API tools faq
paste
Advertisement
Guest User

Anibus Report

a guest
Nov 27th, 2013
333
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 159.82 KB | None | 0 0
raw download clone embed print report
  1. ___ __ _
  2. + /- / | ____ __ __/ /_ (_)____ -\ +
  3. /s h- / /| | / __ \/ / / / __ \/ / ___/ -h s\
  4. oh-:d/ / ___ |/ / / / /_/ / /_/ / (__ ) /d:-ho
  5. shh+hy- /_/ |_/_/ /_/\__,_/_.___/_/____/ -yh+hhs
  6. -:+hhdhyys/- -\syyhdhh+:-
  7. -//////dhhhhhddhhyss- Analysis Report -ssyhhddhhhhhd\\\\\\-
  8. /++/////oydddddhhyys/ ooooooooooooooooooooo \syyhhdddddyo\\\\\++\
  9. -+++///////odh/- -+hdo\\\\\\\+++-
  10. +++++++++//yy+/: :\+yy\\+++++++++
  11. /+soss+sys//yyo/os++o+: :+o++so\oyy\\sys+ssos+\
  12. +oyyyys++o/+yss/+/oyyyy: :yyyyo\+\ssy+\o++syyyyo+
  13. +oyyyyyyso+os/o/+yyyyyy/ \yyyyyy+\o\so+osyyyyyyo+
  14.  
  15.  
  16. [#############################################################################]
  17. Analysis Report for m8update.exe
  18. MD5: 4636c552cfeb57a03e7601c173af8f4e
  19. [#############################################################################]
  20.  
  21.  
  22. [=============================================================================]
  23. Table of Contents
  24. [=============================================================================]
  25.  
  26. - General information
  27. - m8update.e.exe
  28. a) Registry Activities
  29. b) File Activities
  30. c) Process Activities
  31. d) Other Activities
  32. - DW20.EXE
  33. a) Registry Activities
  34. b) File Activities
  35. c) Process Activities
  36.  
  37.  
  38. [#############################################################################]
  39. 1. General Information
  40. [#############################################################################]
  41. [=============================================================================]
  42. Information about Anubis' invocation
  43. [=============================================================================]
  44. Time needed: 256 s
  45. Report created: 11/27/13, 13:13:43 UTC
  46. Termination reason: Timeout
  47. Program version: 1.76.3886
  48.  
  49.  
  50. [#############################################################################]
  51. 2. m8update.e.exe
  52. [#############################################################################]
  53. [=============================================================================]
  54. General information about this executable
  55. [=============================================================================]
  56. Analysis Reason: Primary Analysis Subject
  57. Filename: m8update.e.exe
  58. MD5: 4636c552cfeb57a03e7601c173af8f4e
  59. SHA-1: 49c70c460f102a07866222eb87b3997895d15eee
  60. File Size: 290104 Bytes
  61. Process-status
  62. at analysis end: alive
  63. Exit Code: 0
  64.  
  65. [=============================================================================]
  66. Load-time Dlls
  67. [=============================================================================]
  68. Module Name: [ C:\WINDOWS\system32\ntdll.dll ],
  69. Base Address: [0x7C900000 ], Size: [0x000AF000 ]
  70. Module Name: [ C:\WINDOWS\system32\mscoree.dll ],
  71. Base Address: [0x79000000 ], Size: [0x0004A000 ]
  72. Module Name: [ C:\WINDOWS\system32\KERNEL32.dll ],
  73. Base Address: [0x7C800000 ], Size: [0x000F6000 ]
  74. Module Name: [ C:\WINDOWS\system32\ADVAPI32.dll ],
  75. Base Address: [0x77DD0000 ], Size: [0x0009B000 ]
  76. Module Name: [ C:\WINDOWS\system32\RPCRT4.dll ],
  77. Base Address: [0x77E70000 ], Size: [0x00092000 ]
  78. Module Name: [ C:\WINDOWS\system32\Secur32.dll ],
  79. Base Address: [0x77FE0000 ], Size: [0x00011000 ]
  80. Module Name: [ C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll ],
  81. Base Address: [0x603B0000 ], Size: [0x00066000 ]
  82. Module Name: [ C:\WINDOWS\system32\SHLWAPI.dll ],
  83. Base Address: [0x77F60000 ], Size: [0x00076000 ]
  84. Module Name: [ C:\WINDOWS\system32\GDI32.dll ],
  85. Base Address: [0x77F10000 ], Size: [0x00049000 ]
  86. Module Name: [ C:\WINDOWS\system32\USER32.dll ],
  87. Base Address: [0x7E410000 ], Size: [0x00091000 ]
  88. Module Name: [ C:\WINDOWS\system32\msvcrt.dll ],
  89. Base Address: [0x77C10000 ], Size: [0x00058000 ]
  90. Module Name: [ C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll ],
  91. Base Address: [0x79E70000 ], Size: [0x0058F000 ]
  92. Module Name: [ C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\MSVCR80.dll ],
  93. Base Address: [0x78130000 ], Size: [0x0009B000 ]
  94. Module Name: [ C:\WINDOWS\system32\shell32.dll ],
  95. Base Address: [0x7C9C0000 ], Size: [0x00817000 ]
  96. Module Name: [ C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll ],
  97. Base Address: [0x773D0000 ], Size: [0x00103000 ]
  98. Module Name: [ C:\WINDOWS\system32\comctl32.dll ],
  99. Base Address: [0x5D090000 ], Size: [0x0009A000 ]
  100. Module Name: [ C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\642534209e13d16e93b80a628742d2ee\mscorlib.ni.dll ],
  101. Base Address: [0x790C0000 ], Size: [0x00B36000 ]
  102. Module Name: [ C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll ],
  103. Base Address: [0x64020000 ], Size: [0x00013000 ]
  104. Module Name: [ C:\WINDOWS\system32\WINTRUST.dll ],
  105. Base Address: [0x76C30000 ], Size: [0x0002E000 ]
  106. Module Name: [ C:\WINDOWS\system32\CRYPT32.dll ],
  107. Base Address: [0x77A80000 ], Size: [0x00095000 ]
  108. Module Name: [ C:\WINDOWS\system32\MSASN1.dll ],
  109. Base Address: [0x77B20000 ], Size: [0x00012000 ]
  110. Module Name: [ C:\WINDOWS\system32\IMAGEHLP.dll ],
  111. Base Address: [0x76C90000 ], Size: [0x00028000 ]
  112. Module Name: [ C:\WINDOWS\system32\RichEd20.dll ],
  113. Base Address: [0x74E30000 ], Size: [0x0006D000 ]
  114. Module Name: [ C:\WINDOWS\system32\rsaenh.dll ],
  115. Base Address: [0x68000000 ], Size: [0x00036000 ]
  116. Module Name: [ C:\WINDOWS\system32\xpsp2res.dll ],
  117. Base Address: [0x00EE0000 ], Size: [0x002C5000 ]
  118. Module Name: [ C:\WINDOWS\system32\userenv.dll ],
  119. Base Address: [0x769C0000 ], Size: [0x000B4000 ]
  120. Module Name: [ C:\WINDOWS\system32\VERSION.dll ],
  121. Base Address: [0x77C00000 ], Size: [0x00008000 ]
  122. Module Name: [ C:\WINDOWS\system32\netapi32.dll ],
  123. Base Address: [0x5B860000 ], Size: [0x00055000 ]
  124. Module Name: [ C:\WINDOWS\system32\cryptnet.dll ],
  125. Base Address: [0x75E60000 ], Size: [0x00013000 ]
  126. Module Name: [ C:\WINDOWS\system32\PSAPI.DLL ],
  127. Base Address: [0x76BF0000 ], Size: [0x0000B000 ]
  128. Module Name: [ C:\WINDOWS\system32\SensApi.dll ],
  129. Base Address: [0x722B0000 ], Size: [0x00005000 ]
  130. Module Name: [ C:\WINDOWS\system32\WINHTTP.dll ],
  131. Base Address: [0x4D4F0000 ], Size: [0x00059000 ]
  132. Module Name: [ C:\WINDOWS\system32\WLDAP32.dll ],
  133. Base Address: [0x76F60000 ], Size: [0x0002C000 ]
  134. Module Name: [ C:\WINDOWS\system32\ole32.dll ],
  135. Base Address: [0x774E0000 ], Size: [0x0013D000 ]
  136. Module Name: [ C:\WINDOWS\system32\MSCTF.dll ],
  137. Base Address: [0x74720000 ], Size: [0x0004C000 ]
  138. Module Name: [ C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll ],
  139. Base Address: [0x79060000 ], Size: [0x00056000 ]
  140. Module Name: [ C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\culture.dll ],
  141. Base Address: [0x60340000 ], Size: [0x00008000 ]
  142. Module Name: [ C:\WINDOWS\system32\Apphelp.dll ],
  143. Base Address: [0x77B40000 ], Size: [0x00022000 ]
  144.  
  145. [=============================================================================]
  146. 2.a) m8update.e.exe - Registry Activities
  147. [=============================================================================]
  148. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  149. Registry Values Modified:
  150. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  151. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders ],
  152. Value Name: [ AppData ], New Value: [ C:\Documents and Settings\Administrator\Application Data ]
  153. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders ],
  154. Value Name: [ Cache ], New Value: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files ]
  155.  
  156. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  157. Registry Values Read:
  158. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  159. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  160. Value Name: [ Accessibility,Version="1.0.5000.0",PublicKeyToken="b03f5f7f11d50a3a",Culture="neutral",FileVersion="1.1.4322.573" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  161. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  162. Value Name: [ CustomMarshalers,Version="1.0.5000.0",PublicKeyToken="b03f5f7f11d50a3a",Culture="neutral",FileVersion="1.1.4322.573" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  163. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  164. Value Name: [ IEExecRemote,Version="1.0.5000.0",PublicKeyToken="b03f5f7f11d50a3a",Culture="neutral",FileVersion="1.1.4322.573" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  165. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  166. Value Name: [ IEHost,Version="1.0.5000.0",PublicKeyToken="b03f5f7f11d50a3a",Culture="neutral",FileVersion="1.1.4322.573" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  167. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  168. Value Name: [ IIEHost,Version="1.0.5000.0",PublicKeyToken="b03f5f7f11d50a3a",Culture="neutral",FileVersion="1.0.5000.0" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  169. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  170. Value Name: [ ISymWrapper,Version="1.0.5000.0",PublicKeyToken="b03f5f7f11d50a3a",Culture="neutral",FileVersion="1.1.4322.573" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  171. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  172. Value Name: [ Microsoft.Build.Conversion.v3.5,version="3.5.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" ], Value: [ 0x70002100560045003300360030004b00630034004b006a00540044003400 ], 1 time
  173. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  174. Value Name: [ Microsoft.Build.Engine,version="3.5.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" ], Value: [ 0x70002100560045003300360030004b00630034004b006a00540044003400 ], 1 time
  175. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  176. Value Name: [ Microsoft.Build.Framework,version="3.5.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" ], Value: [ 0x70002100560045003300360030004b00630034004b006a00540044003400 ], 1 time
  177. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  178. Value Name: [ Microsoft.Build.Tasks.v3.5,version="3.5.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" ], Value: [ 0x70002100560045003300360030004b00630034004b006a00540044003400 ], 1 time
  179. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  180. Value Name: [ Microsoft.Build.Utilities.v3.5,version="3.5.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" ], Value: [ 0x70002100560045003300360030004b00630034004b006a00540044003400 ], 1 time
  181. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  182. Value Name: [ Microsoft.JScript,Version="7.0.5000.0",PublicKeyToken="b03f5f7f11d50a3a",Culture="neutral",FileVersion="7.10.3052.4" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  183. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  184. Value Name: [ Microsoft.Transactions.Bridge,Version="3.0.0.0",Culture="neutral",PublicKeyToken="b03f5f7f11d50a3a",ProcessorArchitecture="MSIL",FileVersion="3.0.4506.648" ], Value: [ 0x6a0025006c0024003200790062006300690035004b00290075006a005100 ], 1 time
  185. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  186. Value Name: [ Microsoft.Transactions.Bridge.Dtc,Version="3.0.0.0",Culture="neutral",PublicKeyToken="b03f5f7f11d50a3a",ProcessorArchitecture="x86",FileVersion="3.0.4506.648" ], Value: [ 0x6a0025006c0024003200790062006300690035004b00290075006a005100 ], 1 time
  187. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  188. Value Name: [ Microsoft.VisualBasic,Version="7.0.5000.0",PublicKeyToken="b03f5f7f11d50a3a",Culture="neutral",FileVersion="7.10.3052.4" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  189. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  190. Value Name: [ Microsoft.VisualBasic.Vsa,Version="7.0.5000.0",PublicKeyToken="b03f5f7f11d50a3a",Culture="neutral",FileVersion="7.10.3052.4" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  191. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  192. Value Name: [ Microsoft.VisualC,Version="7.0.5000.0",PublicKeyToken="b03f5f7f11d50a3a",Culture="neutral",FileVersion="7.10.3052.4" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  193. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  194. Value Name: [ Microsoft.VisualC.STLCLR,version="1.0.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="9.0.21022.8",culture="neutral" ], Value: [ 0x70002100560045003300360030004b00630034004b006a00540044003400 ], 1 time
  195. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  196. Value Name: [ Microsoft.Vsa,Version="7.0.5000.0",PublicKeyToken="b03f5f7f11d50a3a",Culture="neutral",FileVersion="7.10.3052.4" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  197. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  198. Value Name: [ Microsoft.Vsa.Vb.CodeDOMProcessor,Version="7.0.5000.0",PublicKeyToken="b03f5f7f11d50a3a",Culture="neutral",FileVersion="7.10.3052.4" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  199. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  200. Value Name: [ Microsoft_VsaVb,Version="7.0.5000.0",PublicKeyToken="b03f5f7f11d50a3a",Culture="neutral",FileVersion="7.10.3052.4" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  201. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  202. Value Name: [ PresentationBuildTasks,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.0" ], Value: [ 0x29006d0066002a0065005d0061006b007b0040004f0069006c0024005700 ], 1 time
  203. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  204. Value Name: [ PresentationBuildTasks,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" ], Value: [ 0x6a0025006c0024003200790062006300690035004b00290075006a005100 ], 1 time
  205. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  206. Value Name: [ PresentationCFFRasterizer,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.0" ], Value: [ 0x29006d0066002a0065005d0061006b007b0040004f0069006c0024005700 ], 1 time
  207. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  208. Value Name: [ PresentationCFFRasterizer,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" ], Value: [ 0x6a0025006c0024003200790062006300690035004b00290075006a005100 ], 1 time
  209. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  210. Value Name: [ PresentationCore,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="x86",FileVersion="3.0.6920.0" ], Value: [ 0x29006d0066002a0065005d0061006b007b0040004f0069006c0024005700 ], 1 time
  211. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  212. Value Name: [ PresentationCore,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="x86",FileVersion="3.0.6920.1109" ], Value: [ 0x6a0025006c0024003200790062006300690035004b00290075006a005100 ], 1 time
  213. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  214. Value Name: [ PresentationFramework,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.0" ], Value: [ 0x29006d0066002a0065005d0061006b007b0040004f0069006c0024005700 ], 1 time
  215. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  216. Value Name: [ PresentationFramework,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" ], Value: [ 0x6a0025006c0024003200790062006300690035004b00290075006a005100 ], 1 time
  217. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  218. Value Name: [ PresentationFramework.Aero,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.0" ], Value: [ 0x29006d0066002a0065005d0061006b007b0040004f0069006c0024005700 ], 1 time
  219. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  220. Value Name: [ PresentationFramework.Aero,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" ], Value: [ 0x6a0025006c0024003200790062006300690035004b00290075006a005100 ], 1 time
  221. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  222. Value Name: [ PresentationFramework.Classic,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.0" ], Value: [ 0x29006d0066002a0065005d0061006b007b0040004f0069006c0024005700 ], 1 time
  223. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  224. Value Name: [ PresentationFramework.Classic,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" ], Value: [ 0x6a0025006c0024003200790062006300690035004b00290075006a005100 ], 1 time
  225. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  226. Value Name: [ PresentationFramework.Luna,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.0" ], Value: [ 0x29006d0066002a0065005d0061006b007b0040004f0069006c0024005700 ], 1 time
