMAN
System.IO
CSCSCS
HEIGHT
RIGHT
posFlagX
posBoxManX
GetBoxManX
GetFlagPosX
GetBoxPosX
posBoxX
EMPTY
posFlagY
posBoxManY
GetBoxManY
GetFlagPosY
GetBoxPosY
posBoxY
mscorlib
System.Collections.Generic
Microsoft.VisualBasic
MazeAccomplished
gameIsFinished
get_Checked
set_Checked
amount_Used
<Employee>k__BackingField
<OriginalTile>k__BackingField
<ObjectOnTile>k__BackingField
<DownTile>k__BackingField
<UpTile>k__BackingField
<LeftTile>k__BackingField
<RightTile>k__BackingField
<Truck>k__BackingField
<GameObjectsCharacter>k__BackingField
<CrateList>k__BackingField
set_AutoScaleMode
FileMode
get_Employee
set_Employee
UseEmployee
MoveEmployee
moveEmployee
set_Image
AddRange
isAwake
IDisposable
set_Visible
RuntimeTypeHandle
GetTypeFromHandle
OpenFile
get_OriginalTile
set_OriginalTile
StandsOnTile
standsOnTile
get_ObjectOnTile
set_ObjectOnTile
ChangeObjectOnTile
DeleteObjectOnTile
objectOnTile
get_DownTile
set_DownTile
get_UpTile
set_UpTile
get_LeftTile
set_LeftTile
get_RightTile
set_RightTile
Console
set_LayoutStyle
ToolStripLayoutStyle
set_DisplayStyle
ToolStripItemDisplayStyle
StartGame
set_Name
get_FileName
_fileName
LevelOne
ReadLine
WriteLine
JCCOre
get_Culture
set_Culture
resourceCulture
Close
Dispose
AddCrate
crate
DebuggerBrowsableState
EditorBrowsableState
set_CheckState
Write
CompilerGeneratedAttribute
GuidAttribute
GeneratedCodeAttribute
DebuggerNonUserCodeAttribute
DebuggableAttribute
DebuggerBrowsableAttribute
EditorBrowsableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
AssemblyFileVersionAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
GetMapNodeValue
value
bEPx.exe
CreateMaze
ShowMaze
_maze
set_Size
set_ClientSize
LateBinding
ToString
disposing
System.Drawing
SaveFileDialog
OpenFileDialog
CommonDialog
ShowDialog
ComputeStringHash
_gameIsFinish
BinaryMath
GetFolderPath
get_Length
LayoutMdi
get_Black
add_Click
CascadeToolStripMenuItem_Click
PasteToolStripMenuItem_Click
TileVerticalToolStripMenuItem_Click
TileHorizontalToolStripMenuItem_Click
CloseAllToolStripMenuItem_Click
ToolBarToolStripMenuItem_Click
StatusBarToolStripMenuItem_Click
SaveAsToolStripMenuItem_Click
ArrangeIconsToolStripMenuItem_Click
CutToolStripMenuItem_Click
CopyToolStripMenuItem_Click
ExitToolsStripMenuItem_Click
set_CheckOnClick
get_Truck
set_Truck
MoveTruck
ToolStripStatusLabel
toolStripStatusLabel
System.ComponentModel
Level
ContainerControl
FileStream
Program
get_Item
ToolStripDropDownItem
ToolStripItem
set_MdiWindowListItem
cascadeToolStripMenuItem
pasteToolStripMenuItem
saveToolStripMenuItem
searchToolStripMenuItem
tileVerticalToolStripMenuItem
tileHorizontalToolStripMenuItem
closeAllToolStripMenuItem
selectAllToolStripMenuItem
openToolStripMenuItem
redoToolStripMenuItem
undoToolStripMenuItem
printSetupToolStripMenuItem
toolBarToolStripMenuItem
statusBarToolStripMenuItem
saveAsToolStripMenuItem
arrangeIconsToolStripMenuItem
optionsToolStripMenuItem
contentsToolStripMenuItem
exitToolStripMenuItem
printToolStripMenuItem
cutToolStripMenuItem
aboutToolStripMenuItem
printPreviewToolStripMenuItem
newToolStripMenuItem
newWindowToolStripMenuItem
indexToolStripMenuItem
copyToolStripMenuItem
System
Random
random
ShowNewForm
resourceMan
BoxMan
Sokoban
get_MdiChildren
AppDomain
get_CurrentDomain
set_Location
Destination
System.Globalization
System.Reflection
ControlCollection
ToolStripItemCollection
direction
saveToolStripButton
openToolStripButton
helpToolStripButton
printToolStripButton
printPreviewToolStripButton
newToolStripButton
ShowGameInfo
CultureInfo
ConsoleKeyInfo
_keyInfo
get_JTSECxCbotHmRcHoyxCwQVGDmJUGp
Bitmap
ToolTip
toolTip
ToolStrip
toolStrip
StatusStrip
statusStrip
set_MainMenuStrip
menuStrip
Clear
get_KeyChar
mazeNumber
childFormNumber
FileReader
_fileReader
StreamReader
TextReader
_reader
SpecialFolder
sender
get_ActiveBorder
get_ResourceManager
ComponentResourceManager
EventHandler
System.CodeDom.Compiler
Sokoban.Controller
GameController
IContainer
set_IsMdiContainer
get_GameObjectsCharacter
set_GameObjectsCharacter
GetTileGameObjectsCharacter
set_Filter
CanEnter
AskToPressKeyToStartOver
ToLower
set_ImageTransparentColor
