Trojan.Win32.Alureon_beea065e35

Trojan.MSIL.Crypt.aosu (Kaspersky), Trojan.Win32.Alureon.FD, mzpefinder_pcap_file.YR (Lavasoft MAS) Behaviour: Trojan The description has been automatically generated by Lavasoft Malware Analysis Sys...
Blog rating:5 out of5 with1 ratings

Trojan.Win32.Alureon_beea065e35

by malwarelabrobot on October 29th, 2015 in Malware Descriptions.

Trojan.MSIL.Crypt.aosu (Kaspersky), Trojan.Win32.Alureon.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)
Behaviour: Trojan


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: beea065e35be4f4820b67e23eaf55747
SHA1: 1addf021e9b6058a3be96634d9e399f337a94fc5
SHA256: be310f86d30497afd0982ee282cc8234d5d02a5d9c4ad55d4f8e905bf43a3061
SSDeep: 393216:F29p5iOrCVVxAJHMW5DY9iHtKWCL8Aec28tQRGYGaWb5gtQt:F2b5rroCaM08Aecbm1JQt
Size: 15431807 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2014-05-26 17:28:05
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

support.exe:1564
Setup.exe:1896
lodctr.exe:2772
lodctr.exe:364
lodctr.exe:2804
IDM1.tmp:1760
aspnet_regiis.exe:3232
idman621f.exe:1276
mscorsvw.exe:2860
mscorsvw.exe:2904
mscorsvw.exe:1204
mscorsvw.exe:336
mscorsvw.exe:3944
mscorsvw.exe:3800
mscorsvw.exe:3060
mscorsvw.exe:1908
mscorsvw.exe:1488
mscorsvw.exe:3292
mscorsvw.exe:4008
mscorsvw.exe:2568
mscorsvw.exe:1984
mscorsvw.exe:2540
mscorsvw.exe:2132
mscorsvw.exe:1616
mscorsvw.exe:2300
mscorsvw.exe:772
mscorsvw.exe:2384
mscorsvw.exe:572
mscorsvw.exe:2240
mscorsvw.exe:2816
mscorsvw.exe:3584
mscorsvw.exe:2720
mscorsvw.exe:3744
mscorsvw.exe:2468
mscorsvw.exe:3708
mscorsvw.exe:3356
mscorsvw.exe:1952
mscorsvw.exe:4040
mscorsvw.exe:2956
mscorsvw.exe:3640
mscorsvw.exe:1284
mscorsvw.exe:1044
mscorsvw.exe:3016
mscorsvw.exe:2672
mscorsvw.exe:352
mscorsvw.exe:3848
mscorsvw.exe:3532
%original file name%.exe:1724
MsiExec.exe:2192
MsiExec.exe:2492
MsiExec.exe:2732
ServiceModelReg.exe:2756
unlodctr.exe:2632
mofcomp.exe:3252
dotNetFx40_Full_setup.exe:652
TMP12.tmp.exe:2324
ngen.exe:3920
ngen.exe:3888

The Trojan injects its code into the following process(es):

KeywordService.exe:2340
mscorsvw.exe:3896
Autoupdate.exe:3448

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process support.exe:1564 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.vshost.exe.manifest (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.vshost.exe (22 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Services.msi (7386 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC (8 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support\prerequisites\.NET Framework 4.0\dotNetFx40_Full_setup.exe (8737 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.exe.config (1 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.vshost.exe (22 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.vshost.exe.config (625 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.vshost.exe.manifest (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\decoder.dll (1137 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Newtonsoft.Json.dll (319 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.exe.config (625 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\GoogleSearchDotnet.xml (140 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\GoogleSearchDotnet.pdb (194 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.exe (38 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\GoogleSearchDotnet.dll (90 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.pdb (73 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.pdb (30 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.exe (14 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\CSCommonLib.dll (110 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.vshost.exe.config (1 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.exe.config (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0 (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support\prerequisites\.NET Framework 4.0\dotNetFx40_Full_setup.exe (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.vshost.exe (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.exe.config (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.exe (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support\prerequisites\.NET Framework 4.0 (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\holder0.aiph (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.vshost.exe.config (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Newtonsoft.Json.dll (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.pdb (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\GoogleSearchDotnet.dll (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.pdb (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\GoogleSearchDotnet.xml (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\CSCommonLib.dll (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.vshost.exe.manifest (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support\prerequisites (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\GoogleSearchDotnet.pdb (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.exe (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.vshost.exe.config (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.vshost.exe (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Services.msi (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.vshost.exe.manifest (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\decoder.dll (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install (0 bytes)