  227. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  228. Value Name: [ PresentationFramework.Luna,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" ], Value: [ 0x6a0025006c0024003200790062006300690035004b00290075006a005100 ], 1 time
  229. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  230. Value Name: [ PresentationFramework.Royale,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.0" ], Value: [ 0x29006d0066002a0065005d0061006b007b0040004f0069006c0024005700 ], 1 time
  231. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  232. Value Name: [ PresentationFramework.Royale,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" ], Value: [ 0x6a0025006c0024003200790062006300690035004b00290075006a005100 ], 1 time
  233. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  234. Value Name: [ PresentationUI,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.0" ], Value: [ 0x29006d0066002a0065005d0061006b007b0040004f0069006c0024005700 ], 1 time
  235. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  236. Value Name: [ PresentationUI,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" ], Value: [ 0x6a0025006c0024003200790062006300690035004b00290075006a005100 ], 1 time
  237. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  238. Value Name: [ ReachFramework,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.0" ], Value: [ 0x29006d0066002a0065005d0061006b007b0040004f0069006c0024005700 ], 1 time
  239. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  240. Value Name: [ ReachFramework,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" ], Value: [ 0x6a0025006c0024003200790062006300690035004b00290075006a005100 ], 1 time
  241. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  242. Value Name: [ Regcode,Version="1.0.5000.0",PublicKeyToken="b03f5f7f11d50a3a",Culture="neutral",FileVersion="1.1.4322.573" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  243. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  244. Value Name: [ SMDiagnostics,Version="3.0.0.0",Culture="neutral",PublicKeyToken="b77a5c561934e089",ProcessorArchitecture="MSIL",FileVersion="3.0.4506.648" ], Value: [ 0x6a0025006c0024003200790062006300690035004b00290075006a005100 ], 1 time
  245. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  246. Value Name: [ System,Version="1.0.5000.0",PublicKeyToken="b77a5c561934e089",Culture="neutral",FileVersion="1.1.4322.573" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  247. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  248. Value Name: [ System.AddIn,version="3.5.0.0",publicKeyToken="b77a5c561934e089",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" ], Value: [ 0x70002100560045003300360030004b00630034004b006a00540044003400 ], 1 time
  249. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  250. Value Name: [ System.AddIn.Contract,version="2.0.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" ], Value: [ 0x70002100560045003300360030004b00630034004b006a00540044003400 ], 1 time
  251. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  252. Value Name: [ System.Configuration.Install,Version="1.0.5000.0",PublicKeyToken="b03f5f7f11d50a3a",Culture="neutral",FileVersion="1.1.4322.573" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  253. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  254. Value Name: [ System.Core,version="3.5.0.0",publicKeyToken="b77a5c561934e089",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" ], Value: [ 0x70002100560045003300360030004b00630034004b006a00540044003400 ], 1 time
  255. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  256. Value Name: [ System.Data,Version="1.0.5000.0",PublicKeyToken="b77a5c561934e089",Culture="neutral",FileVersion="1.1.4322.573" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  257. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  258. Value Name: [ System.Data.DataSetExtensions,version="3.5.0.0",publicKeyToken="b77a5c561934e089",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" ], Value: [ 0x70002100560045003300360030004b00630034004b006a00540044003400 ], 1 time
  259. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  260. Value Name: [ System.Data.Linq,version="3.5.0.0",publicKeyToken="b77a5c561934e089",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" ], Value: [ 0x70002100560045003300360030004b00630034004b006a00540044003400 ], 1 time
  261. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  262. Value Name: [ System.Data.OracleClient,Version="1.0.5000.0",PublicKeyToken="b77a5c561934e089",Culture="neutral",FileVersion="1.1.4322.573" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  263. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  264. Value Name: [ System.Design,Version="1.0.5000.0",PublicKeyToken="b03f5f7f11d50a3a",Culture="neutral",FileVersion="1.1.4322.573" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  265. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  266. Value Name: [ System.DirectoryServices,Version="1.0.5000.0",PublicKeyToken="b03f5f7f11d50a3a",Culture="neutral",FileVersion="1.1.4322.573" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  267. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  268. Value Name: [ System.DirectoryServices.AccountManagement,version="3.5.0.0",publicKeyToken="b77a5c561934e089",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" ], Value: [ 0x70002100560045003300360030004b00630034004b006a00540044003400 ], 1 time
  269. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  270. Value Name: [ System.Drawing,Version="1.0.5000.0",PublicKeyToken="b03f5f7f11d50a3a",Culture="neutral",FileVersion="1.1.4322.573" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  271. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  272. Value Name: [ System.Drawing.Design,Version="1.0.5000.0",PublicKeyToken="b03f5f7f11d50a3a",Culture="neutral",FileVersion="1.1.4322.573" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  273. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  274. Value Name: [ System.EnterpriseServices,Version="1.0.5000.0",PublicKeyToken="b03f5f7f11d50a3a",Culture="neutral",FileVersion="1.1.4322.573" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  275. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  276. Value Name: [ System.IO.Log,Version="3.0.0.0",Culture="neutral",PublicKeyToken="b03f5f7f11d50a3a",ProcessorArchitecture="MSIL",FileVersion="3.0.4506.648" ], Value: [ 0x6a0025006c0024003200790062006300690035004b00290075006a005100 ], 1 time
  277. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  278. Value Name: [ System.IdentityModel,Version="3.0.0.0",Culture="neutral",PublicKeyToken="b77a5c561934e089",ProcessorArchitecture="MSIL",FileVersion="3.0.4506.648" ], Value: [ 0x6a0025006c0024003200790062006300690035004b00290075006a005100 ], 1 time
  279. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  280. Value Name: [ System.IdentityModel.Selectors,Version="3.0.0.0",Culture="neutral",PublicKeyToken="b77a5c561934e089",ProcessorArchitecture="MSIL",FileVersion="3.0.4506.648" ], Value: [ 0x6a0025006c0024003200790062006300690035004b00290075006a005100 ], 1 time
  281. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  282. Value Name: [ System.Management,Version="1.0.5000.0",PublicKeyToken="b03f5f7f11d50a3a",Culture="neutral",FileVersion="1.1.4322.573" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  283. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  284. Value Name: [ System.Management.Instrumentation,version="3.5.0.0",publicKeyToken="b77a5c561934e089",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" ], Value: [ 0x70002100560045003300360030004b00630034004b006a00540044003400 ], 1 time
  285. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  286. Value Name: [ System.Messaging,Version="1.0.5000.0",PublicKeyToken="b03f5f7f11d50a3a",Culture="neutral",FileVersion="1.1.4322.573" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  287. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  288. Value Name: [ System.Net,version="3.5.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" ], Value: [ 0x70002100560045003300360030004b00630034004b006a00540044003400 ], 1 time
  289. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  290. Value Name: [ System.Printing,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="x86",FileVersion="3.0.6920.0" ], Value: [ 0x29006d0066002a0065005d0061006b007b0040004f0069006c0024005700 ], 1 time
  291. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  292. Value Name: [ System.Printing,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="x86",FileVersion="3.0.6920.1109" ], Value: [ 0x6a0025006c0024003200790062006300690035004b00290075006a005100 ], 1 time
  293. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  294. Value Name: [ System.Runtime.Remoting,Version="1.0.5000.0",PublicKeyToken="b77a5c561934e089",Culture="neutral",FileVersion="1.1.4322.573" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  295. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  296. Value Name: [ System.Runtime.Serialization,Version="3.0.0.0",Culture="neutral",PublicKeyToken="b77a5c561934e089",ProcessorArchitecture="MSIL",FileVersion="3.0.4506.648" ], Value: [ 0x6a0025006c0024003200790062006300690035004b00290075006a005100 ], 1 time
  297. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  298. Value Name: [ System.Runtime.Serialization.Formatters.Soap,Version="1.0.5000.0",PublicKeyToken="b03f5f7f11d50a3a",Culture="neutral",FileVersion="1.1.4322.573" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  299. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  300. Value Name: [ System.Security,Version="1.0.5000.0",PublicKeyToken="b03f5f7f11d50a3a",Culture="neutral",FileVersion="1.1.4322.573" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  301. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  302. Value Name: [ System.ServiceModel,Version="3.0.0.0",Culture="neutral",PublicKeyToken="b77a5c561934e089",ProcessorArchitecture="MSIL",FileVersion="3.0.4506.648" ], Value: [ 0x6a0025006c0024003200790062006300690035004b00290075006a005100 ], 1 time
  303. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  304. Value Name: [ System.ServiceModel.Install,Version="3.0.0.0",Culture="neutral",PublicKeyToken="b77a5c561934e089",ProcessorArchitecture="MSIL",FileVersion="3.0.4506.648" ], Value: [ 0x6a0025006c0024003200790062006300690035004b00290075006a005100 ], 1 time
  305. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  306. Value Name: [ System.ServiceModel.WasHosting,Version="3.0.0.0",Culture="neutral",PublicKeyToken="b77a5c561934e089",ProcessorArchitecture="MSIL",FileVersion="3.0.4506.648" ], Value: [ 0x6a0025006c0024003200790062006300690035004b00290075006a005100 ], 1 time
  307. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  308. Value Name: [ System.ServiceModel.Web,version="3.5.0.0",publicKeyToken="31bf3856ad364e35",processorArchitecture="MSIL",fileVersion="3.5.594.0",culture="neutral" ], Value: [ 0x70002100560045003300360030004b00630034004b006a00540044003400 ], 1 time
  309. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  310. Value Name: [ System.ServiceProcess,Version="1.0.5000.0",PublicKeyToken="b03f5f7f11d50a3a",Culture="neutral",FileVersion="1.1.4322.573" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  311. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  312. Value Name: [ System.Speech,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.0" ], Value: [ 0x29006d0066002a0065005d0061006b007b0040004f0069006c0024005700 ], 1 time
  313. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  314. Value Name: [ System.Speech,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" ], Value: [ 0x6a0025006c0024003200790062006300690035004b00290075006a005100 ], 1 time
  315. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  316. Value Name: [ System.Web,Version="1.0.5000.0",PublicKeyToken="b03f5f7f11d50a3a",Culture="neutral",FileVersion="1.1.4322.573" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  317. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  318. Value Name: [ System.Web.Extensions,version="3.5.0.0",publicKeyToken="31bf3856ad364e35",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" ], Value: [ 0x70002100560045003300360030004b00630034004b006a00540044003400 ], 1 time
  319. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  320. Value Name: [ System.Web.Extensions.Design,version="3.5.0.0",publicKeyToken="31bf3856ad364e35",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" ], Value: [ 0x70002100560045003300360030004b00630034004b006a00540044003400 ], 1 time
  321. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  322. Value Name: [ System.Web.Mobile,Version="1.0.5000.0",PublicKeyToken="b03f5f7f11d50a3a",Culture="neutral",FileVersion="1.1.4322.573" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  323. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  324. Value Name: [ System.Web.RegularExpressions,Version="1.0.5000.0",PublicKeyToken="b03f5f7f11d50a3a",Culture="neutral",FileVersion="1.1.4322.573" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  325. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  326. Value Name: [ System.Web.Services,Version="1.0.5000.0",PublicKeyToken="b03f5f7f11d50a3a",Culture="neutral",FileVersion="1.1.4322.573" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  327. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  328. Value Name: [ System.Windows.Forms,Version="1.0.5000.0",PublicKeyToken="b77a5c561934e089",Culture="neutral",FileVersion="1.1.4322.573" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  329. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  330. Value Name: [ System.Windows.Presentation,version="3.5.0.0",publicKeyToken="b77a5c561934e089",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" ], Value: [ 0x70002100560045003300360030004b00630034004b006a00540044003400 ], 1 time
  331. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  332. Value Name: [ System.Workflow.Activities,processorArchitecture="MSIL",publicKeyToken="31BF3856AD364E35",culture="neutral",version="3.0.0.000000",fileVersion="3.0.4203.835" ], Value: [ 0x6a0025006c0024003200790062006300690035004b00290075006a005100 ], 1 time
  333. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  334. Value Name: [ System.Workflow.ComponentModel,processorArchitecture="MSIL",publicKeyToken="31BF3856AD364E35",culture="neutral",version="3.0.0.000000",fileVersion="3.0.4203.835" ], Value: [ 0x6a0025006c0024003200790062006300690035004b00290075006a005100 ], 1 time
  335. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  336. Value Name: [ System.Workflow.Runtime,processorArchitecture="MSIL",publicKeyToken="31BF3856AD364E35",culture="neutral",version="3.0.0.000000",fileVersion="3.0.4203.835" ], Value: [ 0x6a0025006c0024003200790062006300690035004b00290075006a005100 ], 1 time
  337. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  338. Value Name: [ System.WorkflowServices,version="3.5.0.0",publicKeyToken="31bf3856ad364e35",processorArchitecture="MSIL",fileVersion="3.5.594.0",culture="neutral" ], Value: [ 0x70002100560045003300360030004b00630034004b006a00540044003400 ], 1 time
  339. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  340. Value Name: [ System.Xml,Version="1.0.5000.0",PublicKeyToken="b77a5c561934e089",Culture="neutral",FileVersion="1.1.4322.573" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  341. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  342. Value Name: [ System.Xml.Linq,version="3.5.0.0",publicKeyToken="b77a5c561934e089",processorArchitecture="MSIL",fileVersion="3.5.21022.8",culture="neutral" ], Value: [ 0x70002100560045003300360030004b00630034004b006a00540044003400 ], 1 time
  343. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  344. Value Name: [ UIAutomationClient,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.0" ], Value: [ 0x29006d0066002a0065005d0061006b007b0040004f0069006c0024005700 ], 1 time
  345. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  346. Value Name: [ UIAutomationClient,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" ], Value: [ 0x6a0025006c0024003200790062006300690035004b00290075006a005100 ], 1 time
  347. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  348. Value Name: [ UIAutomationClientsideProviders,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.0" ], Value: [ 0x29006d0066002a0065005d0061006b007b0040004f0069006c0024005700 ], 1 time
  349. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  350. Value Name: [ UIAutomationClientsideProviders,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" ], Value: [ 0x6a0025006c0024003200790062006300690035004b00290075006a005100 ], 1 time
  351. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  352. Value Name: [ UIAutomationProvider,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.0" ], Value: [ 0x29006d0066002a0065005d0061006b007b0040004f0069006c0024005700 ], 1 time