Floor
ToolStripSeparator
GetEnumerator
.ctor
.cctor
System.Diagnostics
System.Runtime.InteropServices
Microsoft.VisualBasic.CompilerServices
System.Runtime.CompilerServices
ShowGameProces
System.Resources
Sokoban.MDIParent1.resources
Sokoban.Properties.Resources.resources
DebuggingModes
Sokoban.Properties
EventArgs
get_Controls
get_Items
get_DropDownItems
System.Windows.Forms
Mains
set_AutoScaleDimensions
SetFlagPos
SetBoxPos
get_Chars
SystemColors
FileAccess
components
set_ShortcutKeys
Concat
MoveObject
GetObject
LateGet
DialogResult
Environment
InitializeComponent
set_MdiParent
get_Current
Point
get_Count
EmptySpot
get_CrateList
set_CrateList
SuspendLayout
ResumeLayout
MdiLayout
PerformLayout
AskToSelectMazeInput
AskGameControlInput
ShowErrorInput
_input
MoveNext
set_Text
fileMenu
helpMenu
toolsMenu
windowsMenu
editMenu
viewMenu
InputView
_inputView
OutputView
_outputView
IWin32Window
set_TabIndex
MoveBox
get_Key
ReadKey
ConsoleKey
get_Assembly
set_InitialDirectory
op_Equality
WrapNonExceptionThrows
Sokoban
Microsoft
#Copyright
Microsoft 2017 - 2020
$429743e8-20b5-4b12-81a0-3de82a7d30f5
10.0.12.0
3System.Resources.Tools.StronglyTypedResourceBuilder
16.0.0.0
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPADM
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
cHRM
IDAT8O
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
cHRM
IDAT8Oc
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
cHRM
IDAT8O
tyw%9
m_,!8T
s+B/,{\
$Oi9{
.E)HH
Lech2(
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
cHRM
IDAT8O
tyw%9
m_,!8T
s+B/,{\
$Oi9{
.E)HH
Lech2(
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
cHRM
IDAT8O
Iu'[}gJ
{3T[2_
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
cHRM
IDAT8O
Iu'[}gJ
{3T[2_
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
cHRM
XIDAT8O
o"OgE
)%<QEh|
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
cHRM
XIDAT8O
o"OgE
)%<QEh|
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
cHRM
WIDAT8O
2Rw[m
0Cwa&`Bt
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
cHRM
IDAT8O
/R=E(
aae-1
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
cHRM
IDAT8O
/R=E(
aae-1
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
cHRM
*IDAT8O
Lc(eD
Y!QiQ
ZpT G
NpHvP
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
cHRM
*IDAT8O
Lc(eD
Y!QiQ
ZpT G
NpHvP
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
cHRM
IDAT8O
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
cHRM
/IDAT8O
]t[Sc8
bu/qx
-;d<n
lh:kF
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
cHRM
/IDAT8O
]t[Sc8
bu/qx
-;d<n
lh:kF
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
cHRM
IDAT8O
$dX_wUFvC
><a`v
~FD\,
RcFJ.D
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
cHRM
IDAT8O
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPADk
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
IDATx^
MjR[d
3GdR5)
F)eYl
3pJLA
{[^(n
MHe*4ua
9q!n,
fA}9=>
XY0iH
]!E8!o
4je8~
}Efj]
DUDcj'
l$+|(^/
i6SP<<
3qy:^
p$:OR
@'>/-
<e85%
{aGcY
flR>$^
d=ttLL
5R(Qt8
jE!5C
LT1*l8=
llE)ri/
-H}Uh&+
1UIfd
'7167
#2#>
J4xH)
?bfs;T
B$!#R
}o+os
`2z&S
aj'n&$
^_g+
;y'X+
IykNE
>04+(=/
3d?n}gs
}$2i.
RFpJ.
P-nm~1
%:9z(
j%(;k
ARH-6r;
's~C3?Dn!
>IHc%
; 1[,l
BAHw%
HB^JW
E:Po)D
:k"-2I
3;@*f
-s:b7T(
GWRzg
S`<SX
%5yIwZ
+pSjpZ;
f4Su3
h<5Z5
syN.D
F8y[b
G0 t%
&="x[9
CnA8~
&}Mqf
V4?N+
54+tO
x]9m7
b\iyQI
MH-V*
-mH1=
L|o_[
~,3\:
N{2si]
7x&}2
|!Tz<
JS8W9
73T7l
^<g5a
Qs[Of
T%92*
q4*[S>
ubr$9.*"
Jt$7tt
ch$au
+C1U$
=`mVM'
0T7X}
p~d[d
DRRcq
W(QUM
->I^z5M
y;aG%
%u3NK
m.S5'0s
qNI8>5B
$/PIQ
3zD;[g
"~1joB
e#P%8aaUJ
7hfO`k
~Oul;
\]#PG
w|5}M
nGDBlmf
ZJ|Gbs
5!2GBhs
'6~;_Y
"qV3T
j">h"
lm"vKW
>.7c}
LNrGk&
i?`>x
B2v=0\
T}uC-
T1Q_"&
f|}Mh*
a*Ta~
m6+i3
D0{eM
d,I;'
y|3m!
Y1|WfF
o tC8uk
)X+Fw1T
]J.s6dSQ
~i4?i
yW6[Q
qI9BM
/o }L!2
1>]F2p
!Z_-
e,q9B
;y9zs
_KN&a
qI}7-U
8ObLo6O|
JTw'_'A
.e<^c
8LBgk
caN{Zo
p7zw_L
Jah _
lwXL}
N(Aoow
3t2Oj
X?y`
qjf_t
?Rqf"
xC9cUO
T*1_%R
)EKWl
`js;4{u
!z]% ZC
^oI?4
cjb6
f;.<\Eh
<[]Sx
5pI9Iq
8v4)7f
^p3WN
]Fx 3z
#&Xi)
:K)bS
M;,]#
Fef_6
{x0y:GS
s\(Qmx
CRSp]
Ye- p,
:D#`^i
m!q],
SX%SN
D=Pw1
s^1>~&
=c4X/8
:mi'5p
iFoRM`
k+=,%h
h3<rS
GFs*Z
Z_bem
(q&jr