The process Setup.exe:1896 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1037\SetupResources.dll (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate8.ico (894 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1038\SetupResources.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_20151028_194612849.html (1754040 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupUtility.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1040\eula.rtf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Setup_20151028_194612255.html (169496 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759AD (813 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1036\SetupResources.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Setup.ico (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1037\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1029\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1040\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1049\SetupResources.dll (18 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\A1377F7115F1F126A15360369B165211 (597 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\SysReqNotMet.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate1.ico (894 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1030\SetupResources.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1033\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2052\eula.rtf (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1029\eula.rtf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SplashScreen.bmp (41 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\F90F18257CBB4D84216AC1E1F3BB2C76 (550 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3076\eula.rtf (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1038\eula.rtf (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1044\SetupResources.dll (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\stop.ico (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1037\eula.rtf (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate5.ico (894 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_20151028_194612849-MSI_netfx_Extended_x86.msi.txt (1088936 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate3.ico (894 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\3130B1871A126520A8C47861EFE3ED4D (240 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1043\eula.rtf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1028\LocalizedData.xml (60 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\A1377F7115F1F126A15360369B165211 (260 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate6.ico (894 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Extended\UiInfo.xml (39 bytes)
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Setup_2015102 (1284 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate2.ico (894 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1046\eula.rtf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1031\eula.rtf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1049\eula.rtf (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1032\eula.rtf (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1031\SetupResources.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\ParameterInfo.xml (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1040\SetupResources.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupUi.xsd (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Save.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1031\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1041\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\DisplayIcon.ico (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\UiInfo.xml (38 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Print.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2070\eula.rtf (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1042\SetupResources.dll (15 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\3130B1871A126520A8C47861EFE3ED4D (521 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1045\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1036\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1041\SetupResources.dll (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1041\eula.rtf (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Client\Parameterinfo.xml (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1030\eula.rtf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1028\eula.rtf (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupUi.dll (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1035\SetupResources.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1046\SetupResources.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3082\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1042\LocalizedData.xml (65 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1032\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3082\eula.rtf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1029\SetupResources.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1045\SetupResources.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1046\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\F90F18257CBB4D84216AC1E1F3BB2C76 (304 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1030\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1025\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1042\eula.rtf (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1033\SetupResources.dll (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1053\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2052\SetupResources.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\warn.ico (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1038\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFI2.tmp.html (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1053\eula.rtf (3 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\696F3DE637E6DE85B458996D49D759AD (288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate4.ico (894 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1044\eula.rtf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\header.bmp (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1035\eula.rtf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3076\LocalizedData.xml (60 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1032\SetupResources.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1043\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Strings.xml (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1025\SetupResources.dll (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupEngine.dll (5873 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1044\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\watermark.bmp (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1035\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\sqmapi.dll (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFI5.tmp.html (54394 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\SysReqMet.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Client\UiInfo.xml (39 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1049\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1055\SetupResources.dll (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1045\eula.rtf (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1055\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2070\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1036\eula.rtf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Setup.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1028\SetupResources.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1033\eula.rtf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1055\eula.rtf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Extended\Parameterinfo.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3082\SetupResources.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2052\LocalizedData.xml (60 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1043\SetupResources.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate7.ico (894 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1025\eula.rtf (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\DHtmlHeader.html (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3076\SetupResources.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2070\SetupResources.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1053\SetupResources.dll (17 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\TMP12.tmp.exe.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFI2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFI5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\TMP12.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFI1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFI10.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFI19.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\TMP12.tmp.exe.tmp\netfx_ExtendedCab.msi (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFI4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFI13.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFI3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFI16.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\TMP12.tmp.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFIA.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFI5.tmp.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFID.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFI7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFI1C.tmp (0 bytes)