  353. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  354. Value Name: [ UIAutomationProvider,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" ], Value: [ 0x6a0025006c0024003200790062006300690035004b00290075006a005100 ], 1 time
  355. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  356. Value Name: [ UIAutomationTypes,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.0" ], Value: [ 0x29006d0066002a0065005d0061006b007b0040004f0069006c0024005700 ], 1 time
  357. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  358. Value Name: [ UIAutomationTypes,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" ], Value: [ 0x6a0025006c0024003200790062006300690035004b00290075006a005100 ], 1 time
  359. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  360. Value Name: [ WindowsBase,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.0" ], Value: [ 0x29006d0066002a0065005d0061006b007b0040004f0069006c0024005700 ], 1 time
  361. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  362. Value Name: [ WindowsBase,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" ], Value: [ 0x6a0025006c0024003200790062006300690035004b00290075006a005100 ], 1 time
  363. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  364. Value Name: [ WindowsFormsIntegration,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.0" ], Value: [ 0x29006d0066002a0065005d0061006b007b0040004f0069006c0024005700 ], 1 time
  365. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  366. Value Name: [ WindowsFormsIntegration,Version="3.0.0.0",Culture="neutral",PublicKeyToken="31bf3856ad364e35",ProcessorArchitecture="MSIL",FileVersion="3.0.6920.1109" ], Value: [ 0x6a0025006c0024003200790062006300690035004b00290075006a005100 ], 1 time
  367. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  368. Value Name: [ cscompmgd,Version="7.0.5000.0",PublicKeyToken="b03f5f7f11d50a3a",Culture="neutral",FileVersion="7.10.3052.4" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  369. Key: [ HKLM\SOFTWARE\Classes\Installer\Assemblies\Global ],
  370. Value Name: [ mscorcfg,Version="1.0.5000.0",PublicKeyToken="b03f5f7f11d50a3a",Culture="neutral",FileVersion="1.1.4322.573" ], Value: [ 0x250045006d0041006a003f00430025006b0039005700370063004e004200 ], 1 time
  371. Key: [ HKLM\SOFTWARE\Microsoft\CTF\SystemShared\ ],
  372. Value Name: [ CUAS ], Value: [ 0 ], 1 time
  373. Key: [ HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001 ],
  374. Value Name: [ Name ], Value: [ Microsoft Strong Cryptographic Provider ], 4 times
  375. Key: [ HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider ],
  376. Value Name: [ Image Path ], Value: [ rsaenh.dll ], 4 times
  377. Key: [ HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider ],
  378. Value Name: [ Type ], Value: [ 1 ], 1 time
  379. Key: [ HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting ],
  380. Value Name: [ AllOrNone ], Value: [ 1 ], 1 time
  381. Key: [ HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting ],
  382. Value Name: [ DoReport ], Value: [ 1 ], 1 time
  383. Key: [ HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting ],
  384. Value Name: [ ShowUI ], Value: [ 1 ], 1 time
  385. Key: [ HKLM\SYSTEM\CurrentControlSet\Control\Session Manager ],
  386. Value Name: [ CriticalSectionTimeout ], Value: [ 2592000 ], 1 time
  387. Key: [ HKLM\SYSTEM\Setup ],
  388. Value Name: [ SystemSetupInProgress ], Value: [ 0 ], 1 time
  389. Key: [ HKLM\SYSTEM\WPA\MediaCenter ],
  390. Value Name: [ Installed ], Value: [ 0 ], 1 time
  391. Key: [ HKLM\Software\Microsoft\.NETFramework ],
  392. Value Name: [ InstallRoot ], Value: [ C:\WINDOWS\Microsoft.NET\Framework\ ], 9 times
  393. Key: [ HKLM\Software\Microsoft\.NETFramework\Policy\\v4.0 ],
  394. Value Name: [ 30319 ], Value: [ 30319-30319 ], 1 time
  395. Key: [ HKLM\Software\Microsoft\Cryptography ],
  396. Value Name: [ MachineGuid ], Value: [ 4604e8cc-5b9c-4ffb-a374-a62e6d0494fc ], 4 times
  397. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\#16 ],
  398. Value Name: [ Dll ], Value: [ cryptnet.dll ], 1 time
  399. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\#16 ],
  400. Value Name: [ FuncName ], Value: [ LdapProvOpenStore ], 1 time
  401. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\Ldap ],
  402. Value Name: [ Dll ], Value: [ cryptnet.dll ], 1 time
  403. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\Ldap ],
  404. Value Name: [ FuncName ], Value: [ LdapProvOpenStore ], 1 time
  405. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{000C10F1-0000-0000-C000-000000000046} ],
  406. Value Name: [ Dll ], Value: [ MSISIP.DLL ], 1 time
  407. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{000C10F1-0000-0000-C000-000000000046} ],
  408. Value Name: [ FuncName ], Value: [ MsiSIPGetSignedDataMsg ], 1 time
  409. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090} ],
  410. Value Name: [ Dll ], Value: [ C:\WINDOWS\system32\wshext.dll ], 1 time
  411. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090} ],
  412. Value Name: [ FuncName ], Value: [ GetSignedDataMsg ], 1 time
  413. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB} ],
  414. Value Name: [ Dll ], Value: [ C:\WINDOWS\system32\wshext.dll ], 1 time
  415. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB} ],
  416. Value Name: [ FuncName ], Value: [ GetSignedDataMsg ], 1 time
  417. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090} ],
  418. Value Name: [ Dll ], Value: [ C:\WINDOWS\system32\wshext.dll ], 1 time
  419. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090} ],
  420. Value Name: [ FuncName ], Value: [ GetSignedDataMsg ], 1 time
  421. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE} ],
  422. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  423. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE} ],
  424. Value Name: [ FuncName ], Value: [ CryptSIPGetSignedDataMsg ], 1 time
  425. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE} ],
  426. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  427. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE} ],
  428. Value Name: [ FuncName ], Value: [ CryptSIPGetSignedDataMsg ], 1 time
  429. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE} ],
  430. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  431. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE} ],
  432. Value Name: [ FuncName ], Value: [ CryptSIPGetSignedDataMsg ], 1 time
  433. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE} ],
  434. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  435. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE} ],
  436. Value Name: [ FuncName ], Value: [ CryptSIPGetSignedDataMsg ], 1 time
  437. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE} ],
  438. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  439. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE} ],
  440. Value Name: [ FuncName ], Value: [ CryptSIPGetSignedDataMsg ], 1 time
  441. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE} ],
  442. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  443. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE} ],
  444. Value Name: [ FuncName ], Value: [ CryptSIPGetSignedDataMsg ], 1 time
  445. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{000C10F1-0000-0000-C000-000000000046} ],
  446. Value Name: [ Dll ], Value: [ MSISIP.DLL ], 1 time
  447. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{000C10F1-0000-0000-C000-000000000046} ],
  448. Value Name: [ FuncName ], Value: [ MsiSIPPutSignedDataMsg ], 1 time
  449. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090} ],
  450. Value Name: [ Dll ], Value: [ C:\WINDOWS\system32\wshext.dll ], 1 time
  451. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090} ],
  452. Value Name: [ FuncName ], Value: [ PutSignedDataMsg ], 1 time
  453. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB} ],
  454. Value Name: [ Dll ], Value: [ C:\WINDOWS\system32\wshext.dll ], 1 time
  455. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB} ],
  456. Value Name: [ FuncName ], Value: [ PutSignedDataMsg ], 1 time
  457. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090} ],
  458. Value Name: [ Dll ], Value: [ C:\WINDOWS\system32\wshext.dll ], 1 time
  459. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090} ],
  460. Value Name: [ FuncName ], Value: [ PutSignedDataMsg ], 1 time
  461. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE} ],
  462. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  463. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE} ],
  464. Value Name: [ FuncName ], Value: [ CryptSIPPutSignedDataMsg ], 1 time
  465. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE} ],
  466. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  467. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE} ],
  468. Value Name: [ FuncName ], Value: [ CryptSIPPutSignedDataMsg ], 1 time
  469. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE} ],
  470. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  471. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE} ],
  472. Value Name: [ FuncName ], Value: [ CryptSIPPutSignedDataMsg ], 1 time
  473. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE} ],
  474. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  475. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE} ],
  476. Value Name: [ FuncName ], Value: [ CryptSIPPutSignedDataMsg ], 1 time
  477. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE} ],
  478. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  479. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE} ],
  480. Value Name: [ FuncName ], Value: [ CryptSIPPutSignedDataMsg ], 1 time
  481. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE} ],
  482. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  483. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE} ],
  484. Value Name: [ FuncName ], Value: [ CryptSIPPutSignedDataMsg ], 1 time
  485. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{000C10F1-0000-0000-C000-000000000046} ],
  486. Value Name: [ Dll ], Value: [ MSISIP.DLL ], 1 time
  487. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{000C10F1-0000-0000-C000-000000000046} ],
  488. Value Name: [ FuncName ], Value: [ MsiSIPVerifyIndirectData ], 1 time
  489. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{06C9E010-38CE-11D4-A2A3-00104BD35090} ],
  490. Value Name: [ Dll ], Value: [ C:\WINDOWS\system32\wshext.dll ], 1 time
  491. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{06C9E010-38CE-11D4-A2A3-00104BD35090} ],
  492. Value Name: [ FuncName ], Value: [ VerifyIndirectData ], 1 time
  493. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB} ],
  494. Value Name: [ Dll ], Value: [ C:\WINDOWS\system32\wshext.dll ], 1 time
  495. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB} ],
  496. Value Name: [ FuncName ], Value: [ VerifyIndirectData ], 1 time
  497. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{1A610570-38CE-11D4-A2A3-00104BD35090} ],
  498. Value Name: [ Dll ], Value: [ C:\WINDOWS\system32\wshext.dll ], 1 time
  499. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{1A610570-38CE-11D4-A2A3-00104BD35090} ],
  500. Value Name: [ FuncName ], Value: [ VerifyIndirectData ], 1 time
  501. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE} ],
  502. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  503. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE} ],
  504. Value Name: [ FuncName ], Value: [ CryptSIPVerifyIndirectData ], 1 time
  505. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB8-8E78-11D0-8C47-00C04FC295EE} ],
  506. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  507. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB8-8E78-11D0-8C47-00C04FC295EE} ],
  508. Value Name: [ FuncName ], Value: [ CryptSIPVerifyIndirectData ], 1 time
  509. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB9-8E78-11D0-8C47-00C04FC295EE} ],
  510. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  511. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB9-8E78-11D0-8C47-00C04FC295EE} ],
  512. Value Name: [ FuncName ], Value: [ CryptSIPVerifyIndirectData ], 1 time
  513. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AABA-8E78-11D0-8C47-00C04FC295EE} ],
  514. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  515. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AABA-8E78-11D0-8C47-00C04FC295EE} ],
  516. Value Name: [ FuncName ], Value: [ CryptSIPVerifyIndirectData ], 1 time
  517. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{DE351A42-8E59-11D0-8C47-00C04FC295EE} ],
  518. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  519. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{DE351A42-8E59-11D0-8C47-00C04FC295EE} ],
  520. Value Name: [ FuncName ], Value: [ CryptSIPVerifyIndirectData ], 1 time
  521. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{DE351A43-8E59-11D0-8C47-00C04FC295EE} ],
  522. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  523. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{DE351A43-8E59-11D0-8C47-00C04FC295EE} ],
  524. Value Name: [ FuncName ], Value: [ CryptSIPVerifyIndirectData ], 1 time
  525. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CertDllVerifyRevocation\DEFAULT ],
  526. Value Name: [ Dll ], Value: [ 0x630072007900700074006e00650074002e0064006c006c0000000000 ], 1 time
  527. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.1.1 ],
  528. Value Name: [ Dll ], Value: [ inetcomm.dll ], 1 time
  529. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.1.1 ],
  530. Value Name: [ FuncName ], Value: [ EssReceiptDecodeEx ], 1 time
  531. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.1 ],
  532. Value Name: [ Dll ], Value: [ inetcomm.dll ], 1 time
  533. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.1 ],
  534. Value Name: [ FuncName ], Value: [ EssReceiptRequestDecodeEx ], 1 time
  535. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.11 ],
  536. Value Name: [ Dll ], Value: [ inetcomm.dll ], 1 time
  537. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.11 ],
  538. Value Name: [ FuncName ], Value: [ EssKeyExchPreferenceDecodeEx ], 1 time
  539. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.12 ],
  540. Value Name: [ Dll ], Value: [ inetcomm.dll ], 1 time
  541. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.12 ],
  542. Value Name: [ FuncName ], Value: [ EssSignCertificateDecodeEx ], 1 time
  543. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.2 ],
  544. Value Name: [ Dll ], Value: [ inetcomm.dll ], 1 time
  545. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.2 ],
  546. Value Name: [ FuncName ], Value: [ EssSecurityLabelDecodeEx ], 1 time
  547. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.3 ],
  548. Value Name: [ Dll ], Value: [ inetcomm.dll ], 1 time
  549. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.3 ],
  550. Value Name: [ FuncName ], Value: [ EssMLHistoryDecodeEx ], 1 time
  551. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.4 ],
  552. Value Name: [ Dll ], Value: [ inetcomm.dll ], 1 time
  553. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.4 ],
  554. Value Name: [ FuncName ], Value: [ EssContentHintDecodeEx ], 1 time
  555. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2000 ],
  556. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  557. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2000 ],
  558. Value Name: [ FuncName ], Value: [ WVTAsn1SpcSpAgencyInfoDecode ], 1 time
  559. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2001 ],
  560. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  561. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2001 ],
  562. Value Name: [ FuncName ], Value: [ WVTAsn1SpcMinimalCriteriaInfoDecode ], 1 time
  563. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2002 ],
  564. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  565. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2002 ],
  566. Value Name: [ FuncName ], Value: [ WVTAsn1SpcFinancialCriteriaInfoDecode ], 1 time
  567. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2003 ],
  568. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  569. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2003 ],
  570. Value Name: [ FuncName ], Value: [ WVTAsn1SpcIndirectDataContentDecode ], 1 time
  571. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2004 ],
  572. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  573. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2004 ],
  574. Value Name: [ FuncName ], Value: [ WVTAsn1SpcPeImageDataDecode ], 1 time
  575. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2005 ],
  576. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  577. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2005 ],
  578. Value Name: [ FuncName ], Value: [ WVTAsn1SpcLinkDecode ], 1 time
  579. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2006 ],