39e[X
jn[J&K
'q^-"
qH# $
XP=k3
N5 kvGi
O{BhP1
H,&?`?U
x$)_}
73ok2U
"#>*Gc<
&~?V^
|sq9n
9}1m2G
C1O()%
A Aw'j
53u#yRW
\bhZgj
/R1q5
LY~D(
v9\!hQ,
?19fH~v
f/L<M
FjI&c
(>VID
~n]EyT
BTU=_
%]NDv-
[(\UE
z2!J(Q
35>[R
TIJ45
Q.(zW
Wa3m{
Ef\_~
?bEm9
'iP~SL
jF7E(
oN.Ca
"LLcI
p6n./
'&J.l
0vvTb
aOh7i1cv
M%&Qj
B/w.v
VLcKN
*7/nn
f^\|B}
yO|_]
l^Op}_
"P{|F
q.VA`z4
cTdOb
>i">RC
NIwzW
1?SX-
3.>|H
E$N`4
<fU|
lv$uB
{>b%Z
=faQt
>unS1
xK)Nb
6ct)b
Q(w:s"
w%jyo
G_{k>
I&q:;
="i_w\*;^
?1nu6
t75'Z(
;2:g2Z
2:g)P
^+VY'q
fJbCx
m"A83,
(0( X
4{@Gm
dR1[.
"~yA#
zEdG]
g_&<_
_!?fJ
Qs\BZI
gBGnm
p^~0]@,
@'K,5
S&JK\R
Hd}8a
[]9Tj
Q%pfu'V
p`iA>
S9HEF
JCS"v
9)Z<O
'Q ?L
/$4z
{N(s?
atC+vB)
PF7]mZ~
`D|"J
o! j`C
*)q-ge|
63lD<F=\
D^wSr
?8!lI]B..
W3mV!
\(Q7f
ha6Q$
u-mgKqX
+\$%U
]HV((
#;0Ho
c88%]z
#oW3=
mhNu&4
P2"vB
bm&nV
Vyc5R!
aD:n12
^uG>>
Ii\7~{
&`14F
!IsN`
hJ)nj-
/D2n.&-
_80[)
]N~E
qL[^KC
m|YlH
Bm~ki
lLAS3#'
Dy_~6
VBkY"
F|>_B
"~E,-~*
>Up4C
q~$`v
AP^1#
l-z$U
36w3;:_
f[j$Z
QF*F?]E
&Mq2Q
M-#Jv
1!sXX
W"~.j
%6_.G?
lBCp9n
Sdz{3iX
B3OTS
p`oK!I
!xTw|[
s{:an9
Bdf2b+
gOGi[
/<fIC
!zw;c
L *[I
qKXqg
LSIVi
Jn~=W
;g4:gK
9N$o0A
y>M'&qU[
M$fo$
qXaE_Mu
G|B-w
~gT*SF
cn$Uy
@\`!V&
8~1w&y
c"4%:rF_v
m&[FV
$ROj;v
!:g7s
.{ODP
"$&\JB
2Y3J0
x>yEM
ess+c
t6:.A
W~n:!%
'PhfM
M8th;m
&o(U;S
'{1jL
eG}&<]
*vY[i
<{;]781
aw[1G>
IHKS"
WF/%QZ
lF?e3
NbH<]6wdq
Gx*gKb
:wuD1Z
2>UWp
|1(0$,
Co#\#
-3gr`
*={K/
;oi?]
$Y(Q{
#3bb.
Yqh.c
_)gJz
g^25-
P`Ij^
-4-5"t
,I*'<]
AnsQ(
oaGCL
z<sPr
o_l#;
7-NRRF
wzs>L
P6*x,
&\RZ45
|x$}cO1
;JHo[L
M#<>\
-:mIc
(p+D{^#-
D(yK<
z_JzC
6eIJ:
^o5._
,Wb"
/ 0>4
;.%}P
j&fM
ti3"pp
_Q:'a
1M{$_
rj(-a
qDg9b\SE
.c7v<
B!:a4
_.O`f
s\1J=
K)=+K
u?{2-
\d}^9*
i0)={
I={ %
[Eld(
.B'f%
D&+q+K
I4?\U
zd,[4
C)l>)
MLG1&
@RN&c
o7M&Jm
C'&|^K
UivLU
/&#b2
M=^^-
Dn}31{
8o!Q{lY
xn;}cK
rRpo;
ucT.z
KJg9)UR
uM'A
7uj%z
hW,N&
1'SI8n
iv,5G
=p_(Qc
o%7}:
qWSh<
:n%fj
cs0V=d
1A3yY
/.Cyi
f(s%I
|JG_A
-9Ozs=
4+4:m
%q;y:
IvL4 d
k~Dnc
N=OWS"f
=I3(`
@"u&`Un
c\`An
?N]s1
z(x?J
sx8[_
M'3Y[z
1.THo
iV2P_
*l/{
rL9MY
\|F&`
N4+_$
BAaP>
xW7Z>
[>3I"
qd~J&
_(Q%>B
2REk}
8rCXi
{?l'Y
&,dr~
O3R9]3
uRr~ZI
=Czu'
,J+ocP
@r~)v
MPzgq
6w?.f
rk4N[V
42s7K
`+')
tr'EX
JJ]'j,
Q}'{Xd
~[ObS_
\URn8
;#V,l
~/95&
n!|`;?
eNdD_`
uRm,e
[4%UA
^!5}!
cGJz:
P[z*l
vj(c;y
HB!]/
0l.B)
"~vrM
LDWW<
d:'~xI
qg]I-T
z6vsA
!2c"3
QTSIcq
`HrT#
OmG+o
w2rCw
Y(<wR!T
`3MaF
94UKp
{xHHK
L~lBL
To&IB
nV_h&p
bGwaG+
'I#Zi
r<Q(yO
9>l2uR
WT s|
PRRaG
W>a;;
I$+b=
%%")VjVv
g~bwQ
L,V+Q
cSx]:
MUvbo7
w9GxC
Mgn0t
&^@z*
raGKJn
wm4v^=
s&P/Q
&R$!g;
cW 57b
}r?rD
);b0H7E
7N$!c
U64FFR
10NZy
[~4Lc
JVgw"+
MGShH
j!]\FP
wo ]@
4k 3v
Q"~e:>
nCb_Nf
Dg~iZA
d\p#W6
z+QWGJv>r
K)nuC
v?N,<
.X1mk
sWr;v
CzrD?Y
IDATy
n$i4\i6
_kFp0
o$%/`
|l(A/
sW"n5
pytG)
a~`%w
p*eWX
g%&Oj1
%ea)w
q?a5E
7Y?*b3p
:wBSt
)e`p7
Xv$F8!
n^l{9
vT# jA
Wssiq
{Z1oX#
h;z?}
jf8~Ki
K~pO&
WmhD.
PyZ=r
;v>u>
/Vpou
( z?P
nh$1M
/#<KW
`wj.=
DU$|Y
QQ4vF
{2kX'
|n34{
WT;}*
A*&*W
:iMb,
fsC(i
UptN2
aewer!
C|\#
Qy7QZ
mV0' 9
JIk+9
1OP{ZR7
iXi!`
swg>Q
\w*GM
U3Oz1
ayD>m
8R;$#w
2lc\I
7{d1*
uuiKag
~G~X4
:{S<m
T$vK"k
*]8!O
E!|T##
4&7FMY
(qnp!&s
q'Kz5
w0'fY
P'<;W
78E$q
3MSBY
|=#4Un$^
5:[%%z
!K->g
NzkHM
$vT3E
nyoj\
7^(y7l
3/LW!
+zoZ/
DK>@T
E=i[j
AoBwV
9X8tGnRM
~[omg
;LUi0
ay#8w*
VSsy-g
HwM'7
e<-v!
h\@LX"9
d&1_h
gUx)U:
J>.}?
'5A(a
h<c]1
J!jJW
T# i
JT$!m
=p->DZ
DQzg&
Q+qXb
)cWB-
*<X[%
O}X7`>yG\%%
Otd{RbN
!9j0+7-ed
*2X5l
$>^?Hj;v
l!vJ'
~QLYS
_k&$a
K_a~1
+Me4?m!
6E'QD
H}z;:
h#mb{
)h<vd
PnUAT
qm&jU
b/~=Xq
,sXo<zA
.OAgA
dFGi
"?2`CA.
Kd.F,
b'qzu
;n)_G
m<RA8/
DVj:gl
Is7G5v1
~]Jmc
J:kw!;
q#V>^
Du\Lx
Fq\O^>*bL
}D7Jmf
Lwr|-
Odn.c
p*"gR6
v*M9*
%T(Qu
HbK&1
LJBNK
F}Gl^
PJZr7^
%e" 0
}XFZJ
3[@#]>
LbiS>
\(y_2
}Bi]Lf
Vv;sG(
Fl[m,
Y}QhTK
]d1BI
wr$`y
3C|~K
%/i3E
;abU/
F^8os
x:nvF{
"?dMD
ct7[F
D7Or"H()
>mC|x
4~T{?
rWbnh1
+-X[c
o|VqK=
S_N]7U
}G6Ku
VvKJ*[
rrGM`51
4T(d%
o>!_|
`"-7RX
b)7l/
D{30o
[) j$
VvwPm
*~]@
_Iq^/
}T.[D
B$A4*
T]'Yt
T[LdE
le.'g
MaG{w
J^YtB)
aewBd
[d0%a
3e}G&
a<;VM!
j+cc\
"[C7a
0LlgB`
5^%+0
WS) :N5{ 0
fc3M(
u]v:-a
#TBYC c<
CT%b~9
O;U(Q
4~vR(
54OyL
g9S3v
Y?HwR
a6cBT
7SLS`
)<Dyp
N"~u1
JBZ.h
6:/Bc
_+ jGN
j-[R^
mBI93g
JR}V_J
Jet#=
>9J5T|
tt+iij4vMc
vL(Q;
MZ,Cy
HU*JC
Gg-.U
oD1n$
q*M(y#
CFj~!
ybU$
uf]n&)E
.SYd'
Stt;Bu
{$5u2
9o7N&l
^"~*E
)mVXw
_(Q#:
>b-7-
v#GeG
, PK~/
O()ua
O;BX0