The process KeywordService.exe:2340 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\config (200 bytes)
%System%\config\system (5239 bytes)
%Program Files%\Adobe\Support\list.dll (97 bytes)
%System%\config\SYSTEM.LOG (8433 bytes)

The process lodctr.exe:2772 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\perfc009.dat (76 bytes)
%System%\PerfStringBackup.INI (3361 bytes)
%System%\PerfStringBackup.TMP (1480360 bytes)
%System%\perfh009.dat (1756 bytes)

The Trojan deletes the following file(s):

%System%\PerfStringBackup.TMP (0 bytes)

The process lodctr.exe:2804 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\perfc009.dat (77 bytes)
%System%\PerfStringBackup.INI (3361 bytes)
%System%\PerfStringBackup.TMP (1485028 bytes)
%System%\perfh009.dat (1758 bytes)

The Trojan deletes the following file(s):

%System%\PerfStringBackup.TMP (0 bytes)

The process aspnet_regiis.exe:3232 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RGI58.tmp (9639 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI55.tmp-tmp (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI59.tmp (9639 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI58.tmp-tmp (9 bytes)
%System%\PerfStringBackup.INI (10083 bytes)
%System%\perfc009.dat (323 bytes)
%System%\perfh009.dat (7070 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ASPNETSetup_00000.log (91534 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI57.tmp-tmp (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI54.tmp (9639 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI55.tmp (9639 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI53.tmp-tmp (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI59.tmp-tmp (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI57.tmp (9639 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI54.tmp-tmp (9 bytes)
%System%\PerfStringBackup.TMP (4595016 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI53.tmp (9639 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RGI58.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI55.tmp-tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI59.tmp-tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI58.tmp-tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI59.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI57.tmp-tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI54.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI55.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI53.tmp-tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI57.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI54.tmp-tmp (0 bytes)
%System%\PerfStringBackup.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI53.tmp (0 bytes)

The process mscorsvw.exe:4008 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\assembly\NativeImages_v4.0.30319_32\Temp\fa8-0\System.Design.dll (821943 bytes)

The Trojan deletes the following file(s):

%WinDir%\assembly\NativeImages_v4.0.30319_32\Temp\fa8-0 (0 bytes)
%WinDir%\assembly\NativeImages_v4.0.30319_32\index55.dat (0 bytes)

The process mscorsvw.exe:1984 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\assembly\NativeImages_v4.0.30319_32\Temp\7c0-0\System.Drawing.Design.dll (28176 bytes)

The Trojan deletes the following file(s):

%WinDir%\assembly\NativeImages_v4.0.30319_32\index56.dat (0 bytes)
%WinDir%\assembly\NativeImages_v4.0.30319_32\Temp\7c0-0 (0 bytes)

The process mscorsvw.exe:3896 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Microsoft.NET\Framework\v4.0.30319\ngen_service.log (514 bytes)

The process %original file name%.exe:1724 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\support.exe (32766 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\idman621f.exe (21530 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\__tmp_rar_sfx_access_check_277375 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\support.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\idman621f.exe (0 bytes)