  580. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  581. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2006 ],
  582. Value Name: [ FuncName ], Value: [ WVTAsn1SpcStatementTypeDecode ], 1 time
  583. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2007 ],
  584. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  585. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2007 ],
  586. Value Name: [ FuncName ], Value: [ WVTAsn1SpcSpOpusInfoDecode ], 1 time
  587. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2008 ],
  588. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  589. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2008 ],
  590. Value Name: [ FuncName ], Value: [ WVTAsn1SpcLinkDecode ], 1 time
  591. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2009 ],
  592. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  593. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2009 ],
  594. Value Name: [ FuncName ], Value: [ WVTAsn1SpcLinkDecode ], 1 time
  595. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2130 ],
  596. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  597. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2130 ],
  598. Value Name: [ FuncName ], Value: [ WVTAsn1SpcSigInfoDecode ], 1 time
  599. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2221 ],
  600. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  601. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2221 ],
  602. Value Name: [ FuncName ], Value: [ WVTAsn1CatNameValueDecode ], 1 time
  603. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2222 ],
  604. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  605. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2222 ],
  606. Value Name: [ FuncName ], Value: [ WVTAsn1CatMemberInfoDecode ], 1 time
  607. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.12.2.1 ],
  608. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  609. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.12.2.1 ],
  610. Value Name: [ FuncName ], Value: [ WVTAsn1CatNameValueDecode ], 1 time
  611. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.12.2.2 ],
  612. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  613. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.12.2.2 ],
  614. Value Name: [ FuncName ], Value: [ WVTAsn1CatMemberInfoDecode ], 1 time
  615. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.1.1 ],
  616. Value Name: [ Dll ], Value: [ cryptdlg.dll ], 1 time
  617. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.1.1 ],
  618. Value Name: [ FuncName ], Value: [ DecodeAttrSequence ], 1 time
  619. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.4 ],
  620. Value Name: [ Dll ], Value: [ cryptdlg.dll ], 1 time
  621. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.4 ],
  622. Value Name: [ FuncName ], Value: [ DecodeRecipientID ], 1 time
  623. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.10 ],
  624. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  625. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.10 ],
  626. Value Name: [ FuncName ], Value: [ WVTAsn1SpcSpAgencyInfoDecode ], 1 time
  627. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.11 ],
  628. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  629. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.11 ],
  630. Value Name: [ FuncName ], Value: [ WVTAsn1SpcStatementTypeDecode ], 1 time
  631. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.12 ],
  632. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  633. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.12 ],
  634. Value Name: [ FuncName ], Value: [ WVTAsn1SpcSpOpusInfoDecode ], 1 time
  635. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.15 ],
  636. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  637. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.15 ],
  638. Value Name: [ FuncName ], Value: [ WVTAsn1SpcPeImageDataDecode ], 1 time
  639. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.20 ],
  640. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  641. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.20 ],
  642. Value Name: [ FuncName ], Value: [ WVTAsn1SpcLinkDecode ], 1 time
  643. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.25 ],
  644. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  645. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.25 ],
  646. Value Name: [ FuncName ], Value: [ WVTAsn1SpcLinkDecode ], 1 time
  647. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.26 ],
  648. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  649. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.26 ],
  650. Value Name: [ FuncName ], Value: [ WVTAsn1SpcMinimalCriteriaInfoDecode ], 1 time
  651. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.27 ],
  652. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  653. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.27 ],
  654. Value Name: [ FuncName ], Value: [ WVTAsn1SpcFinancialCriteriaInfoDecode ], 1 time
  655. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.28 ],
  656. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  657. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.28 ],
  658. Value Name: [ FuncName ], Value: [ WVTAsn1SpcLinkDecode ], 1 time
  659. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.30 ],
  660. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  661. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.30 ],
  662. Value Name: [ FuncName ], Value: [ WVTAsn1SpcSigInfoDecode ], 1 time
  663. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.4 ],
  664. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  665. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.4 ],
  666. Value Name: [ FuncName ], Value: [ WVTAsn1SpcIndirectDataContentDecode ], 1 time
  667. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.1.1 ],
  668. Value Name: [ Dll ], Value: [ inetcomm.dll ], 1 time
  669. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.1.1 ],
  670. Value Name: [ FuncName ], Value: [ EssReceiptEncodeEx ], 1 time
  671. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.1 ],
  672. Value Name: [ Dll ], Value: [ inetcomm.dll ], 1 time
  673. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.1 ],
  674. Value Name: [ FuncName ], Value: [ EssReceiptRequestEncodeEx ], 1 time
  675. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.11 ],
  676. Value Name: [ Dll ], Value: [ inetcomm.dll ], 1 time
  677. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.11 ],
  678. Value Name: [ FuncName ], Value: [ EssKeyExchPreferenceEncodeEx ], 1 time
  679. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.12 ],
  680. Value Name: [ Dll ], Value: [ inetcomm.dll ], 1 time
  681. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.12 ],
  682. Value Name: [ FuncName ], Value: [ EssSignCertificateEncodeEx ], 1 time
  683. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.2 ],
  684. Value Name: [ Dll ], Value: [ inetcomm.dll ], 1 time
  685. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.2 ],
  686. Value Name: [ FuncName ], Value: [ EssSecurityLabelEncodeEx ], 1 time
  687. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.3 ],
  688. Value Name: [ Dll ], Value: [ inetcomm.dll ], 1 time
  689. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.3 ],
  690. Value Name: [ FuncName ], Value: [ EssMLHistoryEncodeEx ], 1 time
  691. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.4 ],
  692. Value Name: [ Dll ], Value: [ inetcomm.dll ], 1 time
  693. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.4 ],
  694. Value Name: [ FuncName ], Value: [ EssContentHintEncodeEx ], 1 time
  695. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2000 ],
  696. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  697. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2000 ],
  698. Value Name: [ FuncName ], Value: [ WVTAsn1SpcSpAgencyInfoEncode ], 1 time
  699. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2001 ],
  700. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  701. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2001 ],
  702. Value Name: [ FuncName ], Value: [ WVTAsn1SpcMinimalCriteriaInfoEncode ], 1 time
  703. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2002 ],
  704. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  705. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2002 ],
  706. Value Name: [ FuncName ], Value: [ WVTAsn1SpcFinancialCriteriaInfoEncode ], 1 time
  707. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2003 ],
  708. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  709. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2003 ],
  710. Value Name: [ FuncName ], Value: [ WVTAsn1SpcIndirectDataContentEncode ], 1 time
  711. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2004 ],
  712. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  713. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2004 ],
  714. Value Name: [ FuncName ], Value: [ WVTAsn1SpcPeImageDataEncode ], 1 time
  715. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2005 ],
  716. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  717. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2005 ],
  718. Value Name: [ FuncName ], Value: [ WVTAsn1SpcLinkEncode ], 1 time
  719. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2006 ],
  720. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  721. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2006 ],
  722. Value Name: [ FuncName ], Value: [ WVTAsn1SpcStatementTypeEncode ], 1 time
  723. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2007 ],
  724. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  725. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2007 ],
  726. Value Name: [ FuncName ], Value: [ WVTAsn1SpcSpOpusInfoEncode ], 1 time
  727. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2008 ],
  728. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  729. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2008 ],
  730. Value Name: [ FuncName ], Value: [ WVTAsn1SpcLinkEncode ], 1 time
  731. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2009 ],
  732. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  733. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2009 ],
  734. Value Name: [ FuncName ], Value: [ WVTAsn1SpcLinkEncode ], 1 time
  735. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2130 ],
  736. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  737. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2130 ],
  738. Value Name: [ FuncName ], Value: [ WVTAsn1SpcSigInfoEncode ], 1 time
  739. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2221 ],
  740. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  741. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2221 ],
  742. Value Name: [ FuncName ], Value: [ WVTAsn1CatNameValueEncode ], 1 time
  743. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2222 ],
  744. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  745. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2222 ],
  746. Value Name: [ FuncName ], Value: [ WVTAsn1CatMemberInfoEncode ], 1 time
  747. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.1 ],
  748. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  749. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.1 ],
  750. Value Name: [ FuncName ], Value: [ WVTAsn1CatNameValueEncode ], 1 time
  751. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.2 ],
  752. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  753. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.2 ],
  754. Value Name: [ FuncName ], Value: [ WVTAsn1CatMemberInfoEncode ], 1 time
  755. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.1.1 ],
  756. Value Name: [ Dll ], Value: [ cryptdlg.dll ], 1 time
  757. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.1.1 ],
  758. Value Name: [ FuncName ], Value: [ EncodeAttrSequence ], 1 time
  759. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.4 ],
  760. Value Name: [ Dll ], Value: [ cryptdlg.dll ], 1 time
  761. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.4 ],
  762. Value Name: [ FuncName ], Value: [ EncodeRecipientID ], 1 time
  763. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.10 ],
  764. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  765. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.10 ],
  766. Value Name: [ FuncName ], Value: [ WVTAsn1SpcSpAgencyInfoEncode ], 1 time
  767. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.11 ],
  768. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  769. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.11 ],
  770. Value Name: [ FuncName ], Value: [ WVTAsn1SpcStatementTypeEncode ], 1 time
  771. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.12 ],
  772. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  773. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.12 ],
  774. Value Name: [ FuncName ], Value: [ WVTAsn1SpcSpOpusInfoEncode ], 1 time
  775. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.15 ],
  776. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  777. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.15 ],
  778. Value Name: [ FuncName ], Value: [ WVTAsn1SpcPeImageDataEncode ], 1 time
  779. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.20 ],
  780. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  781. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.20 ],
  782. Value Name: [ FuncName ], Value: [ WVTAsn1SpcLinkEncode ], 1 time
  783. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.25 ],
  784. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  785. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.25 ],
  786. Value Name: [ FuncName ], Value: [ WVTAsn1SpcLinkEncode ], 1 time
  787. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.26 ],
  788. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  789. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.26 ],
  790. Value Name: [ FuncName ], Value: [ WVTAsn1SpcMinimalCriteriaInfoEncode ], 1 time
  791. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.27 ],
  792. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  793. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.27 ],
  794. Value Name: [ FuncName ], Value: [ WVTAsn1SpcFinancialCriteriaInfoEncode ], 1 time
  795. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.28 ],
  796. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  797. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.28 ],
  798. Value Name: [ FuncName ], Value: [ WVTAsn1SpcLinkEncode ], 1 time
  799. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.30 ],
  800. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  801. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.30 ],
  802. Value Name: [ FuncName ], Value: [ WVTAsn1SpcSigInfoEncode ], 1 time
  803. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.4 ],
  804. Value Name: [ Dll ], Value: [ WINTRUST.DLL ], 1 time
  805. Key: [ HKLM\Software\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.4 ],
  806. Value Name: [ FuncName ], Value: [ WVTAsn1SpcIndirectDataContentEncode ], 1 time
  807. Key: [ HKLM\Software\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} ],
  808. Value Name: [ $DLL ], Value: [ WINTRUST.DLL ], 1 time
  809. Key: [ HKLM\Software\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} ],
  810. Value Name: [ $Function ], Value: [ SoftpubCheckCert ], 1 time
  811. Key: [ HKLM\Software\Microsoft\Cryptography\Providers\Trust\CertCheck\{31D1ADC1-D329-11D1-8ED8-0080C76516C6} ],
  812. Value Name: [ $DLL ], Value: [ WINTRUST.DLL ], 1 time
  813. Key: [ HKLM\Software\Microsoft\Cryptography\Providers\Trust\CertCheck\{31D1ADC1-D329-11D1-8ED8-0080C76516C6} ],
  814. Value Name: [ $Function ], Value: [ SoftpubCheckCert ], 1 time
  815. Key: [ HKLM\Software\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} ],
  816. Value Name: [ $DLL ], Value: [ WINTRUST.DLL ], 1 time
  817. Key: [ HKLM\Software\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} ],
  818. Value Name: [ $Function ], Value: [ WintrustCertificateTrust ], 1 time
  819. Key: [ HKLM\Software\Microsoft\Cryptography\Providers\Trust\Certificate\{31D1ADC1-D329-11D1-8ED8-0080C76516C6} ],
  820. Value Name: [ $DLL ], Value: [ WINTRUST.DLL ], 1 time
  821. Key: [ HKLM\Software\Microsoft\Cryptography\Providers\Trust\Certificate\{31D1ADC1-D329-11D1-8ED8-0080C76516C6} ],
  822. Value Name: [ $Function ], Value: [ WintrustCertificateTrust ], 1 time
  823. Key: [ HKLM\Software\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} ],
  824. Value Name: [ $DLL ], Value: [ WINTRUST.DLL ], 1 time
  825. Key: [ HKLM\Software\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} ],
  826. Value Name: [ $Function ], Value: [ SoftpubCleanup ], 1 time
  827. Key: [ HKLM\Software\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} ],
  828. Value Name: [ $DLL ], Value: [ WINTRUST.DLL ], 1 time