pp:UF_b,
-BaFQ
':_(Q
uO/qf
bjTI(
8'CwR
?FCnc
@yf8Ic
P5rf-
I|Ay4>
OKpN5f
;WwEr
n39`=
$S,oa
0f)#1
=#~8C
LDoW'
-/x6r3
.Q($W
h%F)+Xa
9YjBV
\)T`d
dkbRK
{psUO
"m<w/
)O+?AY
UdwTA;
Y]:a+
c)1t5&Y
0Ak%h]
Ght<q
b*]t0
}Y|$k
Rrq*i<
z]v.Q
+B9yQ
kg;a)
=Aim/
Q#C{i
OFVSc'#
SfDa9
#hh?O
Yf=Ixn
LE^`"
_q.s
N4b&]
09/7Gr
s%Bk%XC
gNz.e
$i|:E
!]0y/t
P0y+J
jy"W]Zp?e
aiY\h?
Og^q!
>!#Rh
Viv^M`
{l&JE
Z'6f6
RhMUj/
ffWF||
>QMFu(
X'"~sa
|*k&[
*QPho.
h"G0i
cOC9Y;
1L>sS
k[HV_+
M*'ze
{dl|?6
"d/'K
!R|>]
MR`Ze
']M9x|
hzo%-
RkoNu
tc5YE
m]+1Y
|ru#c6
Hcq_,
*^2A]
TW(hSb
w)n?O
sjoLg
fOPwB?
[l0u3
d$JL4
(1)W#
I?kcd
_"#v<
_zF~NR
8L)At:1
\OVMyJ
r>F!$
|0+o!I3
+.}0 )
P)kaW
:r(}5V
Gptog
Iu&rZ#
QTTc/P
-AcbIp
2iewD]
jCXR#
)&Qa[
'e{T:
\0K#_
[;|PBe
P;AZ6
<vLZM
Z+7{R
>m2It
LYq4I
? zEW
??ZZO
k'v6R
+tTNbb
Vrb{##
X-diU[
X`,@t)M
axm/|u
D5:{$
K[%nC"
!a`%~
\nU1BH
v^uDw
J0}E"
`,Xb.
`U6;5
Z;v\B
<3"Vz
#.9|C
"wN!^0
t{~AB
H`Bz
j0g}~
>rD "&&
OyIy6
6mh?u?
'p<2!
~A"~>D
9##Yi
U:{qL
2iXcK|
C)m;v
d^$LWS
_lsRX)@
6s.n>LP
8W2^T
;B{mV
x!kB^re
*%B(Q
f?17#vk"
aHT]q
-;X\6
@bBSl
Q#cZ^
'sAj9
N>I LX
f.\lG
' FFnT#
*T.e4<XI\
4VS6&
7_t$FH]T(Lm
BRzJIl
sfyTr
i7R{Y!
:cTTKE
Ii(,TXu
st%/j
u^FTc
|VoQ`
<ldXCW
cTH{k
'*"3:
\kq|?
V1O4!C
kfVT=ycc
l2c&1r
SVQiSL
\4!9V
Y4HsN
9HBjX
W~DmQsb}
me.SS
G;i:]
Vdc;1
#a/_P
4V%cP
dNF4%D
wHM7 `
4By]lA
Qjl>tA
{s&|
S1K~M
bww5'
Fyi.A
F{m1-
)6cax
_ko|-
e~x;'
XQ?/M(xc
Sszq,
`Q?{>
=s{8q
3(wZ%
qusbQl
j#.J&
LrZ;a
ZGz\<
7>2~3
+N$8Iq
"Y}CX
MMfD=A
p|5--
Z;m6F(
9[N]eJ
ht+TxL
)a;9[
am\>h
UQbb&
fO9}i
M&R{D
Pk2r4
Uk9zgu
c>h#r
sUGN&t
5)Vf(Mw
G?w"2Q
1R[Wp
[6%>s
"]{m6
:.,kG
c(QBI]<
E1k,*
KXV&gb~$
,o$!T
bN6Xq|
?0uY7
8;_eo
"wAmu
-WP|}8knv`
J4H(Q
Ar}Sq
fPbd3V
/vIdFD
|}>/v
_'oa_
\smV3
:+_(yw
s85z+5
N_{N4
eLyj(
G4!GM
pB'k9
%$t>N
BSK"*
?Y0=A
LGl2o#
o?Nej
?=NeM$
5Gsru
b!^u(
PK5)N
K'brWkO7d
6{`ch
kMhY8
mB_tp#r
t):fC
a?.X(
xwN"f
Kjk.icc
&+Q(i
\";;G
J2W2{
gz4F72
LgK)Q
JjMD7h
_k&S4
}V$;&
e/=n,
kG`y5
eOxph
@hm0k
YNma(
&dBJd
uUOFt
gDm*a
"WR,^
SvP3rZ
K<:Le
-y=+zGQ
:rx2BI
JpC"5
i??|:
<oSb&w
M/;3$g
yBIIM
EH:jn,
D4qk.8
PunC2
Y^|;Z
f;ICi
u/*?5
7s"z;
byr:w
S(x1b+
tI?CvB*w+
r.-S4
}fmcS
67Mg[
!pn,Y
u3~}BI
AI>[>-
v~u-yg
PRA~gp^|
~JO"4
N/MM2/(
QIWE9q
6}Tv>s
ke0^(Q
f/z9E0
x^z"Zb
o,Ei4
93Muc./G
[|.wco
yO17L
6&$Jxi
2~xW\3
XHtYP
o~'=#
z71Fu&%
VMBsF
IDATj
</jZn1
HBuG6W
gBF|=
VGuU3cE!
lo2$8
|V'TS#
UJrw~-
Qp=f)
;s+LuOS;
D2otOv
--B'"
%rQI.
_cGAy/
k,i9$
|Oc4?
}~b_O
Fy,SM
u{6Oz
blgua
7Y? _R
"x5~n
R"*F0
y;Nrcfu
tu9:s.
Uw*yT
#DZh3
amFBIMEi_N
x~=,~F3
,{Cn0w
%w9Rw
;_# `#w
!*!X"Ug
"7v&D
4\=YA
dr+rU
nD:J97
(C{_wvjF
&h9P{|<
LEm${
|zpnu_
~wui3
Lum69
lLpF"
i=e|]
UbTsW
BqSw6\ZD
7l59(@x
iVVdFF
jR<DR
L%1TNx
@}&?((
{`1e8M
Gv/P]
KpS4#
}y4=>9
.X'Rx
D=iSA4O
J XeG
8c?l#
J}<u$
(<FsW.!
``49?
s8}E%x
P<sN<#)T
pX(Q#
XJ#)k<E
GO;b5
T^$|A
#!2Ne
I}A5k
%y~S8
fQA_R^[S
JJu&%
K()K}
rt8Uc
0([(Y
j#B6S(
1MQA/
Pw[Jm
ca7m2*
q.2C/
\T-NM
s[F]
1!x4C
&^C;@u
-(\[xy
OJ$|a
~UFYW'
m&{Y(
>u9C(
azDj/#
PpMVc
$u(x#
>"B}&/
)]yqt
BImXf'
%o% ZY
CbC3Y5
-22rip
,#Oo:
UnAE#$
'mZ}x
@?M;2D
DNd>Y>6b
+e8Kg;3Z
I'lU'
j;oc\
\iO'aG{
mG8[Tv
v5a[?E
e?Db$
/!O6I(
_{VQ/
Wu\=r
tPv&S
YEav%
X"jwc
'^fUm
dF6J3
5G_*H
UHgRz^r
k:h=c
|Hc\,aE
#/.C|
EJO~;
JyzoTV
T%#{?
o9BD{?
{-']S
6O7:&
c^Wyb
oh3O&4p#{:~L
3"'=B
#Y\m/
o(2>G
Y?{0sO
7!*JAfq5
O{xqk}
Y%imoQ
Tj*,,
? 'w0qe?
'-Wt$
JT/m3y
y3~Ok
Q^"[]
~NEiW
WXx#,
DGR+k
8cya&u
(cMHW
wI `H
U6u!L
!lB$U
Y^'04
XlvG{Q5
:y$*w
xZ67#
lotB.
9qH{:
/m5<l
U4TQ9!WJ
lvk4e
#<]EFK
2rf5K)v
sT(ykR
[}M+F
s,sh&]>
UH:5"
61nG>+Vw
x`W2>'zq0#O
DMGJv
#8?^I
>E:N*h,
LKh7&
=J8>~
):fJJL"O
><xaJ
WDE9Q
Ukd8+
Vz [TNw
e8*'1t
g;7h'
1OS6[D
H%6d U
2}.UL
P8s3gf
`+U,9
1zjIIU
iN!~d
55Yixf]
\zYfs.x-
."I\j{
"R}PZN
{T2N<
v>>:R
kZ1~DN
]^@a7
KK6k
(cV&M
d*,|Y
d(eGL1
2kd'2
NlD&
,qpH!
[Vk#M
t1r[s
:RtM$%u
ah/Kfa
PG;*6
z~k{,
x')ELV)
FI)ZE
?Go%lx
(Q;aG
mq|# $
Tg\ZO
w-)EL
`\'M!
Jv>-
@^j.6E
?)fT'
Or&,zL
Q,0Au
HB*>E3h
![.ct
u.+o
w#sW/
w.=O\`
kN0;h-w
?LlboL
`L;M?Q
{vAif-
AjT3uq
J>pu5
AICe(.
P:dJv>
M[ITD
_Ea\L
wyXbM'
Arz}g
kK!J+
zaG/s
JTN2{
K[Q)&
"hF<1k
Iq2}9]
Z|! p
) :&J
9aG#1
?z_6k
Qt-P"
!^XW7S
So&>v{
28a26
gj{_"Z
p4nFqp
p%Ts;
t0}pn+
g72BN
&?`t}<kG
_i *6
(3}9Y5
v~!Y*
p&Q5e<\
dz<em
]CxSy
(BojQw
w ^],
KJU%'B
z!?eTc$~i
7s(4\
xx|Nq
3S(1S'
on\9u
vDk,6
4e6'D
X7b?;
%'fRq
Rd;*],
AR^/Z
j_Bt~
/&W'Q
!^@8CX{
:9P72
&k=[)D_
m<%e5