The process MsiExec.exe:2192 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\diskcost.html (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\rmfiles.html (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\cancel.png (395 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\jquery-1.3.2.js (61857 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\box-repair.png (457 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\resume.html (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\back.png (328 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\outofrbdisk.html (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\retry.png (415 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\welcome.html (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\progress.html (337 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\check.png (333 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\pngfix\DD_belatedPNG_0.0.8a.js (1969 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\customize.html (337 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\box-add-remove.png (457 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\common.js (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\folder.html (337 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\client.png (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\verifyrepair.html (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\exit.html (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\style.css (337 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\setuptype.html (337 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\client_server.png (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\outofdisk.html (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\progress\progressbar.js (302 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\fatalerror.html (337 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\box.png (337 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\verifyready.html (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\box-custom.png (457 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\prepare.html (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\print.png (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\server.png (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\box-remove.png (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\button-large-bg.png (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\userexit.html (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\fileinuse.html (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\varstyle.css (232 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\maintwelcome.html (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\progress\progressbar.css (407 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7 (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\next.png (333 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\verifyremove.html (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\maintype.html (457 bytes)

The Trojan deletes the following file(s):

C:\DOCUMENTS AND SETTINGS (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\diskcost.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\cancel.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\rmfiles.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\outofdisk.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\common.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\box-repair.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\resume.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\outofrbdisk.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\retry.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\welcome.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\progress.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\check.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\pngfix\DD_belatedPNG_0.0.8a.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\verifyready.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\customize.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\box-add-remove.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\verifyrepair.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\folder.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\client.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\exit.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\style.css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\setuptype.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\client_server.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\box-custom.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\jquery-1.3.2.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\progress\progressbar.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\fatalerror.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\box.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\pngfix (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\progress (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\prepare.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\print.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\server.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\box-remove.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\button-large-bg.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\userexit.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\back.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\fileinuse.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\varstyle.css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\maintwelcome.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\progress\progressbar.css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\next.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\verifyremove.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\maintype.html (0 bytes)
%Documents and Settings%\%current user%\LOCAL SETTINGS (0 bytes)