  829. Key: [ HKLM\Software\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} ],
  830. Value Name: [ $Function ], Value: [ SoftpubAuthenticode ], 1 time
  831. Key: [ HKLM\Software\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{31D1ADC1-D329-11D1-8ED8-0080C76516C6} ],
  832. Value Name: [ $DLL ], Value: [ mscorsec.dll ], 1 time
  833. Key: [ HKLM\Software\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{31D1ADC1-D329-11D1-8ED8-0080C76516C6} ],
  834. Value Name: [ $Function ], Value: [ CORPolicyEE ], 1 time
  835. Key: [ HKLM\Software\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} ],
  836. Value Name: [ $DLL ], Value: [ WINTRUST.DLL ], 1 time
  837. Key: [ HKLM\Software\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} ],
  838. Value Name: [ $Function ], Value: [ SoftpubInitialize ], 1 time
  839. Key: [ HKLM\Software\Microsoft\Cryptography\Providers\Trust\Initialization\{31D1ADC1-D329-11D1-8ED8-0080C76516C6} ],
  840. Value Name: [ $DLL ], Value: [ WINTRUST.DLL ], 1 time
  841. Key: [ HKLM\Software\Microsoft\Cryptography\Providers\Trust\Initialization\{31D1ADC1-D329-11D1-8ED8-0080C76516C6} ],
  842. Value Name: [ $Function ], Value: [ SoftpubInitialize ], 1 time
  843. Key: [ HKLM\Software\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} ],
  844. Value Name: [ $DLL ], Value: [ WINTRUST.DLL ], 1 time
  845. Key: [ HKLM\Software\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} ],
  846. Value Name: [ $Function ], Value: [ SoftpubLoadMessage ], 1 time
  847. Key: [ HKLM\Software\Microsoft\Cryptography\Providers\Trust\Message\{31D1ADC1-D329-11D1-8ED8-0080C76516C6} ],
  848. Value Name: [ $DLL ], Value: [ WINTRUST.DLL ], 1 time
  849. Key: [ HKLM\Software\Microsoft\Cryptography\Providers\Trust\Message\{31D1ADC1-D329-11D1-8ED8-0080C76516C6} ],
  850. Value Name: [ $Function ], Value: [ SoftpubLoadMessage ], 1 time
  851. Key: [ HKLM\Software\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} ],
  852. Value Name: [ $DLL ], Value: [ WINTRUST.DLL ], 1 time
  853. Key: [ HKLM\Software\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE} ],
  854. Value Name: [ $Function ], Value: [ SoftpubLoadSignature ], 1 time
  855. Key: [ HKLM\Software\Microsoft\Cryptography\Providers\Trust\Signature\{31D1ADC1-D329-11D1-8ED8-0080C76516C6} ],
  856. Value Name: [ $DLL ], Value: [ WINTRUST.DLL ], 1 time
  857. Key: [ HKLM\Software\Microsoft\Cryptography\Providers\Trust\Signature\{31D1ADC1-D329-11D1-8ED8-0080C76516C6} ],
  858. Value Name: [ $Function ], Value: [ SoftpubLoadSignature ], 1 time
  859. Key: [ HKLM\Software\Microsoft\Fusion\GACChangeNotification\Default ],
  860. Value Name: [ mscorlib,2.0.0.0,,b77a5c561934e089,x86 ], Value: [ 0xa8ce1d9f20cfcb01 ], 1 time
  861. Key: [ HKLM\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32 ],
  862. Value Name: [ LatestIndex ], Value: [ 117 ], 3 times
  863. Key: [ HKLM\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\319545b3\8 ],
  864. Value Name: [ DisplayName ], Value: [ mscorlib,2.0.0.0,,b77a5c561934e089 ], 1 time
  865. Key: [ HKLM\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\319545b3\8 ],
  866. Value Name: [ LastModTime ], Value: [ 0xa8ce1d9f20cfcb01 ], 1 time
  867. Key: [ HKLM\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\319545b3\8 ],
  868. Value Name: [ Modules ], Value: [ sortkey.nlp|sorttbls.nlp|big5.nlp|bopomofo.nlp|ksc.nlp|prc.nlp|prcp.nlp|xjis.nlp|normidna.nlp|normnfc.nlp|normnfd.nlp|normnfkc.nlp|normnfkd.nlp ], 1 time
  869. Key: [ HKLM\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\319545b3\8 ],
  870. Value Name: [ SIG ], Value: [ 0x61498a5bb093b143a337bdf5962ece99bd6c58fc8f03105a020331f4a600 ], 1 time
  871. Key: [ HKLM\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\319545b3\8 ],
  872. Value Name: [ Status ], Value: [ 8198 ], 1 time
  873. Key: [ HKLM\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\3c74e9a9\8 ],
  874. Value Name: [ ConfigMask ], Value: [ 4361 ], 1 time
  875. Key: [ HKLM\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\3c74e9a9\8 ],
  876. Value Name: [ ConfigString ], Value: [ ZAP--0000-0000 ], 1 time
  877. Key: [ HKLM\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\3c74e9a9\8 ],
  878. Value Name: [ DisplayName ], Value: [ mscorlib,2.0.0.0,,b77a5c561934e089 ], 1 time
  879. Key: [ HKLM\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\3c74e9a9\8 ],
  880. Value Name: [ ILDependencies ], Value: [ 0xc5e25079b3459531080000000200000000000000 ], 1 time
  881. Key: [ HKLM\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\3c74e9a9\8 ],
  882. Value Name: [ MVID ], Value: [ 0x642534209e13d16e93b80a628742d2ee ], 1 time
  883. Key: [ HKLM\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\3c74e9a9\8 ],
  884. Value Name: [ Status ], Value: [ 0 ], 1 time
  885. Key: [ HKLM\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index75 ],
  886. Value Name: [ ILUsageMask ], Value: [ 0xffffffffffffffffff01 ], 1 time
  887. Key: [ HKLM\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index75 ],
  888. Value Name: [ NIUsageMask ], Value: [ 0xfffffffffffffffff1 ], 1 time
  889. Key: [ HKLM\Software\Microsoft\Fusion\PublisherPolicy\Default ],
  890. Value Name: [ Latest ], Value: [ 1 ], 1 time
  891. Key: [ HKLM\Software\Microsoft\Fusion\PublisherPolicy\Default ],
  892. Value Name: [ LegacyPolicyTimeStamp ], Value: [ 0x0000000000000000 ], 1 time
  893. Key: [ HKLM\Software\Microsoft\Fusion\PublisherPolicy\Default ],
  894. Value Name: [ index1 ], Value: [ 0x00 ], 1 time
  895. Key: [ HKLM\Software\Microsoft\PCHealth\ErrorReporting\DW\Installed ],
  896. Value Name: [ DW0200 ], Value: [ C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE ], 1 time
  897. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\0048F8D37B153F6EA2798C323EF4F318A5624A9E ],
  898. Value Name: [ Blob ], Value: [ 0x04000000010000001000000015b298a354704048703a375582c45afa1400 ], 2 times
  899. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\00EA522C8A9C06AA3ECCE0B4FA6CDC21D92E8099 ],
  900. Value Name: [ Blob ], Value: [ 0x0400000001000000100000003e80175badd77c104bf941b0cf1642b01400 ], 2 times
  901. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\0483ED3399AC3608058722EDBC5E4600E3BEF9D7 ],
  902. Value Name: [ Blob ], Value: [ 0x0400000001000000100000004c5641e50dbb2be8caa3ed1808ad43391400 ], 2 times
  903. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\049811056AFE9FD0F5BE01685AACE6A5D1C4454C ],
  904. Value Name: [ Blob ], Value: [ 0x040000000100000010000000f27de954e4a3220d769fe70bbbb3242b1400 ], 2 times
  905. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\0B77BEBBCB7AA24705DECC0FBD6A02FC7ABD9B52 ],
  906. Value Name: [ Blob ], Value: [ 0x040000000100000010000000266d2c1998b6706838505419ec9034601400 ], 2 times
  907. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\1331F48A5DA8E01DAACA1BB0C17044ACFEF755BB ],
  908. Value Name: [ Blob ], Value: [ 0x04000000010000001000000050e1419d59738b46732d7f7fcf5c44f11400 ], 2 times
  909. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\1F55E8839BAC30728BE7108EDE7B0BB0D3298224 ],
  910. Value Name: [ Blob ], Value: [ 0x0400000001000000100000008cd79febc7b8144c5478a7903ba935671400 ], 2 times
  911. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\209900B63D955728140CD13622D8C687A4EB0085 ],
  912. Value Name: [ Blob ], Value: [ 0x0400000001000000100000001e74c3863c0c35c53ec27fef3caa3cd91400 ], 2 times
  913. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\216B2A29E62A00CE820146D8244141B92511B279 ],
  914. Value Name: [ Blob ], Value: [ 0x040000000100000010000000e14b5273d71bdb9330e5bde4096ebefb1400 ], 2 times
  915. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\23E594945195F2414803B4D564D2A3A3F5D88B8C ],
  916. Value Name: [ Blob ], Value: [ 0x040000000100000010000000c570c4a2ed53780cc810538164cbd01d1400 ], 2 times
  917. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\24A40A1F573643A67F0A4B0749F6A22BF28ABB6B ],
  918. Value Name: [ Blob ], Value: [ 0x040000000100000010000000dd753f56bfbbc5a17a1553c690f9fbcc1400 ], 2 times
  919. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\24BA6D6C8A5B5837A48DB5FAE919EA675C94D217 ],
  920. Value Name: [ Blob ], Value: [ 0x0400000001000000100000007bb508999a8c18bf85277d0eaedab2ab1400 ], 2 times
  921. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\273EE12457FDC4F90C55E82B56167F62F532E547 ],
  922. Value Name: [ Blob ], Value: [ 0x040000000100000010000000db233df969fa4bb9958044735e7d41831400 ], 2 times
  923. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\284F55C41A1A7A3F8328D4C262FB376ED6096F24 ],
  924. Value Name: [ Blob ], Value: [ 0x040000000100000010000000011a3f4db5f814c56848ad083eb9c8c21400 ], 2 times
  925. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\2F173F7DE99667AFA57AF80AA2D1B12FAC830338 ],
  926. Value Name: [ Blob ], Value: [ 0x040000000100000010000000abbfeae36b29a6cca6783599efad2b801400 ], 2 times
  927. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6 ],
  928. Value Name: [ Blob ], Value: [ 0x040000000100000010000000a923759bba49366e31c2dbf2e766ba871400 ], 2 times
  929. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\36863563FD5128C7BEA6F005CFE9B43668086CCE ],
  930. Value Name: [ Blob ], Value: [ 0x0400000001000000100000003ab2de229a209349f9edc8d28ae7680d1400 ], 2 times
  931. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\394FF6850B06BE52E51856CC10E180E882B385CC ],
  932. Value Name: [ Blob ], Value: [ 0x040000000100000010000000aabfbf6497da981d6fc6083a957033ca1400 ], 2 times
  933. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\3F85F2BB4A62B0B58BE1614ABB0D4631B4BEF8BA ],
  934. Value Name: [ Blob ], Value: [ 0x0400000001000000100000002a5d003739469475397b11a6f29341e11400 ], 2 times
  935. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\4072BA31FEC351438480F62E6CB95508461EAB2F ],
  936. Value Name: [ Blob ], Value: [ 0x04000000010000001000000070b57c4881953e80dc289bbaef1ee4851400 ], 2 times
  937. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\40E78C1D523D1CD9954FAC1A1AB3BD3CBAA15BFC ],
  938. Value Name: [ Blob ], Value: [ 0x040000000100000010000000e60bd2c9ca2d88db1a710e4b78eb02411400 ], 2 times
  939. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\43DDB1FFF3B49B73831407F6BC8B975023D07C50 ],
  940. Value Name: [ Blob ], Value: [ 0x04000000010000001000000000531d1d7201d423c820d00b6088c5d11400 ], 2 times
  941. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\43F9B110D5BAFD48225231B0D0082B372FEF9A54 ],
  942. Value Name: [ Blob ], Value: [ 0x040000000100000010000000259dcf5eb3259d95b93f00865f47943d1400 ], 2 times
  943. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\4463C531D7CCC1006794612BB656D3BF8257846F ],
  944. Value Name: [ Blob ], Value: [ 0x040000000100000010000000747b820343f0009e6bb3ec47bf85a5931400 ], 2 times
  945. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\47AFB915CDA26D82467B97FA42914468726138DD ],
  946. Value Name: [ Blob ], Value: [ 0x04000000010000001000000050193e2fe8b6f4055449f3aec98b3e191400 ], 2 times
  947. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\4B421F7515F6AE8A6ECEF97F6982A400A4D9224E ],
  948. Value Name: [ Blob ], Value: [ 0x0400000001000000100000005a11b922850289e1c3f22ce14ec101841400 ], 2 times
  949. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\4BA7B9DDD68788E12FF852E1A024204BF286A8F6 ],
  950. Value Name: [ Blob ], Value: [ 0x04000000010000001000000018ae695d15cab917673267d597b260c01400 ], 2 times
  951. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\4C95A9902ABE0777CED18D6ACCC3372D2748381E ],
  952. Value Name: [ Blob ], Value: [ 0x0400000001000000100000004b1c568ca0e8c79e1ef5ee32939965fe1400 ], 2 times
  953. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 ],
  954. Value Name: [ Blob ], Value: [ 0x040000000100000010000000cb17e431673ee209fe455793f30afa1c0300 ], 2 times
  955. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\4EF2E6670AC9B5091FE06BE0E5483EAAD6BA32D9 ],
  956. Value Name: [ Blob ], Value: [ 0x040000000100000010000000034287d7c1167d18afa4703cb8312c3e1400 ], 2 times
  957. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\4EFCED9C6BDD0C985CA3C7D253063C5BE6FC620C ],
  958. Value Name: [ Blob ], Value: [ 0x040000000100000010000000852ff4764cd5426ccb5e7df717e835bd1400 ], 2 times
  959. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\4F65566336DB6598581D584A596C87934D5F2AB4 ],
  960. Value Name: [ Blob ], Value: [ 0x040000000100000010000000782a02dfdb2e14d5a75f0adfb68e9c5d1400 ], 2 times
  961. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\54F9C163759F19045121A319F64C2D0555B7E073 ],
  962. Value Name: [ Blob ], Value: [ 0x0400000001000000100000004b798dd41d0392aa51ee04e5906f47491400 ], 2 times
  963. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\58119F0E128287EA50FDD987456F4F78DCFAD6D4 ],
  964. Value Name: [ Blob ], Value: [ 0x040000000100000010000000b3a53e77216dac4ac0c9fbd5413dca061400 ], 2 times
  965. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\5B4E0EC28EBD8292A51782241281AD9FEEDD4E4C ],
  966. Value Name: [ Blob ], Value: [ 0x040000000100000010000000b774cd487c5f9a0d3bf3fe66f41b3dfa1400 ], 2 times
  967. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\5D989CDB159611365165641B560FDBEA2AC23EF1 ],
  968. Value Name: [ Blob ], Value: [ 0x040000000100000010000000bf6059a35bbaf6a77642da6f1a7b50cf1400 ], 2 times
  969. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\5E5A168867BFFF00987D0B1DC2AB466C4264F956 ],
  970. Value Name: [ Blob ], Value: [ 0x040000000100000010000000343339fc6d033a8fa25385443270dec41400 ], 2 times
  971. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\5E997CA5945AAB75FFD14804A974BF2AE1DFE7E1 ],
  972. Value Name: [ Blob ], Value: [ 0x0400000001000000100000009aaef722f533fb4eec0a249dc63d7d251400 ], 2 times
  973. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\627F8D7827656399D27D7F9044C9FEB3F33EFA9A ],
  974. Value Name: [ Blob ], Value: [ 0x040000000100000010000000069f6979166690021b8c8ca2c3076f3a1400 ], 2 times
  975. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\6372C49DA9FFF051B8B5C7D4E5AAE30384024B9C ],
  976. Value Name: [ Blob ], Value: [ 0x0400000001000000100000008956aa4d441e59d805a1886deac828b21400 ], 2 times
  977. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\6782AAE0EDEEE21A5839D3C0CD14680A4F60142A ],
  978. Value Name: [ Blob ], Value: [ 0x040000000100000010000000b39c25b1c32e32538015309d4d02773e1400 ], 2 times
  979. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\67EB337B684CEB0EC2B0760AB488278CDD9597DD ],
  980. Value Name: [ Blob ], Value: [ 0x040000000100000010000000cd3b3d625b09b80936879e122f7164ba1400 ], 2 times
  981. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\687EC17E0602E3CD3F7DFBD7E28D57A0199A3F44 ],
  982. Value Name: [ Blob ], Value: [ 0x040000000100000010000000824ad493004d66b6a32ca77b3536cf0b1400 ], 2 times
  983. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\688B6EB807E8EDA5C7B17C4393D0795F0FAE155F ],
  984. Value Name: [ Blob ], Value: [ 0x040000000100000010000000e8cc9fb09b40c51f4fba7421f952857a1400 ], 2 times
  985. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\68ED18B309CD5291C0D3357C1D1141BF883866B1 ],
  986. Value Name: [ Blob ], Value: [ 0x0400000001000000100000008212f789e10b9160a4b6229f946811921400 ], 2 times
  987. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\69BD8CF49CD300FB592E1793CA556AF3ECAA35FB ],
  988. Value Name: [ Blob ], Value: [ 0x040000000100000010000000a26f53b7ee40db4a68e7fa18d9104b721400 ], 2 times
  989. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\6A174570A916FBE84453EED3D070A1D8DA442829 ],
  990. Value Name: [ Blob ], Value: [ 0x0400000001000000100000002124a681c1d8f219af4998e39dfe0bf41400 ], 2 times
  991. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\720FC15DDC27D456D098FABF3CDD78D31EF5A8DA ],
  992. Value Name: [ Blob ], Value: [ 0x0400000001000000100000008d26ff2f316d5929dde636a7e2ce64251400 ], 2 times
  993. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\74207441729CDD92EC7931D823108DC28192E2BB ],
  994. Value Name: [ Blob ], Value: [ 0x040000000100000010000000882c8c52b8a23cf3f7bb03eaaeac420b1400 ], 2 times
  995. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2 ],
  996. Value Name: [ Blob ], Value: [ 0x04000000010000001000000010fc635df6263e0df325be5f79cd67671400 ], 2 times
  997. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\7639C71847E151B5C7EA01C758FBF12ABA298F7A ],
  998. Value Name: [ Blob ], Value: [ 0x040000000100000010000000a8eddeeb938866d82fc3bd1dbe45be4d1400 ], 2 times
  999. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\78E9DD0650624DB9CB36B50767F209B843BE15B3 ],
  1000. Value Name: [ Blob ], Value: [ 0x0400000001000000100000005186e81fbcb1c371b51810db5fdcf6201400 ], 2 times
  1001. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\7A74410FB0CD5C972A364B71BF031D88A6510E9E ],
  1002. Value Name: [ Blob ], Value: [ 0x04000000010000001000000041b807f7a8d109eeb49a8e704dfc1b781400 ], 2 times