s,!g2
t"7^?O
gCy?1
W/Dc)
Lg|x_(
3_,ZD
Tl:^c
|^q9NM
:aGmw;rEn
>"
},#ok
\eOhs+}
c!cxK
IQx+K1r
:g.~YY
DU3TlP[
l(TSnW
A6${\d
<94^(
8XGNU
<WzsEX
Ay<L[
T<^N7
N&y?ci
G7\*Bm
%4v&^
U5l[o
Oz]Qq
%6}=9
k}TbM
Y9f(^
H([oa
AU1Nn
{w/fy
Tc<u=
xoPpD
p/Sa3
1(nJ}
tQ\'y
c$^N!,
%c&}N
rzt
D'aP.G
s:g)&M
JHaJd)
vX(ac
KD3+?
jO|bK
I`U"g
j6a*O<
kw7ab
_'=v8k
F#C4t
L_Qlt
fI*:O
?U1E1
&]_BTX
gkl1z
n'\eK
VK-NQX
c1dV3
vsdYc8
k50)b
AKig\
&2mP:
W/I}f
6zU6-A
2BVVq
bbro`f
__) *
NtXkM
>M#,u
so*k7
U{|#"
os,?>HRG{L
-T;4r
v>nE9Yq
dv$&B
g{IX\A
hVJ)X
X?iZo
=0m1p]
u$#zLcmOw
!This program cannot be run in DOS mode.
.text
`.rsrc
@.reloc
+$+)+*+++,t
+O+P+Q+V+[+`
+a+fo
*BSJB
v2.0.50727
#Strings
#GUID
#Blob
MusicPlay.dll
MusicPlay
<Module>
Player
mscorlib
Object
System
PoweredByAttribute
SmartAssembly.Attributes
Attribute
QSQWDWD
QSQSQSQS
System.Drawing
Bitmap
WDWDW
Pause
CSCSC
SCSCSC
.ctor
CompilationRelaxationsAttribute
System.Runtime.CompilerServices
RuntimeCompatibilityAttribute
DebuggableAttribute
System.Diagnostics
DebuggingModes
AssemblyTitleAttribute
System.Reflection
AssemblyDescriptionAttribute
AssemblyConfigurationAttribute
AssemblyCompanyAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyTrademarkAttribute
ComVisibleAttribute
System.Runtime.InteropServices
GuidAttribute
AssemblyFileVersionAttribute
Buffer
BlockCopy
Array
Image
get_Height
GetPixel
Color
FromArgb
op_Inequality
get_R
get_G
get_B
List`1
System.Collections.Generic
AddRange
IEnumerable`1
ToArray
get_Width
String
Concat
Assembly
GetEntryAssembly
ResourceManager
System.Resources
GetObject
AppDomain
Microsoft.VisualBasic
Interaction
CallByName
CallType
Int32
ProjectData
Microsoft.VisualBasic.CompilerServices
EndApp
Thread
System.Threading
Sleep
GetDomain
WrapNonExceptionThrows
MusicPlay
Copyright
2020
$d8f693c2-8fa7-4631-b7fb-ac387c9df7fb
1.0.0.0
#Powered by SmartAssembly 7.3.0.3296
_CorDllMain
mscoree.dll
_CorExeMain
mscoree.dll
IDATx
'JDpJ8'
=UV:0#f
Ln20A
G!d,A
!H)S2
Z{viy
BPnTQ
*p0A U
#@FP*B
P jG ./
YdP2F
r2__w*
l71hm
R% ,Pn
/Ru0!
It\dQrP
Sd1iV$;
j8:hx
`Svk#
hQbvO
4]+l-
s%R.0
+=9>m
LdrN2
!FBh:
tjJz\RJ
7;0.-
T:}a9
N[O=X
H6~aJ
{/_m_
_=pr~
Ul--M
9ba:&
]=s3v
-?Z2E
Sbf$0!
'A<J'
0<yq'/
:j{f`X6
(:p{#
|[6&/5!
lln^A1
,i2L-?
(7jznB
Q\.0Y.2
I^@1E
F)I:hM\
sgt~?
3O$4G(
"M=/&
T$!#m
z?v=D
}NKbAA
q?+[0
IDATm
@sl,R
[UQwO
rs.B0
j9l\=
[/_FzN%
_0?V>
5I*4P(
tohHAg
3!?'D
xXSBy
lT2FECT4$
yaYpq
,s08(
T2*#_
4*/XE#z
/fFBm
A]mjJ
t81D^
SzowiL7
{*#xi
7Y];h
zxj&2
G`It.
^Hja`
bbiF2e
{Te$r> pgC
|("P(
9/pp^
wA[X*
m%S$v
3LR&YF
a:PH[rr
St21'#m
-KHIws
hLD`p
01k:A'S
\vT25(
97Gk~
R$2?V
hI)S-
P)ZEH?
br'%M
a5AX%
W.6~>
3(@HL
=t6A?
5%H',d#t:B
h{.|t4
R&#.h-0
<BX $
cT6D'
BHSvn
vL>z}~
[Fz+X
'lz&+
='\DP
kK7i//
IDATSt?)
[bQ.rU.
^BVgAx
kKWi/]
_Y$Z]`Q
,PvfgS6X
G8>J02T
&5{lz
g&lHi!
;h-7F
4EcTI0>
<S=+G
BE)i7"^
2X_&v
,TneT
?o_^t.2(
,\:cNK;
-CHTq
@TPSq$
mpMQ:g=b
`%WqS
(AE}T
e"pfW
k6+P9L
Onuns
@1:9JX
f^2L .
$j=SH
IDATH
K{<:=
9TET}
x?2>L
F24j<7q
E-#(]
:]%Y~
0G?x/
[_&M7J
F}T?B
ZQmTH
agB[}xP0
=t.03
w^s40
b+YD>
78*momD2O
F*@NY*3Dl
`=C(GO
1*3py
&fG,A
AiZ;y
9(Z9BY
CV,HUrG
!CVpu
\2%N,z
vl3Ez
V:\k|
EkY#S
aP!Z6
=<? Uk9
U"ImqP
bTUHk%F
2V;@}
RT?^/
Ea<4c+,
(FkMP
+U]<YTT
.On=Csz
^m+"h"
)JUYXX
QV-P
8N/:I
GkkRc
F]"?"
`L8XFh
1&O3&
.+3NH
`d6)J
m\=_P`
8LF|o
-FG;v
IT!CS
F`[sc3
4g:LNv
gt:x
Oz<1[
0>2xq
?k#]dC
0"~4$n
vOEA<J
G}.>~
IDAT?
MLjSo
1>&_Be
Sk<rY1
CTM-g
ONYO6\
uP_ ;~
+g^+a&
m82<>v
06qIc
Q`& |
Y'^3D
RI;"Jh+
l6c\c
f9yfH
QLFwiu
su:AORd+
55hxtDC=f
j!)Q.X
VUYU\&G
6E2h!
sDk%F+
lg'`u
i}1w=
&lU,
z4:-.>}
w(1s^}
WZ~1"P
7ZcrEvgh
`|:pZ
.lFC:
BJV/]
#y-gi;
d%d'W
O!UDu
5 f}i
ft[d!0
=A=|;Eq
V<("L
,^_bf
U0(5,
n#d,iXR,
MNje`9
Y4/o e
5SRQH
w%+K1[
6tJ/)
rWR,?
'M+Y.
zL7J2
-?gRd
X&f1i
>3Gub\3G:
P*0>;
eB:~ZJ
!A,yd
6=Fse
JYw .8:
7rD 0
\\egu
EDaR~
ss<\u
I-{v9J
C)76e
`m'h=|
/&u{-
X(&J
ISJDH
'y(M\J
up5^G
LeJ|~!
B(T<,
MlQF`Rp
<yH\Z
1WNQ^
tbC6k4%
61,C_
s]}:[
~4#1$
uyoZi*L
d11_#
X"{!q
8cyGf
x' Je
R"0ut
HA&C)
]-S>2
."Dg8
k_j~2
IDATKO
HfZh$
'fHhw
_iU'f
>4L'#
"N=|:
H U]i
0Zf>/
jjN_%
FzlwV
=B}iI
/^:S?
~qk;ZGz
rl9vmLKnl
7lSIC
{Ag}k
:_5_8
*;%|
.=Z t
!*' m
$-%"r
0>G#y
EZv"z
.;4(z
!%S8w
$-!"d
G]f(p
UizQ
JXk\
IYc.h{
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX
.27<Z_
JTSECxCbotHmRcHoyxCwQVGDmJUGp