The process MsiExec.exe:2492 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\assembly\tmp\751VHO3H\System.ServiceModel.Activation.dll (6360 bytes)
%WinDir%\assembly\tmp\5E7SDNDD\System.Web.DataVisualization.dll (48928 bytes)
%WinDir%\assembly\tmp\8SHHTI8S\Microsoft.Workflow.Compiler.manifest (491 bytes)
%WinDir%\assembly\tmp\G78P5KRU\Microsoft.VisualC.STLCLR.dll (1552 bytes)
%WinDir%\assembly\tmp\I7AW9OUF\System.Web.Abstractions.dll (784 bytes)
%WinDir%\assembly\tmp\QI3T4ABF\System.Data.Services.dll (23296 bytes)
%WinDir%\assembly\tmp\19BC9HZ9\System.Web.Entity.Design.dll (5064 bytes)
%WinDir%\assembly\tmp\EC0KHXJI\System.Web.Extensions.dll (56684 bytes)
%WinDir%\assembly\tmp\N2NGQG0N\System.Xaml.Hosting.dll (784 bytes)
%WinDir%\assembly\tmp\YCTE7B33\PresentationBuildTasks.dll (19592 bytes)
%WinDir%\assembly\tmp\IZN06KEA\System.Web.dll (165798 bytes)
%WinDir%\assembly\tmp\2HOW8PT9\System.Web.DynamicData.dll (8560 bytes)
%WinDir%\assembly\tmp\5QX1UWUX\System.ServiceModel.ServiceMoniker40.dll (12 bytes)
%WinDir%\assembly\tmp\PTS7XXL1\Microsoft.Build.Conversion.v4.0.dll (2392 bytes)
%WinDir%\assembly\tmp\TZSDFI1C\System.Data.Services.Design.dll (6360 bytes)
%WinDir%\assembly\tmp\QWR2CQVO\Microsoft.Build.Tasks.v4.0.dll (33391 bytes)
%WinDir%\assembly\tmp\TVKYS1EU\System.Web.Entity.dll (5064 bytes)
%WinDir%\assembly\tmp\MHBOWRSB\System.WorkflowServices.dll (15168 bytes)
%WinDir%\assembly\tmp\RKNSA6MO\System.Workflow.ComponentModel.dll (44462 bytes)
%WinDir%\assembly\tmp\M3WMBDX6\AspNetMMCExt.dll (16944 bytes)
%WinDir%\assembly\tmp\DARCI67A\Microsoft.Build.dll (37025 bytes)
%WinDir%\assembly\tmp\9XRLSSVY\System.Web.RegularExpressions.dll (2392 bytes)
%WinDir%\assembly\tmp\2M9610E6\Microsoft.Build.Engine.dll (23936 bytes)
%WinDir%\assembly\tmp\41LYR0G2\System.Web.Mobile.dll (27704 bytes)
%WinDir%\assembly\tmp\2L7ZOCXU\System.Web.Extensions.Design.dll (11344 bytes)
%WinDir%\assembly\tmp\PU3CE29F\System.Web.Routing.dll (784 bytes)
%WinDir%\assembly\tmp\VQR78MV4\System.Windows.Forms.DataVisualization.Design.dll (2392 bytes)
%WinDir%\assembly\tmp\87SD3538\Microsoft.Build.Utilities.v4.0.dll (8184 bytes)
%WinDir%\assembly\tmp\RVQHRR45\System.Drawing.Design.dll (3312 bytes)
%WinDir%\assembly\tmp\R8P3CY5W\System.ServiceModel.WasHosting.dll (784 bytes)
%WinDir%\assembly\tmp\3NPDCTUI\System.Data.OracleClient.dll (16944 bytes)
%WinDir%\assembly\tmp\MD8A1L6R\XamlBuildTask.dll (3312 bytes)
%WinDir%\assembly\tmp\5B8HO84G\Microsoft.Build.Framework.dll (3616 bytes)
%WinDir%\assembly\tmp\0MP4V5FE\System.Web.DataVisualization.Design.dll (3312 bytes)
%WinDir%\assembly\tmp\8DKF866A\System.Design.dll (165081 bytes)
%WinDir%\assembly\tmp\XRR185J6\System.ServiceModel.Web.dll (11344 bytes)
%WinDir%\assembly\tmp\8SHHTI8S\Microsoft.Workflow.Compiler.exe (784 bytes)
%WinDir%\assembly\tmp\NLG7DXKH\System.Data.Entity.Design.dll (27504 bytes)
%WinDir%\assembly\tmp\O334KH0J\System.Workflow.Runtime.dll (17848 bytes)
%WinDir%\assembly\tmp\9LDLZFYY\System.Runtime.Caching.dll (3312 bytes)
%WinDir%\assembly\tmp\G5DZJJ2D\System.Web.DynamicData.Design.dll (1552 bytes)
%WinDir%\assembly\tmp\GSJR9SJ4\System.Workflow.Activities.dll (33455 bytes)

The process ServiceModelReg.exe:2756 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\dd_wcf_CA_smci_20151028_174648_520.txt (21652 bytes)

The process mofcomp.exe:3252 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\wbem\Logs\mofcomp.log (1883 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmp56.tmp (13484 bytes)
%System%\wbem\AutoRecover\807DD20ADF6F5D5EEA0C4E4CF016E69E.mof (216 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\tmp56.tmp (0 bytes)