  1003. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\7AC5FFF8DCBC5583176877073BF751735E9BD358 ],
  1004. Value Name: [ Blob ], Value: [ 0x0400000001000000100000004b6771be33b90db64b3a400187f08b1f1400 ], 2 times
  1005. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\7CA04FD8064C1CAA32A37AA94375038E8DF8DDC0 ],
  1006. Value Name: [ Blob ], Value: [ 0x0400000001000000100000005b6f532cbb8188fa6c042c325da56b961400 ], 2 times
  1007. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\7E784A101C8265CC2DE1F16D47B440CAD90A1945 ],
  1008. Value Name: [ Blob ], Value: [ 0x0400000001000000100000008f5d770627c4983c5b9378e7d77d9bcc1400 ], 2 times
  1009. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\81968B3AEF1CDC70F5FA3269C292A3635BD123D3 ],
  1010. Value Name: [ Blob ], Value: [ 0x040000000100000010000000257aba832eb6a20bdafef5020f08d7ad1400 ], 2 times
  1011. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\838E30F77FDD14AA385ED145009C0E2236494FAA ],
  1012. Value Name: [ Blob ], Value: [ 0x040000000100000010000000b816334c4c4cf2d8d34d06b4a65b40031400 ], 2 times
  1013. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\85371CA6E550143DCE2803471BDE3A09E8F8770F ],
  1014. Value Name: [ Blob ], Value: [ 0x040000000100000010000000a2339b4c747873d46ce7c1f38dcb5ce91400 ], 2 times
  1015. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\85A408C09C193E5D51587DCDD61330FD8CDE37BF ],
  1016. Value Name: [ Blob ], Value: [ 0x04000000010000001000000074014a91b108c458ce47cdf0dd1153081400 ], 2 times
  1017. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\879F4BEE05DF98583BE360D633E70D3FFE9871AF ],
  1018. Value Name: [ Blob ], Value: [ 0x0400000001000000100000003916aab96a41e11469df9e6c3b72dcb61400 ], 2 times
  1019. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\8EB03FC3CF7BB292866268B751223DB5103405CB ],
  1020. Value Name: [ Blob ], Value: [ 0x0400000001000000100000008bca525f7553d02c6f630d8f882e1cd71400 ], 2 times
  1021. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\9078C5A28F9A4325C2A7C73813CDFE13C20F934E ],
  1022. Value Name: [ Blob ], Value: [ 0x040000000100000010000000f20598e5964bbe5d55181b55b388e3921400 ], 2 times
  1023. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\90AEA26985FF14804C434952ECE9608477AF556F ],
  1024. Value Name: [ Blob ], Value: [ 0x0400000001000000100000009760e8575fd35047e5430c94368ab0621400 ], 2 times
  1025. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\90DEDE9E4C4E9F6FD88617579DD391BC65A68964 ],
  1026. Value Name: [ Blob ], Value: [ 0x040000000100000010000000c4d7f0b2a3c57d6167f004cd43d3ba581400 ], 2 times
  1027. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\96974CD6B663A7184526B1D648AD815CF51E801A ],
  1028. Value Name: [ Blob ], Value: [ 0x040000000100000010000000711f0e21e7aaea323a6623d3ab50d6691400 ], 2 times
  1029. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\97817950D81C9670CC34D809CF794431367EF474 ],
  1030. Value Name: [ Blob ], Value: [ 0x040000000100000010000000ca3dd368f1035cd032fab82b59e85adb1400 ], 2 times
  1031. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\97E2E99636A547554F838FBA38B82E74F89A830A ],
  1032. Value Name: [ Blob ], Value: [ 0x040000000100000010000000c463ab44201c36e437c05f279d0f6f6e1400 ], 2 times
  1033. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\99A69BE61AFE886B4D2B82007CB854FC317E1539 ],
  1034. Value Name: [ Blob ], Value: [ 0x040000000100000010000000dff28073ccf1e66173fcf542e9c57cee1400 ], 2 times
  1035. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\9BACF3B664EAC5A17BED08437C72E4ACDA12F7E7 ],
  1036. Value Name: [ Blob ], Value: [ 0x040000000100000010000000e2d52023eceeb872e12b5d296ffa43da1400 ], 2 times
  1037. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\9E6CEB179185A29EC6060CA53E1974AF94AF59D4 ],
  1038. Value Name: [ Blob ], Value: [ 0x0400000001000000100000009b340d1a315b97462698bca6136a71961400 ], 2 times
  1039. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\9FC796E8F8524F863AE1496D381242105F1B78F5 ],
  1040. Value Name: [ Blob ], Value: [ 0x0400000001000000100000005f944a7322b8f7d131ec5939f78efe6e1400 ], 2 times
  1041. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\A399F76F0CBF4C9DA55E4AC24E8960984B2905B6 ],
  1042. Value Name: [ Blob ], Value: [ 0x040000000100000010000000370971c4afeb7501ae636c3016bfd1e51400 ], 2 times
  1043. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\A3E31E20B2E46A328520472D0CDE9523E7260C6D ],
  1044. Value Name: [ Blob ], Value: [ 0x040000000100000010000000a33d88fe161bddf95c9f1a7fd8c890081400 ], 2 times
  1045. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\A5EC73D48C34FCBEF1005AEB85843524BBFAB727 ],
  1046. Value Name: [ Blob ], Value: [ 0x040000000100000010000000ec407d2b765267052ceaf23a4f65f0d81400 ], 2 times
  1047. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\AB48F333DB04ABB9C072DA5B0CC1D057F0369B46 ],
  1048. Value Name: [ Blob ], Value: [ 0x04000000010000001000000093c28e117bd4f30319bd2875134a454a1400 ], 2 times
  1049. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\ACED5F6553FD25CE015F1F7A483B6A749F6178C6 ],
  1050. Value Name: [ Blob ], Value: [ 0x04000000010000001000000086386d5e49636c855cdb6ddc94b7d0f71400 ], 2 times
  1051. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\B172B1A56D95F91FE50287E14D37EA6A4463768A ],
  1052. Value Name: [ Blob ], Value: [ 0x040000000100000010000000d7343def1d270928e131025b132bddf71400 ], 2 times
  1053. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\B19DD096DCD4E3E0FD676885505A672C438D4E9C ],
  1054. Value Name: [ Blob ], Value: [ 0x0400000001000000100000002b508718392d3bffc3917f2d7dc08a971400 ], 2 times
  1055. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\B3EAC44776C9C81CEAF29D95B6CCA0081B67EC9D ],
  1056. Value Name: [ Blob ], Value: [ 0x0400000001000000100000002dbbe525d3d165823ab70efae6ebe2e11400 ], 2 times
  1057. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\B5D303BF8682E152919D83F184ED05F1DCE5370C ],
  1058. Value Name: [ Blob ], Value: [ 0x040000000100000010000000978fc66b3b3e40857724750b76bb55f81400 ], 2 times
  1059. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\B6AF5BE5F878A00114C3D7FEF8C775C34CCD17B6 ],
  1060. Value Name: [ Blob ], Value: [ 0x040000000100000010000000a37d2c27e4a7f3aa5f75d4c49264026a1400 ], 2 times
  1061. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\B72FFF92D2CE43DE0A8D4C548C503726A81E2B93 ],
  1062. Value Name: [ Blob ], Value: [ 0x0400000001000000100000006cc9a76e47f10ce3533b784c4dc26ac51400 ], 2 times
  1063. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\BC9219DDC98E14BF1A781F6E280B04C27F902712 ],
  1064. Value Name: [ Blob ], Value: [ 0x040000000100000010000000b465220a7caddf41b7d544d5adfa9a751400 ], 2 times
  1065. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656 ],
  1066. Value Name: [ Blob ], Value: [ 0x0400000001000000100000007f667a71d3eb6978209a51149d83da201400 ], 2 times
  1067. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\CABB51672400588E6419F1D40878D0403AA20264 ],
  1068. Value Name: [ Blob ], Value: [ 0x040000000100000010000000bdd6f58a7c3cc4a6f934ccc38961f6b21400 ], 2 times
  1069. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\CFDEFE102FDA05BBE4C78D2E4423589005B2571D ],
  1070. Value Name: [ Blob ], Value: [ 0x040000000100000010000000ad8e0f9e016ba0c574d50cd368654f1e1400 ], 2 times
  1071. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\CFF360F524CB20F1FEAD89006F7F586A285B2D5B ],
  1072. Value Name: [ Blob ], Value: [ 0x04000000010000001000000074a82c81432b35609b78056b58f365821400 ], 2 times
  1073. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\CFF810FB2C4FFC0156BFE1E1FABCB418C68D31C5 ],
  1074. Value Name: [ Blob ], Value: [ 0x04000000010000001000000071e265fbcd7b0b845be3bcd76320c5981400 ], 2 times
  1075. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\D23209AD23D314232174E40D7F9D62139786633A ],
  1076. Value Name: [ Blob ], Value: [ 0x04000000010000001000000067cb9dc013248a829bb2171ed11becd41400 ], 2 times
  1077. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\D29F6C98BEFC6D986521543EE8BE56CEBC288CF3 ],
  1078. Value Name: [ Blob ], Value: [ 0x0400000001000000100000000efa4bf7d760cd65f7a70688579862391400 ], 2 times
  1079. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\D2EDF88B41B6FE01461D6E2834EC7C8F6C77721E ],
  1080. Value Name: [ Blob ], Value: [ 0x040000000100000010000000bd8ace34a8ae6148e85ec87a1ce8ccbf1400 ], 2 times
  1081. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\DA40188B9189A3EDEEAEDA97FE2F9DF5B7D18A41 ],
  1082. Value Name: [ Blob ], Value: [ 0x040000000100000010000000649cef2e44fcc68f5207d051738fcb3d1400 ], 2 times
  1083. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\DBAC3C7AA4254DA1AA5CAAD68468CB88EEDDEEA8 ],
  1084. Value Name: [ Blob ], Value: [ 0x040000000100000010000000df168a83ea83845db96501c6a65d193e1400 ], 2 times
  1085. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46 ],
  1086. Value Name: [ Blob ], Value: [ 0x040000000100000010000000a7f2e41606411150306b9ce3b49cb0c91400 ], 2 times
  1087. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\E392512F0ACFF505DFF6DE067F7537E165EA574B ],
  1088. Value Name: [ Blob ], Value: [ 0x0400000001000000100000004febf1f070c280635d589fda123ca9c41400 ], 2 times
  1089. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\E4554333CA390E128B8BF81D90B70F4002D1D6E9 ],
  1090. Value Name: [ Blob ], Value: [ 0x040000000100000010000000bfb5e77d3dea6f1df08a50bc8c1cfa1d1400 ], 2 times
  1091. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\E5DF743CB601C49B9843DCAB8CE86A81109FE48E ],
  1092. Value Name: [ Blob ], Value: [ 0x0400000001000000100000006558ab15ad576c1ea8a7b569acbfffeb1400 ], 2 times
  1093. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\EBBC0E2D020CA69B222C2BFFD203CB8BF5A82766 ],
  1094. Value Name: [ Blob ], Value: [ 0x040000000100000010000000b2407992461a19c4180fec34ec68afd51400 ], 2 times
  1095. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\EC0C3716EA9EDFADD35DFBD55608E60A05D3CBF3 ],
  1096. Value Name: [ Blob ], Value: [ 0x04000000010000001000000078a5fb104be4632ed26bfbf2b6c24b8e1400 ], 2 times
  1097. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\EF2DACCBEABB682D32CE4ABD6CB90025236C07BC ],
  1098. Value Name: [ Blob ], Value: [ 0x040000000100000010000000c69f6d5cb379b00389cbf03fa4c09f8a1400 ], 2 times
  1099. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\F44095C238AC73FC4F77BF8F98DF70F8F091BC52 ],
  1100. Value Name: [ Blob ], Value: [ 0x040000000100000010000000f4ff97428070fe66168bbed35315819b1400 ], 2 times
  1101. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\\Certificates\F88015D3F98479E1DA553D24FD42BA3F43886AEF ],
  1102. Value Name: [ Blob ], Value: [ 0x040000000100000010000000160a1613c17ff01d887ee3d9e71261cc1400 ], 2 times
  1103. Key: [ HKLM\Software\Microsoft\SystemCertificates\Disallowed\\Certificates\637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6 ],
  1104. Value Name: [ Blob ], Value: [ 0x0f000000010000001000000033592925e547604fd98c09f1fa44c2790b00 ], 4 times
  1105. Key: [ HKLM\Software\Microsoft\SystemCertificates\Disallowed\\Certificates\7D7F4414CCEF168ADF6BF40753B5BECD78375931 ],
  1106. Value Name: [ Blob ], Value: [ 0x0f00000001000000100000008cdb18e99a266c9be818e94229cf0fca0b00 ], 4 times
  1107. Key: [ HKLM\Software\Microsoft\SystemCertificates\ca\\CRLs\A377D1B1C0538833035211F4083D00FECC414DAB ],
  1108. Value Name: [ Blob ], Value: [ 0x030000000100000014000000a377d1b1c0538833035211f4083d00fecc41 ], 2 times
  1109. Key: [ HKLM\Software\Microsoft\SystemCertificates\ca\\Certificates\063DA67748F0ECCC690D319BCDCD0E72AC8D48D5 ],
  1110. Value Name: [ Blob ], Value: [ 0x19000000010000001000000012fabd58acd5fc77cd7608b3d3378c3d0300 ], 2 times
  1111. Key: [ HKLM\Software\Microsoft\SystemCertificates\ca\\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C ],
  1112. Value Name: [ Blob ], Value: [ 0x030000000100000014000000109f1caed645bb78b3ea2b94c0697c740733 ], 2 times
  1113. Key: [ HKLM\Software\Microsoft\SystemCertificates\ca\\Certificates\12519AE9CD777A560184F1FBD54215222E95E71F ],
  1114. Value Name: [ Blob ], Value: [ 0x190000000100000010000000a889c4496403d2619e040ad282ffc1590300 ], 2 times
  1115. Key: [ HKLM\Software\Microsoft\SystemCertificates\ca\\Certificates\189271E573FED295A8C130EAF357A20C4A9F115E ],
  1116. Value Name: [ Blob ], Value: [ 0x19000000010000001000000099c03958d4138c59ae87672beb67432a0300 ], 2 times
  1117. Key: [ HKLM\Software\Microsoft\SystemCertificates\ca\\Certificates\2D69A20EC4F0CD19037FD6D6246B1EE0EC41BA22 ],
  1118. Value Name: [ Blob ], Value: [ 0x1900000001000000100000004187d1f7d569d7cab129111df89991810300 ], 2 times
  1119. Key: [ HKLM\Software\Microsoft\SystemCertificates\ca\\Certificates\7B02312BACC59EC388FEAE12FD277F6A9FB4FAC1 ],
  1120. Value Name: [ Blob ], Value: [ 0x190000000100000010000000c4f1f90b2787ece21c32340df76cc67c0300 ], 2 times
  1121. Key: [ HKLM\Software\Microsoft\SystemCertificates\ca\\Certificates\8B24CD8D8B58C6DA72ACE097C7B1E3CEA4DC3DC6 ],
  1122. Value Name: [ Blob ], Value: [ 0x1900000001000000100000006ed6ed7df52fc19bdc9e5fe9e2be21fb0300 ], 2 times
  1123. Key: [ HKLM\Software\Microsoft\SystemCertificates\ca\\Certificates\9F025D9F58711A605EB0694B0E8BC0CA4F25FD6F ],
  1124. Value Name: [ Blob ], Value: [ 0x190000000100000010000000fe4d945be7ca1f62953a5c89cd07a9960300 ], 2 times
  1125. Key: [ HKLM\Software\Microsoft\SystemCertificates\ca\\Certificates\BA9E3C32562A67128CAABD4AB0C500BEE1D0C256 ],
  1126. Value Name: [ Blob ], Value: [ 0x19000000010000001000000083b65318664e6fa245e0d7609fb958200300 ], 2 times
  1127. Key: [ HKLM\Software\Microsoft\SystemCertificates\ca\\Certificates\E5215D3460C2C20BBE2D9FE5FB665DAA2C0E225C ],
  1128. Value Name: [ Blob ], Value: [ 0x190000000100000010000000a823b4a20180beb460cab955c24d7e210300 ], 2 times
  1129. Key: [ HKLM\Software\Microsoft\SystemCertificates\ca\\Certificates\F6357239B7C39725BD8000646E4A0D18EBCE4CFA ],
  1130. Value Name: [ Blob ], Value: [ 0x1900000001000000100000008d1180a8ac4f2b186c7da5fffd8b86e10300 ], 2 times
  1131. Key: [ HKLM\Software\Microsoft\SystemCertificates\ca\\Certificates\FE622EA7B33CA46519AB39736A66B8F6E41FF157 ],
  1132. Value Name: [ Blob ], Value: [ 0x1900000001000000100000005dc45e2cd1845791bdde7600050af5100300 ], 2 times
  1133. Key: [ HKLM\Software\Microsoft\SystemCertificates\ca\\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4 ],
  1134. Value Name: [ Blob ], Value: [ 0x190000000100000010000000edbccdd5106a071c5d8b4690918e48aa0300 ], 2 times
  1135. Key: [ HKLM\Software\Microsoft\SystemCertificates\disallowed\\Certificates\637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6 ],
  1136. Value Name: [ Blob ], Value: [ 0x0f000000010000001000000033592925e547604fd98c09f1fa44c2790b00 ], 2 times
  1137. Key: [ HKLM\Software\Microsoft\SystemCertificates\disallowed\\Certificates\7D7F4414CCEF168ADF6BF40753B5BECD78375931 ],
  1138. Value Name: [ Blob ], Value: [ 0x0f00000001000000100000008cdb18e99a266c9be818e94229cf0fca0b00 ], 2 times
  1139. Key: [ HKLM\Software\Microsoft\SystemCertificates\root\\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25 ],
  1140. Value Name: [ Blob ], Value: [ 0x040000000100000010000000ebb04f1d3a2e372f1dda6e27d6b680fa1400 ], 2 times
  1141. Key: [ HKLM\Software\Microsoft\SystemCertificates\root\\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85 ],
  1142. Value Name: [ Blob ], Value: [ 0x040000000100000010000000556ebef54c1d7c0360c43418bc9649c11400 ], 2 times
  1143. Key: [ HKLM\Software\Microsoft\SystemCertificates\root\\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247 ],
  1144. Value Name: [ Blob ], Value: [ 0x040000000100000010000000dc6d6faf897cdd17332fb5ba9035e9ce1400 ], 2 times
  1145. Key: [ HKLM\Software\Microsoft\SystemCertificates\root\\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419 ],
  1146. Value Name: [ Blob ], Value: [ 0x1900000001000000100000003fc8cb0bc05241e58d65e9448b2d07c21400 ], 2 times
  1147. Key: [ HKLM\Software\Microsoft\SystemCertificates\root\\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072 ],
  1148. Value Name: [ Blob ], Value: [ 0x190000000100000010000000983b132635b7e91deef54a6780c092691400 ], 2 times
  1149. Key: [ HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscoree.dll ],
  1150. Value Name: [ CheckAppHelp ], Value: [ 1 ], 1 time
  1151. Key: [ HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorwks.dll ],
  1152. Value Name: [ CheckAppHelp ], Value: [ 1 ], 1 time
  1153. Key: [ HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList ],
  1154. Value Name: [ AllUsersProfile ], Value: [ All Users ], 3 times
  1155. Key: [ HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList ],
  1156. Value Name: [ DefaultUserProfile ], Value: [ Default User ], 3 times
  1157. Key: [ HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList ],
  1158. Value Name: [ ProfilesDirectory ], Value: [ %SystemDrive%\Documents and Settings ], 6 times
  1159. Key: [ HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-842925246-1425521274-308236825-500 ],