GetType
MusicPlay.Player
GetMethod
Pause
Invoke
Sokoban
..\..\Doolhofs\doolhof
Window
Text Files (*.txt)|*.txt|All Files (*.*)|*.*
menuStrip
MenuStrip
fileMenu
&File
newToolStripMenuItem.Image
newToolStripMenuItem
openToolStripMenuItem.Image
openToolStripMenuItem
&Open
toolStripSeparator3
saveToolStripMenuItem.Image
saveToolStripMenuItem
&Save
saveAsToolStripMenuItem
Save &As
toolStripSeparator4
printToolStripMenuItem.Image
printToolStripMenuItem
&Print
printPreviewToolStripMenuItem.Image
printPreviewToolStripMenuItem
Print Pre&view
printSetupToolStripMenuItem
Print Setup
toolStripSeparator5
exitToolStripMenuItem
E&xit
editMenu
&Edit
undoToolStripMenuItem.Image
undoToolStripMenuItem
&Undo
redoToolStripMenuItem.Image
redoToolStripMenuItem
&Redo
toolStripSeparator6
cutToolStripMenuItem.Image
cutToolStripMenuItem
copyToolStripMenuItem.Image
copyToolStripMenuItem
&Copy
pasteToolStripMenuItem.Image
pasteToolStripMenuItem
&Paste
toolStripSeparator7
selectAllToolStripMenuItem
Select &All
viewMenu
&View
toolBarToolStripMenuItem
&Toolbar
statusBarToolStripMenuItem
&Status Bar
toolsMenu
&Tools
optionsToolStripMenuItem
&Options
windowsMenu
&Windows
newWindowToolStripMenuItem
&New Window
cascadeToolStripMenuItem
&Cascade
tileVerticalToolStripMenuItem
Tile &Vertical
tileHorizontalToolStripMenuItem
Tile &Horizontal
closeAllToolStripMenuItem
C&lose All
arrangeIconsToolStripMenuItem
&Arrange Icons
helpMenu
&Help
contentsToolStripMenuItem
&Contents
indexToolStripMenuItem.Image
indexToolStripMenuItem
&Index
searchToolStripMenuItem.Image
searchToolStripMenuItem
&Search
toolStripSeparator8
aboutToolStripMenuItem
&About ... ...
toolStrip
ToolStrip
newToolStripButton.Image
newToolStripButton
openToolStripButton.Image
openToolStripButton
saveToolStripButton.Image
saveToolStripButton
toolStripSeparator1
printToolStripButton.Image
printToolStripButton
Print
printPreviewToolStripButton.Image
printPreviewToolStripButton
Print Preview
toolStripSeparator2
helpToolStripButton.Image
helpToolStripButton
statusStrip
StatusStrip
toolStripStatusLabel
Status
MDIParent1
> gebruik pijljestoetsen (s = stop, r = reset)
> Kies een doolhof (1 - 6), s = stop
=== HOERA OPGELOST ===
> press key to continue
___________________________________________________________
| |
| Welkom bij Sokoban |
| Betekenis van symbolen | Doel van het spel |
| | |
| ' ' : Outerspace | Duw met de truck |
| '#' : Muur | de krat(ten) |
| '.' : Vloer | naar de bestemming |
| 'o' : Krat | |
| '0' : Krat op bestemming | |
| 'x' : Bestemming | |
| '@' : Truck | |
| '$' : Employee - Wakker | |
| 'Z' : Employee - Slapend | |
| '~' : Val | |
| ' ' : Valkuil | |
|__________________________________________________________|
_________
| |
| Sokoban |
|_________|
________________________________________________________
________________________________________________________|
Sokoban.Properties.Resources
MusicPlay2
copyToolStripMenuItem.Image
cutToolStripMenuItem.Image
helpToolStripButton.Image
indexToolStripMenuItem.Image
newToolStripButton.Image
newToolStripMenuItem.Image
openToolStripButton.Image
openToolStripMenuItem.Image
pasteToolStripMenuItem.Image
printPreviewToolStripButton.Image
printPreviewToolStripMenuItem.Image
printToolStripButton.Image
printToolStripMenuItem.Image
redoToolStripMenuItem.Image
saveToolStripButton.Image
saveToolStripMenuItem.Image
searchToolStripMenuItem.Image
undoToolStripMenuItem.Image
JTSECxCbotHmRcHoyxCwQVGDmJUGp
MusicPlay2
j.#s.+
.Cs.K
.Properties.Resources
EntryPoint
Invoke
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
CompanyName
FileDescription
MusicPlay
FileVersion
1.0.0.0
InternalName
MusicPlay.dll
LegalCopyright
Copyright
2020
LegalTrademarks
OriginalFilename
MusicPlay.dll
ProductName
MusicPlay
ProductVersion
1.0.0.0
Assembly Version
1.0.0.0
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
CompanyName
Microsoft
FileDescription
Sokoban
FileVersion
10.0.12.0
InternalName
bEPx.exe
LegalCopyright
Copyright
Microsoft 2017 - 2020
LegalTrademarks
OriginalFilename
bEPx.exe
ProductName
Sokoban
ProductVersion
10.0.12.0
Assembly Version
10.0.12.0