The process dotNetFx40_Full_setup.exe:652 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\b677a0af2311ba9e2f8238db391cdc\1042\eula.rtf (12 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1049\SetupResources.dll (18 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\2070\LocalizedData.xml (1425 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\SetupUtility.exe (886 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\SysReqMet.ico (1 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1025\LocalizedData.xml (555 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\2070\eula.rtf (4 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1038\LocalizedData.xml (493 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1045\LocalizedData.xml (638 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\UiInfo.xml (376 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\2070\SetupResources.dll (18 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1053\LocalizedData.xml (579 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1036\eula.rtf (3 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate8.ico (894 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1037\eula.rtf (860 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1029\SetupResources.dll (18 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1040\eula.rtf (3 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\sqmapi.dll (531 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1055\eula.rtf (3 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1040\SetupResources.dll (18 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Extended\UiInfo.xml (959 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\ParameterInfo.xml (2631 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1030\LocalizedData.xml (427 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1025\eula.rtf (7 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1028\SetupResources.dll (14 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1041\eula.rtf (10 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1055\SetupResources.dll (17 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1044\LocalizedData.xml (203 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1028\LocalizedData.xml (423 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\watermark.bmp (1212 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Print.ico (1 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate6.ico (894 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1053\SetupResources.dll (619 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\SetupUi.dll (1564 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1032\SetupResources.dll (711 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\warn.ico (10 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\SetupUi.xsd (30 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\SplashScreen.bmp (41 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1042\SetupResources.dll (15 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Setup.ico (394 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate4.ico (894 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1044\SetupResources.dll (17 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1028\eula.rtf (6 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1043\SetupResources.dll (19 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1046\SetupResources.dll (117 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1033\eula.rtf (3 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\3076\eula.rtf (6 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate2.ico (894 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate3.ico (894 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\3082\LocalizedData.xml (423 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Setup.exe (1356 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1029\LocalizedData.xml (380 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\2052\SetupResources.dll (14 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1046\LocalizedData.xml (817 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1038\SetupResources.dll (18 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1043\eula.rtf (3 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1033\SetupResources.dll (17 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1036\LocalizedData.xml (104 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Client\UiInfo.xml (39 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1031\eula.rtf (3 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1032\eula.rtf (8 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1053\eula.rtf (3 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1037\LocalizedData.xml (556 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1032\LocalizedData.xml (849 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\stop.ico (10 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate5.ico (894 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\header.bmp (3 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\3082\SetupResources.dll (564 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1033\LocalizedData.xml (658 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1030\SetupResources.dll (18 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Client\Parameterinfo.xml (1937 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Strings.xml (14 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\SysReqNotMet.ico (1 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1029\eula.rtf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dd_dotNetFx40_Full_setup_decompression_log.txt (5605 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\3076\SetupResources.dll (14 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1037\SetupResources.dll (16 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\2052\eula.rtf (5 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\DisplayIcon.ico (875 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\3082\eula.rtf (3 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1040\LocalizedData.xml (1164 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate7.ico (894 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1045\eula.rtf (4 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1035\eula.rtf (3 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1046\eula.rtf (3 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1035\SetupResources.dll (981 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1049\LocalizedData.xml (600 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1025\SetupResources.dll (459 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics (4 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1031\LocalizedData.xml (930 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1041\LocalizedData.xml (249 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Save.ico (1 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1049\eula.rtf (229 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1055\LocalizedData.xml (872 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate1.ico (894 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1035\LocalizedData.xml (924 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Extended\Parameterinfo.xml (711 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1043\LocalizedData.xml (429 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1044\eula.rtf (3 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1038\eula.rtf (4 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1030\eula.rtf (3 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1042\LocalizedData.xml (950 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\2052\LocalizedData.xml (566 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1031\SetupResources.dll (18 bytes)
C:\b677a0af2311ba9e2f8238db391cdc (8 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1045\SetupResources.dll (18 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1036\SetupResources.dll (18 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\3076\LocalizedData.xml (148 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\DHtmlHeader.html (322 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1041\SetupResources.dll (252 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\SetupEngine.dll (5705 bytes)

The Trojan deletes the following file(s):