  1160. Value Name: [ ProfileImagePath ], Value: [ %SystemDrive%\Documents and Settings\Administrator ], 3 times
  1161. Key: [ HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows ],
  1162. Value Name: [ AppInit_DLLs ], Value: [ ], 1 time
  1163. Key: [ HKLM\Software\Microsoft\Windows\CurrentVersion ],
  1164. Value Name: [ CommonFilesDir ], Value: [ C:\Program Files\Common Files ], 3 times
  1165. Key: [ HKLM\Software\Microsoft\Windows\CurrentVersion ],
  1166. Value Name: [ ProgramFilesDir ], Value: [ C:\Program Files ], 3 times
  1167. Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers ],
  1168. Value Name: [ AuthenticodeEnabled ], Value: [ 0 ], 1 time
  1169. Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers ],
  1170. Value Name: [ DefaultLevel ], Value: [ 262144 ], 1 time
  1171. Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers ],
  1172. Value Name: [ PolicyScope ], Value: [ 0 ], 1 time
  1173. Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers ],
  1174. Value Name: [ TransparentEnabled ], Value: [ 1 ], 2 times
  1175. Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328} ],
  1176. Value Name: [ HashAlg ], Value: [ 32771 ], 1 time
  1177. Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328} ],
  1178. Value Name: [ ItemData ], Value: [ 0x5eab304f957a49896a006c1c31154015 ], 1 time
  1179. Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328} ],
  1180. Value Name: [ ItemSize ], Value: [ 779 ], 1 time
  1181. Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328} ],
  1182. Value Name: [ SaferFlags ], Value: [ 0 ], 1 time
  1183. Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91} ],
  1184. Value Name: [ HashAlg ], Value: [ 32771 ], 1 time
  1185. Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91} ],
  1186. Value Name: [ ItemData ], Value: [ 0x67b0d48b343a3fd3bce9dc646704f394 ], 1 time
  1187. Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91} ],
  1188. Value Name: [ ItemSize ], Value: [ 517 ], 1 time
  1189. Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91} ],
  1190. Value Name: [ SaferFlags ], Value: [ 0 ], 1 time
  1191. Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f} ],
  1192. Value Name: [ HashAlg ], Value: [ 32771 ], 1 time
  1193. Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f} ],
  1194. Value Name: [ ItemData ], Value: [ 0x327802dcfef8c893dc8ab006dd847d1d ], 1 time
  1195. Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f} ],
  1196. Value Name: [ ItemSize ], Value: [ 918 ], 1 time
  1197. Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f} ],
  1198. Value Name: [ SaferFlags ], Value: [ 0 ], 1 time
  1199. Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d} ],
  1200. Value Name: [ HashAlg ], Value: [ 32771 ], 1 time
  1201. Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d} ],
  1202. Value Name: [ ItemData ], Value: [ 0xbd9a2adb42ebd8560e250e4df8162f67 ], 1 time
  1203. Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d} ],
  1204. Value Name: [ ItemSize ], Value: [ 229 ], 1 time
  1205. Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d} ],
  1206. Value Name: [ SaferFlags ], Value: [ 0 ], 1 time
  1207. Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc} ],
  1208. Value Name: [ HashAlg ], Value: [ 32771 ], 1 time
  1209. Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc} ],
  1210. Value Name: [ ItemData ], Value: [ 0x386b085f84ecf669d36b956a22c01e80 ], 1 time
  1211. Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc} ],
  1212. Value Name: [ ItemSize ], Value: [ 370 ], 1 time
  1213. Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc} ],
  1214. Value Name: [ SaferFlags ], Value: [ 0 ], 1 time
  1215. Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33} ],
  1216. Value Name: [ ItemData ], Value: [ %HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache%OLK* ], 1 time
  1217. Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33} ],
  1218. Value Name: [ SaferFlags ], Value: [ 0 ], 1 time
  1219. Key: [ HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName ],
  1220. Value Name: [ ComputerName ], Value: [ PC ], 4 times
  1221. Key: [ HKLM\System\CurrentControlSet\Control\ProductOptions ],
  1222. Value Name: [ ProductType ], Value: [ WinNT ], 1 time
  1223. Key: [ HKLM\System\CurrentControlSet\Control\Session Manager\Environment ],
  1224. Value Name: [ ComSpec ], Value: [ %SystemRoot%\system32\cmd.exe ], 6 times
  1225. Key: [ HKLM\System\CurrentControlSet\Control\Session Manager\Environment ],
  1226. Value Name: [ FP_NO_HOST_CHECK ], Value: [ NO ], 6 times
  1227. Key: [ HKLM\System\CurrentControlSet\Control\Session Manager\Environment ],
  1228. Value Name: [ NUMBER_OF_PROCESSORS ], Value: [ 1 ], 6 times
  1229. Key: [ HKLM\System\CurrentControlSet\Control\Session Manager\Environment ],
  1230. Value Name: [ OS ], Value: [ Windows_NT ], 6 times
  1231. Key: [ HKLM\System\CurrentControlSet\Control\Session Manager\Environment ],
  1232. Value Name: [ PATHEXT ], Value: [ .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH ], 6 times
  1233. Key: [ HKLM\System\CurrentControlSet\Control\Session Manager\Environment ],
  1234. Value Name: [ PROCESSOR_ARCHITECTURE ], Value: [ x86 ], 6 times
  1235. Key: [ HKLM\System\CurrentControlSet\Control\Session Manager\Environment ],
  1236. Value Name: [ PROCESSOR_IDENTIFIER ], Value: [ x86 Family 6 Model 3 Stepping 3, GenuineIntel ], 6 times
  1237. Key: [ HKLM\System\CurrentControlSet\Control\Session Manager\Environment ],
  1238. Value Name: [ PROCESSOR_LEVEL ], Value: [ 6 ], 6 times
  1239. Key: [ HKLM\System\CurrentControlSet\Control\Session Manager\Environment ],
  1240. Value Name: [ PROCESSOR_REVISION ], Value: [ 0303 ], 6 times
  1241. Key: [ HKLM\System\CurrentControlSet\Control\Session Manager\Environment ],
  1242. Value Name: [ Path ], Value: [ %SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem ], 6 times
  1243. Key: [ HKLM\System\CurrentControlSet\Control\Session Manager\Environment ],
  1244. Value Name: [ TEMP ], Value: [ %SystemRoot%\TEMP ], 6 times
  1245. Key: [ HKLM\System\CurrentControlSet\Control\Session Manager\Environment ],
  1246. Value Name: [ TMP ], Value: [ %SystemRoot%\TEMP ], 6 times
  1247. Key: [ HKLM\System\CurrentControlSet\Control\Session Manager\Environment ],
  1248. Value Name: [ windir ], Value: [ %SystemRoot% ], 6 times
  1249. Key: [ HKLM\System\CurrentControlSet\Control\Terminal Server ],
  1250. Value Name: [ TSAppCompat ], Value: [ 0 ], 3 times
  1251. Key: [ HKLM\System\CurrentControlSet\Control\Terminal Server ],
  1252. Value Name: [ TSUserEnabled ], Value: [ 0 ], 1 time
  1253. Key: [ HKLM\System\CurrentControlSet\Services\LDAP ],
  1254. Value Name: [ LdapClientIntegrity ], Value: [ 1 ], 1 time
  1255. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Environment ],
  1256. Value Name: [ TEMP ], Value: [ %USERPROFILE%\Local Settings\Temp ], 6 times
  1257. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Environment ],
  1258. Value Name: [ TMP ], Value: [ %USERPROFILE%\Local Settings\Temp ], 6 times
  1259. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Keyboard Layout\Toggle ],
  1260. Value Name: [ Language Hotkey ], Value: [ 1 ], 2 times
  1261. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Keyboard Layout\Toggle ],
  1262. Value Name: [ Layout Hotkey ], Value: [ 2 ], 2 times
  1263. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Internet Explorer\Security ],
  1264. Value Name: [ Safety Warning Level ], Value: [ Query ], 2 times
  1265. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\SystemCertificates\Root\ProtectedRoots ],
  1266. Value Name: [ Certificates ], Value: [ 0x180000000100000050a5c0c5adc5c8010000000018000000 ], 4 times
  1267. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\SystemCertificates\ca\\Certificates\F77A3F82B7C4B3A9D869A93E3335CF1F78BC441E ],
  1268. Value Name: [ Blob ], Value: [ 0x030000000100000014000000f77a3f82b7c4b3a9d869a93e3335cf1f78bc ], 2 times
  1269. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows NT\CurrentVersion\Winlogon ],
  1270. Value Name: [ ParseAutoexec ], Value: [ 1 ], 3 times
  1271. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders ],
  1272. Value Name: [ Cache ], Value: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files ], 1 time
  1273. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders ],
  1274. Value Name: [ AppData ], Value: [ %USERPROFILE%\Application Data ], 4 times
  1275. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders ],
  1276. Value Name: [ Cache ], Value: [ %USERPROFILE%\Local Settings\Temporary Internet Files ], 1 time
  1277. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders ],
  1278. Value Name: [ Local Settings ], Value: [ %USERPROFILE%\Local Settings ], 1 time
  1279. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders ],
  1280. Value Name: [ Personal ], Value: [ %USERPROFILE%\My Documents ], 1 time
  1281. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing ],
  1282. Value Name: [ State ], Value: [ 146432 ], 2 times
  1283. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Volatile Environment ],
  1284. Value Name: [ APPDATA ], Value: [ C:\Documents and Settings\Administrator\Application Data ], 6 times
  1285. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Volatile Environment ],
  1286. Value Name: [ CLIENTNAME ], Value: [ Console ], 6 times
  1287. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Volatile Environment ],
  1288. Value Name: [ HOMEDRIVE ], Value: [ C: ], 6 times
  1289. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Volatile Environment ],
  1290. Value Name: [ HOMEPATH ], Value: [ \Documents and Settings\Administrator ], 6 times
  1291. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Volatile Environment ],
  1292. Value Name: [ HOMESHARE ], Value: [ ], 6 times
  1293. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Volatile Environment ],
  1294. Value Name: [ LOGONSERVER ], Value: [ \\PC ], 6 times
  1295. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Volatile Environment ],
  1296. Value Name: [ SESSIONNAME ], Value: [ Console ], 6 times
  1297.  
  1298. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1299. Monitored Registry Keys:
  1300. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1301. Key: [ HKLM\Software\Microsoft\EnterpriseCertificates\Disallowed\ ],
  1302. Watch subtree: [ 1 ], Notify Filter: [ Key Change,Value Change ], 2 times
  1303. Key: [ HKLM\Software\Microsoft\EnterpriseCertificates\ca\ ],
  1304. Watch subtree: [ 1 ], Notify Filter: [ Key Change,Value Change ], 1 time
  1305. Key: [ HKLM\Software\Microsoft\EnterpriseCertificates\disallowed\ ],
  1306. Watch subtree: [ 1 ], Notify Filter: [ Key Change,Value Change ], 1 time
  1307. Key: [ HKLM\Software\Microsoft\EnterpriseCertificates\root\ ],
  1308. Watch subtree: [ 1 ], Notify Filter: [ Key Change,Value Change ], 1 time
  1309. Key: [ HKLM\Software\Microsoft\EnterpriseCertificates\trust\ ],
  1310. Watch subtree: [ 1 ], Notify Filter: [ Key Change,Value Change ], 1 time
  1311. Key: [ HKLM\Software\Microsoft\SystemCertificates\AuthRoot\ ],
  1312. Watch subtree: [ 1 ], Notify Filter: [ Key Change,Value Change ], 1 time
  1313. Key: [ HKLM\Software\Microsoft\SystemCertificates\Disallowed\ ],
  1314. Watch subtree: [ 1 ], Notify Filter: [ Key Change,Value Change ], 2 times
  1315. Key: [ HKLM\Software\Microsoft\SystemCertificates\ca\ ],
  1316. Watch subtree: [ 1 ], Notify Filter: [ Key Change,Value Change ], 1 time
  1317. Key: [ HKLM\Software\Microsoft\SystemCertificates\disallowed\ ],
  1318. Watch subtree: [ 1 ], Notify Filter: [ Key Change,Value Change ], 1 time
  1319. Key: [ HKLM\Software\Microsoft\SystemCertificates\root\ ],
  1320. Watch subtree: [ 1 ], Notify Filter: [ Key Change,Value Change ], 1 time
  1321. Key: [ HKLM\Software\Microsoft\SystemCertificates\trust\ ],
  1322. Watch subtree: [ 1 ], Notify Filter: [ Key Change,Value Change ], 1 time
  1323. Key: [ HKLM\Software\Policies\Microsoft\SystemCertificates ],
  1324. Watch subtree: [ 1 ], Notify Filter: [ Key Change,Value Change ], 1 time
  1325. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\SystemCertificates\Disallowed\ ],
  1326. Watch subtree: [ 1 ], Notify Filter: [ Key Change,Value Change ], 2 times
  1327. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\SystemCertificates\ca\ ],
  1328. Watch subtree: [ 1 ], Notify Filter: [ Key Change,Value Change ], 1 time
  1329. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\SystemCertificates\disallowed\ ],
  1330. Watch subtree: [ 1 ], Notify Filter: [ Key Change,Value Change ], 1 time
  1331. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\SystemCertificates\root\ ],
  1332. Watch subtree: [ 1 ], Notify Filter: [ Key Change,Value Change ], 1 time
  1333. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\SystemCertificates\trust\ ],
  1334. Watch subtree: [ 1 ], Notify Filter: [ Key Change,Value Change ], 1 time
  1335. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\\Software\Policies\Microsoft\SystemCertificates ],
  1336. Watch subtree: [ 1 ], Notify Filter: [ Key Change,Value Change ], 5 times
  1337.  
  1338.  
  1339. [=============================================================================]
  1340. 2.b) m8update.e.exe - File Activities
  1341. [=============================================================================]
  1342. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1343. Files Read:
  1344. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1345. File Name: [ C:\Documents and Settings\Administrator\Application Data\Microsoft\CryptnetUrlCache\Content\62B5AF9BE9ADC1085C3C56EC07A82BF6 ]
  1346. File Name: [ C:\Documents and Settings\Administrator\Application Data\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F ]
  1347. File Name: [ C:\Documents and Settings\Administrator\Application Data\Microsoft\CryptnetUrlCache\MetaData\62B5AF9BE9ADC1085C3C56EC07A82BF6 ]
  1348. File Name: [ C:\Documents and Settings\Administrator\Application Data\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F ]
  1349. File Name: [ C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\config\machine.config ]
  1350. File Name: [ C:\WINDOWS\system32\rsaenh.dll ]
  1351. File Name: [ PIPE\lsarpc ]
  1352. File Name: [ c:\autoexec.bat ]
  1353.  
  1354. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1355. Files Modified:
  1356. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1357. File Name: [ PIPE\lsarpc ]
  1358.  
  1359. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1360. File System Control Communication:
  1361. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1362. File: [ C:\Program Files\Common Files\ ], Control Code: [ 0x00090028 ], 1 time
  1363. File: [ PIPE\lsarpc ], Control Code: [ 0x0011C017 ], 1 time
  1364.  
  1365. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1366. Device Control Communication:
  1367. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1368. File: [ \Device\KsecDD ], Control Code: [ 0x00390008 ], 8 times
  1369.  
  1370. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1371. Memory Mapped Files:
  1372. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1373. File Name: [ C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE ]
  1374. File Name: [ C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\culture.dll ]
  1375. File Name: [ C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll ]
  1376. File Name: [ C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll ]
  1377. File Name: [ C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll ]
  1378. File Name: [ C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll ]
  1379. File Name: [ C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll ]
  1380. File Name: [ C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\MSVCR80.dll ]
  1381. File Name: [ C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll ]
  1382. File Name: [ C:\WINDOWS\WindowsShell.Manifest ]
  1383. File Name: [ C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\642534209e13d16e93b80a628742d2ee\mscorlib.ni.dll ]
  1384. File Name: [ C:\WINDOWS\system32\Apphelp.dll ]
  1385. File Name: [ C:\WINDOWS\system32\MSCTF.dll ]
  1386. File Name: [ C:\WINDOWS\system32\PSAPI.DLL ]
  1387. File Name: [ C:\WINDOWS\system32\RichEd20.dll ]
  1388. File Name: [ C:\WINDOWS\system32\SensApi.dll ]
  1389. File Name: [ C:\WINDOWS\system32\WINHTTP.dll ]
  1390. File Name: [ C:\WINDOWS\system32\comctl32.dll ]
  1391. File Name: [ C:\WINDOWS\system32\cryptnet.dll ]
  1392. File Name: [ C:\WINDOWS\system32\imm32.dll ]
  1393. File Name: [ C:\WINDOWS\system32\l_intl.nls ]
  1394. File Name: [ C:\WINDOWS\system32\mscoree.dll ]
  1395. File Name: [ C:\WINDOWS\system32\rpcss.dll ]
  1396. File Name: [ C:\WINDOWS\system32\rsaenh.dll ]
  1397. File Name: [ C:\WINDOWS\system32\shell32.dll ]
  1398. File Name: [ C:\WINDOWS\system32\xpsp2res.dll ]
  1399. File Name: [ C:\Windows\AppPatch\sysmain.sdb ]
  1400. File Name: [ C:\m8update.e.exe ]
  1401.  