Full Results

Engine Signature Engine Signature Engine Signature
Bkav Clean MicroWorld-eScan Clean FireEye Generic.mg.925cba90f4d80775
CAT-QuickHeal Clean McAfee Clean Cylance Unsafe
Zillya Clean SUPERAntiSpyware Clean Sangfor Malware
K7AntiVirus Clean Alibaba Clean K7GW Clean
Cybereason malicious.d09e91 Arcabit Clean Invincea Clean
BitDefenderTheta Gen:[email protected] Cyren Clean Symantec Clean
TotalDefense Clean Baidu Clean APEX Malicious
Paloalto Clean ClamAV Clean Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Clean NANO-Antivirus Clean ViRobot Clean
Avast Clean Rising Clean Endgame malicious (high confidence)
Sophos Clean Comodo Clean DrWeb Clean
VIPRE Clean TrendMicro Clean McAfee-GW-Edition BehavesLike.Win32.Generic.jc
Trapmine Clean CMC Clean Emsisoft Clean
SentinelOne DFI - Malicious PE F-Prot Clean Jiangmin Clean
eGambit Unsafe.AI_Score_98% Avira Clean Fortinet Clean
Antiy-AVL Clean Kingsoft Clean Microsoft Clean
AegisLab Clean ZoneAlarm UDS:DangerousObject.Multi.Generic Avast-Mobile Clean
Cynet Clean AhnLab-V3 Clean Acronis Clean
VBA32 Clean ALYac Clean MAX Clean
Ad-Aware Clean Malwarebytes Clean Zoner Clean
ESET-NOD32 a variant of MSIL/Kryptik.WMH TrendMicro-HouseCall Clean Tencent Clean
Yandex Clean TACHYON Clean MaxSecure Clean
GData Clean Webroot Clean AVG Clean
Panda Clean CrowdStrike win/malicious_confidence_60% (D) Qihoo-360 Clean
Sorry! No behavior.

Hosts

Direct IP Country Name
Y 8.8.8.8 [VT] United States
Y 1.1.1.1 [VT] Australia

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.1.4 51228 1.1.1.1 53
192.168.1.4 62350 1.1.1.1 53
192.168.1.4 137 192.168.1.255 137
192.168.1.4 51228 8.8.8.8 53

DNS

No domains contacted.