C:\b677a0af2311ba9e2f8238db391cdc\1042\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1049\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\2070\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\SetupUtility.exe (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\2052 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\SysReqMet.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1025\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\2070\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1038\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1045\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\UiInfo.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\2070\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1053\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1036\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate8.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1037\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1029\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1040\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1028 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1043\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\sqmapi.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Client (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1055\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1040\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1025 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Extended\UiInfo.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\3082 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\ParameterInfo.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1030\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1025\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1028\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1041\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1055\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1044\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1028\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1036 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1035 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1033 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1032 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1031 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1030 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Print.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1038 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate6.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Extended (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1053\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\SetupUi.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1032\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\warn.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\SetupUi.xsd (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\SplashScreen.bmp (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1042\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Setup.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate4.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1044\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1028\eula.rtf (0 bytes)
C:\ece90306-3a19-405a-81b4-b4a46592a18a (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1046\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1042 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1043 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1040 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1041 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1046 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1044 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1045 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1049 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1033\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\3076\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate2.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate3.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\3082\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Setup.exe (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1029\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\2052\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1046\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1038\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1043\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1033\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1036\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Client\UiInfo.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1037 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1031\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1055 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1032\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1053\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1037\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1032\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\stop.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate5.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1053 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\header.bmp (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\3082\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1033\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\3082\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Client\Parameterinfo.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Strings.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\SysReqNotMet.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1029\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\2070 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\watermark.bmp (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\3076\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1037\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\2052\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\DisplayIcon.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1030\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1040\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate7.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1045\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1035\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1046\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1035\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1049\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1025\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1031\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1041\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Save.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1049\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1055\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate1.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1035\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Extended\Parameterinfo.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1043\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1044\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1038\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1030\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1042\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\2052\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1029 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1031\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1045\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\3076 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1036\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\3076\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\DHtmlHeader.html (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1041\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\SetupEngine.dll (0 bytes)

The process TMP12.tmp.exe:2324 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\TMP12.tmp.exe.tmp\netfx_Extended.mzz (263065 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dd_TMP12.tmp_decompression_log.txt (1272 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\TMP12.tmp.exe.tmp\netfx_ExtendedCab.msi (26 bytes)

The process ngen.exe:3920 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Microsoft.NET\Framework\v4.0.30319\ngen.log (43210 bytes)

The process ngen.exe:3888 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Microsoft.NET\Framework\v4.0.30319\ngen.log (886 bytes)

Registry activity

The process support.exe:1564 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D4 1A A3 3A CD C9 53 C6 CE 54 38 B5 A2 55 BE 0A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\InterbootContext]
"(Default)" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Application Data\Adobe\Support\prerequisites\.NET Framework 4.0]
"dotNetFx40_Full_setup.exe" = "Microsoft .NET Framework 4 Setup"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\RarSFX0]
"support.exe" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\RarSFX0\support.exe /exenoupdates /exelang 0 /prereqs 1 /qn"

The Trojan deletes the following registry key(s):

[HKCU\InterbootContext]

The Trojan deletes the following value(s) in system registry:
The Trojan disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\RarSFX0]
"support.exe"

The process Setup.exe:1896 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DF 48 32 26 8E 5F 21 82 88 64 93 4A F5 17 3A 20"

The process KeywordService.exe:2340 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "46 B8 CF 5B 0F DA 36 62 29 5F 83 49 22 33 81 0E"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application]
"Sources" = "ASP.NET 4.0.30319.0, WSH, WMIAdapter, WMI.NET Provider Extension, WmdmPmSN, WinMgmt, Winlogon, Windows Product Activation, Windows 3.1 Migration, WebClient, VSSetup, VSS, vmtools, vmStatsProvider, VBRuntime, Userinit, Userenv, TPVCGateway, Tlntsvr, System.ServiceModel.Install 3.0.0.0, System.ServiceModel 4.0.0.0, System.ServiceModel 3.0.0.0, System.Runtime.Serialization 4.0.0.0, System.Runtime.Serialization 3.0.0.0, System.IO.Log 4.0.0.0, System.IO.Log 3.0.0.0, System.IdentityModel 4.0.0.0, System.IdentityModel 3.0.0.0, SysmonLog, Starter, SpoolerCtrs, Software Restriction Policies, Software Installation, ServiceModel Audit 4.0.0.0, ServiceModel Audit 3.0.0.0, SecurityCenter, SclgNtfy, SceSrv, SceCli, safrslv, SAFrdms, RPC, Remote Assistance, PerlMsg, PerfProc, PerfOS, PerfNet, Perfmon, Perflib, PerfDisk, Perfctrs, Offline Files, Oakley, ntbackup, MSSQLSERVER/MSDE, MSSHA, MsiInstaller, MSDTC Client, MSDTC, mnmsrvc, Microsoft.Transactions.Bridge 4.0.0.0, Microsoft.Transactions.Bridge 3.0.0.0, Microsoft H.323 Telephony Service Provider, Microsoft (R) Visual C# 2005 Compile`"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\Service1]
"EventMessageFile" = "%WinDir%\Microsoft.NET\Framework\v4.0.30319\EventLogMessages.dll"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = ""
"Cookies" = "%Documents and Settings%\LocalService\Cookies"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\C]
"BaseClass" = "Drive"