  1402. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1403. Directories Monitored:
  1404. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1405. Directory: [ C:\Documents and Settings\Administrator\Application Data\Microsoft\SystemCertificates\My ], Watch subtree: [ 1 ], Notify FilterFile Name Change,Directory Name Change,Name Change,Size Change,Last Write Change ], 1 time
  1406.  
  1407. [=============================================================================]
  1408. 2.c) m8update.e.exe - Process Activities
  1409. [=============================================================================]
  1410. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1411. Processes Created:
  1412. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1413. Executable: [ C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE ], Command Line: [ ]
  1414. Executable: [ C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE ], Command Line: [ dw20.exe -x -s 716 ]
  1415.  
  1416. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1417. Remote Threads Created:
  1418. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1419. Affected Process: [ C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE ]
  1420.  
  1421. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1422. Foreign Memory Regions Read:
  1423. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1424. Process: [ C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE ]
  1425.  
  1426. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1427. Foreign Memory Regions Written:
  1428. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1429. Process: [ C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE ]
  1430.  
  1431.  
  1432. [=============================================================================]
  1433. 2.d) m8update.e.exe - Other Activities
  1434. [=============================================================================]
  1435. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1436. Mutexes Created:
  1437. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1438. Mutex: [ CTF.Asm.MutexDefaultS-1-5-21-842925246-1425521274-308236825-500 ]
  1439. Mutex: [ CTF.Compart.MutexDefaultS-1-5-21-842925246-1425521274-308236825-500 ]
  1440. Mutex: [ CTF.LBES.MutexDefaultS-1-5-21-842925246-1425521274-308236825-500 ]
  1441. Mutex: [ CTF.Layouts.MutexDefaultS-1-5-21-842925246-1425521274-308236825-500 ]
  1442. Mutex: [ CTF.TMD.MutexDefaultS-1-5-21-842925246-1425521274-308236825-500 ]
  1443. Mutex: [ CTF.TimListCache.FMPDefaultS-1-5-21-842925246-1425521274-308236825-500MUTEX.DefaultS-1-5-21-842925246-1425521274-308236825-500 ]
  1444.  
  1445. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1446. Windows SEH exceptions:
  1447. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1448. Description: [ Exception 0xe06d7363 at 0x7c812aeb ], 4 times
  1449.  
  1450. Description: [ Exception 0xe0434f4d at 0x7c812aeb ], 1 time
  1451.  
  1452.  
  1453.  
  1454.  
  1455. [#############################################################################]
  1456. 3. DW20.EXE
  1457. [#############################################################################]
  1458. [=============================================================================]
  1459. General information about this executable
  1460. [=============================================================================]
  1461. Analysis Reason: Started by m8update.e.exe
  1462. Filename: DW20.EXE
  1463. MD5: a981419c39cc02259b8f2da3974000d9
  1464. SHA-1: 905d359e2c5e8330d39b746132fa9779f52c0b93
  1465. File Size: 637272 Bytes
  1466. Command Line: dw20.exe -x -s 716
  1467. Process-status
  1468. at analysis end: alive
  1469. Exit Code: 0
  1470.  
  1471. [=============================================================================]
  1472. Load-time Dlls
  1473. [=============================================================================]
  1474. Module Name: [ C:\WINDOWS\system32\ntdll.dll ],
  1475. Base Address: [0x7C900000 ], Size: [0x000AF000 ]
  1476. Module Name: [ C:\WINDOWS\system32\kernel32.dll ],
  1477. Base Address: [0x7C800000 ], Size: [0x000F6000 ]
  1478. Module Name: [ C:\WINDOWS\system32\ADVAPI32.dll ],
  1479. Base Address: [0x77DD0000 ], Size: [0x0009B000 ]
  1480. Module Name: [ C:\WINDOWS\system32\RPCRT4.dll ],
  1481. Base Address: [0x77E70000 ], Size: [0x00092000 ]
  1482. Module Name: [ C:\WINDOWS\system32\Secur32.dll ],
  1483. Base Address: [0x77FE0000 ], Size: [0x00011000 ]
  1484. Module Name: [ C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\COMCTL32.dll ],
  1485. Base Address: [0x773D0000 ], Size: [0x00103000 ]
  1486. Module Name: [ C:\WINDOWS\system32\msvcrt.dll ],
  1487. Base Address: [0x77C10000 ], Size: [0x00058000 ]
  1488. Module Name: [ C:\WINDOWS\system32\GDI32.dll ],
  1489. Base Address: [0x77F10000 ], Size: [0x00049000 ]
  1490. Module Name: [ C:\WINDOWS\system32\USER32.dll ],
  1491. Base Address: [0x7E410000 ], Size: [0x00091000 ]
  1492. Module Name: [ C:\WINDOWS\system32\SHLWAPI.dll ],
  1493. Base Address: [0x77F60000 ], Size: [0x00076000 ]
  1494. Module Name: [ C:\WINDOWS\system32\OLEACC.dll ],
  1495. Base Address: [0x74C80000 ], Size: [0x0002C000 ]
  1496. Module Name: [ C:\WINDOWS\system32\MSVCP60.dll ],
  1497. Base Address: [0x76080000 ], Size: [0x00065000 ]
  1498. Module Name: [ C:\WINDOWS\system32\ole32.dll ],
  1499. Base Address: [0x774E0000 ], Size: [0x0013D000 ]
  1500. Module Name: [ C:\WINDOWS\system32\OLEAUT32.dll ],
  1501. Base Address: [0x77120000 ], Size: [0x0008B000 ]
  1502. Module Name: [ C:\WINDOWS\system32\SHELL32.dll ],
  1503. Base Address: [0x7C9C0000 ], Size: [0x00817000 ]
  1504. Module Name: [ C:\WINDOWS\system32\urlmon.dll ],
  1505. Base Address: [0x7E1E0000 ], Size: [0x000A2000 ]
  1506. Module Name: [ C:\WINDOWS\system32\VERSION.dll ],
  1507. Base Address: [0x77C00000 ], Size: [0x00008000 ]
  1508. Module Name: [ C:\WINDOWS\system32\WININET.dll ],
  1509. Base Address: [0x771B0000 ], Size: [0x000AA000 ]
  1510. Module Name: [ C:\WINDOWS\system32\CRYPT32.dll ],
  1511. Base Address: [0x77A80000 ], Size: [0x00095000 ]
  1512. Module Name: [ C:\WINDOWS\system32\MSASN1.dll ],
  1513. Base Address: [0x77B20000 ], Size: [0x00012000 ]
  1514.  
  1515. [=============================================================================]
  1516. Run-time Dlls
  1517. [=============================================================================]
  1518. Module Name: [ C:\WINDOWS\system32\MSCTF.dll ],
  1519. Base Address: [0x74720000 ], Size: [0x0004C000 ]
  1520. Module Name: [ C:\WINDOWS\system32\riched20.dll ],
  1521. Base Address: [0x74E30000 ], Size: [0x0006D000 ]
  1522. Module Name: [ C:\WINDOWS\system32\imm32.dll ],
  1523. Base Address: [0x76390000 ], Size: [0x0001D000 ]
  1524. Module Name: [ C:\WINDOWS\system32\shfolder.dll ],
  1525. Base Address: [0x76780000 ], Size: [0x00009000 ]
  1526. Module Name: [ C:\WINDOWS\system32\psapi.dll ],
  1527. Base Address: [0x76BF0000 ], Size: [0x0000B000 ]
  1528.  
  1529. [=============================================================================]
  1530. 3.a) DW20.EXE - Registry Activities
  1531. [=============================================================================]
  1532. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1533. Registry Values Modified:
  1534. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1535. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders ],
  1536. Value Name: [ AppData ], New Value: [ C:\Documents and Settings\Administrator\Application Data ]
  1537. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders ],
  1538. Value Name: [ Personal ], New Value: [ C:\Documents and Settings\Administrator\My Documents ]
  1539.  
  1540. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1541. Registry Values Read:
  1542. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1543. Key: [ HKLM\SOFTWARE\Microsoft\CTF\SystemShared\ ],
  1544. Value Name: [ CUAS ], Value: [ 0 ], 1 time
  1545. Key: [ HKLM\SYSTEM\CurrentControlSet\Control\Session Manager ],
  1546. Value Name: [ CriticalSectionTimeout ], Value: [ 2592000 ], 1 time
  1547. Key: [ HKLM\SYSTEM\Setup ],
  1548. Value Name: [ SystemSetupInProgress ], Value: [ 0 ], 1 time
  1549. Key: [ HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BEHAVIORS ],
  1550. Value Name: [ * ], Value: [ 1 ], 1 time
  1551. Key: [ HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL ],
  1552. Value Name: [ * ], Value: [ 1 ], 1 time
  1553. Key: [ HKLM\Software\Microsoft\Windows NT\CurrentVersion\MiniDumpAuxiliaryDlls ],
  1554. Value Name: [ C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll ], Value: [ C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll ], 1 time
  1555. Key: [ HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows ],
  1556. Value Name: [ AppInit_DLLs ], Value: [ ], 1 time
  1557. Key: [ HKLM\Software\Microsoft\Windows\CurrentVersion ],
  1558. Value Name: [ CommonFilesDir ], Value: [ C:\Program Files\Common Files ], 1 time
  1559. Key: [ HKLM\Software\Microsoft\Windows\CurrentVersion ],
  1560. Value Name: [ ProgramFilesDir ], Value: [ C:\Program Files ], 1 time
  1561. Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers ],
  1562. Value Name: [ TransparentEnabled ], Value: [ 1 ], 1 time
  1563. Key: [ HKLM\System\CurrentControlSet\Control\Terminal Server ],
  1564. Value Name: [ TSAppCompat ], Value: [ 0 ], 3 times
  1565. Key: [ HKLM\System\CurrentControlSet\Control\Terminal Server ],
  1566. Value Name: [ TSUserEnabled ], Value: [ 0 ], 1 time
  1567. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Keyboard Layout\Toggle ],
  1568. Value Name: [ Language Hotkey ], Value: [ 1 ], 2 times
  1569. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Keyboard Layout\Toggle ],
  1570. Value Name: [ Layout Hotkey ], Value: [ 2 ], 2 times
  1571. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Internet Explorer\Settings ],
  1572. Value Name: [ Anchor Color ], Value: [ 0,0,255 ], 4 times
  1573. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders ],
  1574. Value Name: [ AppData ], Value: [ %USERPROFILE%\Application Data ], 1 time
  1575. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders ],
  1576. Value Name: [ Personal ], Value: [ %USERPROFILE%\My Documents ], 1 time
  1577.  
  1578.  
  1579. [=============================================================================]
  1580. 3.b) DW20.EXE - File Activities
  1581. [=============================================================================]
  1582. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1583. Files Created:
  1584. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1585. File Name: [ C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\73E3F.dmp ]
  1586. File Name: [ C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\dw.log ]
  1587.  
  1588. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1589. Files Read:
  1590. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1591. File Name: [ C:\m8update.e.exe ]
  1592.  
  1593. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1594. Files Modified:
  1595. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1596. File Name: [ C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\dw.log ]
  1597.  
  1598. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1599. Device Control Communication:
  1600. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1601. File: [ \Device\KsecDD ], Control Code: [ 0x00390008 ], 1 time
  1602.  
  1603. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1604. Memory Mapped Files:
  1605. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1606. File Name: [ C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll ]
  1607. File Name: [ C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll ]
  1608. File Name: [ C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll ]
  1609. File Name: [ C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\MSVCR80.dll ]
  1610. File Name: [ C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\COMCTL32.dll ]
  1611. File Name: [ C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll ]
  1612. File Name: [ C:\WINDOWS\WindowsShell.Manifest ]
  1613. File Name: [ C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\642534209e13d16e93b80a628742d2ee\mscorlib.ni.dll ]
  1614. File Name: [ C:\WINDOWS\system32\ADVAPI32.dll ]
  1615. File Name: [ C:\WINDOWS\system32\CRYPT32.dll ]
  1616. File Name: [ C:\WINDOWS\system32\GDI32.dll ]
  1617. File Name: [ C:\WINDOWS\system32\IMAGEHLP.dll ]
  1618. File Name: [ C:\WINDOWS\system32\KERNEL32.dll ]
  1619. File Name: [ C:\WINDOWS\system32\MSASN1.dll ]
  1620. File Name: [ C:\WINDOWS\system32\MSCTF.dll ]
  1621. File Name: [ C:\WINDOWS\system32\MSVCP60.dll ]
  1622. File Name: [ C:\WINDOWS\system32\OLEACC.dll ]
  1623. File Name: [ C:\WINDOWS\system32\OLEACCRC.DLL ]
  1624. File Name: [ C:\WINDOWS\system32\PSAPI.DLL ]
  1625. File Name: [ C:\WINDOWS\system32\RPCRT4.dll ]
  1626. File Name: [ C:\WINDOWS\system32\SHELL32.dll ]
  1627. File Name: [ C:\WINDOWS\system32\SHLWAPI.dll ]
  1628. File Name: [ C:\WINDOWS\system32\Secur32.dll ]
  1629. File Name: [ C:\WINDOWS\system32\SensApi.dll ]
  1630. File Name: [ C:\WINDOWS\system32\USER32.dll ]
  1631. File Name: [ C:\WINDOWS\system32\VERSION.dll ]
  1632. File Name: [ C:\WINDOWS\system32\WINHTTP.dll ]
  1633. File Name: [ C:\WINDOWS\system32\WININET.dll ]
  1634. File Name: [ C:\WINDOWS\system32\WINTRUST.dll ]
  1635. File Name: [ C:\WINDOWS\system32\WLDAP32.dll ]
  1636. File Name: [ C:\WINDOWS\system32\comctl32.dll ]
  1637. File Name: [ C:\WINDOWS\system32\cryptnet.dll ]
  1638. File Name: [ C:\WINDOWS\system32\imm32.dll ]
  1639. File Name: [ C:\WINDOWS\system32\mscoree.dll ]
  1640. File Name: [ C:\WINDOWS\system32\msvcrt.dll ]
  1641. File Name: [ C:\WINDOWS\system32\netapi32.dll ]
  1642. File Name: [ C:\WINDOWS\system32\ntdll.dll ]
  1643. File Name: [ C:\WINDOWS\system32\psapi.dll ]
  1644. File Name: [ C:\WINDOWS\system32\riched20.dll ]
  1645. File Name: [ C:\WINDOWS\system32\rsaenh.dll ]
  1646. File Name: [ C:\WINDOWS\system32\shell32.dll ]
  1647. File Name: [ C:\WINDOWS\system32\shfolder.dll ]
  1648. File Name: [ C:\WINDOWS\system32\urlmon.dll ]
  1649. File Name: [ C:\WINDOWS\system32\userenv.dll ]
  1650. File Name: [ C:\WINDOWS\system32\xpsp2res.dll ]
  1651. File Name: [ C:\m8update.e.exe ]
  1652.  
  1653. [=============================================================================]
  1654. 3.c) DW20.EXE - Process Activities
  1655. [=============================================================================]
  1656. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1657. Foreign Memory Regions Read:
  1658. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  1659. Process: [ C:\m8update.e.exe ]
  1660.  
  1661.  
  1662.  
  1663.  
  1664. [#############################################################################]
  1665. International Secure Systems Lab
  1666. http://www.iseclab.org
  1667.  
  1668. Vienna University of Technology Eurecom France UC Santa Barbara
  1669. http://www.tuwien.ac.at http://www.eurecom.fr http://www.cs.ucsb.edu
  1670.  
  1671. Contact: anubis@iseclab.org
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!