HTTP Requests

No HTTP requests performed.

SMTP traffic

No SMTP traffic performed.

IRC traffic

No IRC requests performed.

ICMP traffic

No ICMP traffic performed.

CIF Results

No CIF Results

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Suricata HTTP

No Suricata HTTP

Sorry! No dropped Suricata Extracted files.

JA3

Source Source Port Destination Destination Port JA3 Hash JA3 Description
192.168.1.4 49177 13.107.42.23 443 3b483d0b34894548b602e8d18cdc24c5 unknown
Sorry! No dropped files.
Sorry! No CAPE files.
Sorry! No process dumps.
Defense Evasion Credential Access Collection Privilege Escalation Persistence
  • T1116 - Code Signing
    • Signature - invalid_authenticode_signature
  • T1055 - Process Injection
    • Signature - InjectionInterProcess
  • T1045 - Software Packing
    • Signature - packer_entropy
  • T1003 - Credential Dumping
    • Signature - infostealer_browser
  • T1081 - Credentials in Files
    • Signature - infostealer_browser
  • T1005 - Data from Local System
    • Signature - infostealer_browser
  • T1055 - Process Injection
    • Signature - InjectionInterProcess
  • T1060 - Registry Run Keys / Startup Folder
    • Signature - persistence_autorun

    Processing ( 3.4149999999999996 seconds )

    • 1.55 BehaviorAnalysis
    • 0.801 Static
    • 0.286 static_dotnet
    • 0.27 VirusTotal
    • 0.245 CAPE
    • 0.055 TargetInfo
    • 0.051 Dropped
    • 0.048 NetworkAnalysis
    • 0.025 Deduplicate
    • 0.02 AnalysisInfo
    • 0.02 peid
    • 0.018 Curtain
    • 0.018 Strings
    • 0.005 Debug
    • 0.002 Suricata
    • 0.001 ProcDump

    Signatures ( 1.5709999999999982 seconds )

    • 0.361 antiav_detectreg
    • 0.129 infostealer_ftp
    • 0.121 territorial_disputes_sigs
    • 0.074 antianalysis_detectreg
    • 0.073 infostealer_im
    • 0.04 antivm_vbox_keys
    • 0.038 stealth_timeout
    • 0.036 api_spamming
    • 0.035 decoy_document
    • 0.027 antivm_vmware_keys
    • 0.027 masquerade_process_name
    • 0.025 NewtWire Behavior
    • 0.025 infostealer_mail
    • 0.023 antiav_detectfile
    • 0.02 antivm_parallels_keys
    • 0.02 antivm_xen_keys
    • 0.019 antivm_generic_disk
    • 0.016 mimics_filetime
    • 0.015 ransomware_files
    • 0.014 Doppelganging
    • 0.014 reads_self
    • 0.014 infostealer_bitcoin
    • 0.013 antivm_generic_scsi
    • 0.013 infostealer_browser
    • 0.013 antivm_generic_diskreg
    • 0.013 antivm_vpc_keys
    • 0.012 stealth_file
    • 0.012 virus
    • 0.012 antianalysis_detectfile
    • 0.012 geodo_banking_trojan
    • 0.01 InjectionCreateRemoteThread
    • 0.01 bootkit
    • 0.01 injection_createremotethread
    • 0.009 antivm_vbox_files
    • 0.009 ransomware_extensions
    • 0.008 antidebug_guardpages
    • 0.008 antiemu_wine_func
    • 0.008 dynamic_function_loading
    • 0.008 hancitor_behavior
    • 0.007 exec_crash
    • 0.007 infostealer_browser_password
    • 0.007 malicious_dynamic_function_loading
    • 0.007 blackrat_registry_keys
    • 0.007 bypass_firewall
    • 0.006 betabot_behavior
    • 0.006 exploit_heapspray
    • 0.006 kibex_behavior
    • 0.006 recon_programs
    • 0.006 antivm_xen_keys
    • 0.006 antivm_hyperv_keys
    • 0.006 predatorthethief_files
    • 0.006 qulab_files
    • 0.005 PlugX
    • 0.005 antisandbox_sleep
    • 0.005 antivm_generic_services
    • 0.005 kovter_behavior
    • 0.005 persistence_autorun
    • 0.005 OrcusRAT Behavior
    • 0.004 InjectionInterProcess
    • 0.004 hawkeye_behavior
    • 0.004 vawtrak_behavior
    • 0.004 antivm_generic_bios
    • 0.004 antivm_generic_system
    • 0.004 ketrican_regkeys
    • 0.004 darkcomet_regkeys
    • 0.004 limerat_regkeys
    • 0.004 recon_fingerprint
    • 0.003 antiav_avast_libs
    • 0.003 antivm_vbox_libs
    • 0.003 exploit_getbasekerneladdress
    • 0.003 shifu_behavior
    • 0.003 stack_pivot
    • 0.003 antidbg_devices
    • 0.003 antivm_vmware_files
    • 0.002 Unpacker
    • 0.002 antidbg_windows
    • 0.002 antisandbox_sunbelt_libs
    • 0.002 uac_bypass_eventvwr
    • 0.002 encrypted_ioc
    • 0.002 exploit_gethaldispatchtable
    • 0.002 injection_runpe
    • 0.002 network_tor
    • 0.002 antivm_vbox_devices
    • 0.002 browser_security
    • 0.002 disables_browser_warn
    • 0.002 medusalocker_regkeys
    • 0.002 warzonerat_regkeys
    • 0.002 remcos_regkeys
    • 0.001 InjectionProcessHollowing
    • 0.001 InjectionSetWindowLong
    • 0.001 antiav_bitdefender_libs
    • 0.001 antiav_bullgaurd_libs
    • 0.001 antiav_emsisoft_libs
    • 0.001 antiav_qurb_libs
    • 0.001 antiav_apioverride_libs
    • 0.001 antiav_nthookengine_libs
    • 0.001 antisandbox_sboxie_libs
    • 0.001 Vidar Behavior
    • 0.001 ipc_namedpipe
    • 0.001 kazybot_behavior
    • 0.001 office_flash_load
    • 0.001 rat_nanocore
    • 0.001 tinba_behavior
    • 0.001 neshta_files
    • 0.001 banker_cridex
    • 0.001 bot_drive
    • 0.001 modify_proxy
    • 0.001 codelux_behavior
    • 0.001 packer_armadillo_regkey
    • 0.001 nemty_regkeys
    • 0.001 revil_mutexes
    • 0.001 obliquerat_files
    • 0.001 rat_pcclient
    • 0.001 sniffer_winpcap
    • 0.001 targeted_flame

    Reporting ( 13.971000000000002 seconds )

    • 13.928 BinGraph
    • 0.041 MITRE_TTPS
    • 0.002 PCAP2CERT