[HKU\.DEFAULT\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Adobe\Support]
"AutoUpdate.exe" = "Autoupdate"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = ""

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D]
"BaseClass" = "Drive"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F]
"BaseClass" = "Drive"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\A]
"BaseClass" = "Drive"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The process lodctr.exe:2772 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "67 76 7B D6 46 AC 11 C0 D3 8F F5 85 83 1C 4E 3C"

[HKLM\System\CurrentControlSet\Services\.NET Memory Cache 4.0\Performance]
"First Help" = "3705"
"First Counter" = "3704"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib]
"Updating" = ".NET Memory Cache 4.0"

[HKLM\System\CurrentControlSet\Services\.NET Memory Cache 4.0\Performance]
"Last Counter" = "3718"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib]
"Last Help" = "3719"

[HKLM\System\CurrentControlSet\Services\.NET Memory Cache 4.0\Performance]
"Last Help" = "3719"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib]
"Last Counter" = "3718"

[HKLM\System\CurrentControlSet\Services\.NET Memory Cache 4.0\Performance]
"Object List" = "3704"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib]
"Updating"

[HKLM\System\CurrentControlSet\Services\.NET Memory Cache 4.0\Performance]
"Disable Performance Counters"

The process lodctr.exe:364 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D2 AA AF 8B 54 6E 83 63 1E 4B B2 62 74 BB A8 AF"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib]
"Updating"

The process lodctr.exe:2804 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B5 58 37 B1 39 FE F2 A3 0A 16 3C 4F F6 75 73 DD"

[HKLM\System\CurrentControlSet\Services\Windows Workflow Foundation 4.0.0.0\Performance]
"First Counter" = "3720"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib]
"Updating" = "Windows Workflow Foundation 4.0.0.0"

[HKLM\System\CurrentControlSet\Services\Windows Workflow Foundation 4.0.0.0\Performance]
"Last Counter" = "3762"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib]
"Last Help" = "3763"

[HKLM\System\CurrentControlSet\Services\Windows Workflow Foundation 4.0.0.0\Performance]
"Object List" = "3720 3720 3720 3720 3720 3720 3720 3720 3720 3720 3720 3720 3720 3720 3720 3720 3720 3720 3720 3720 3720 3720 3720 3720"
"First Help" = "3721"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib]
"Last Counter" = "3762"

[HKLM\System\CurrentControlSet\Services\Windows Workflow Foundation 4.0.0.0\Performance]
"Last Help" = "3763"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib]
"Updating"

[HKLM\System\CurrentControlSet\Services\Windows Workflow Foundation 4.0.0.0\Performance]
"Disable Performance Counters"

The process IDM1.tmp:1760 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F8 E5 C5 5F 18 6C 32 53 20 C6 A2 0A 45 1A BE BB"

The process aspnet_regiis.exe:3232 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\MMC\NodeTypes\{a841b6c8-7577-11d0-bb1f-00a0c922e79c}\Extensions\PropertySheet]
"{fedb2179-2335-48f1-aa28-5cda35a2b36d}" = "ASP.NET MMC Extension VDir Node"

[HKLM\System\CurrentControlSet\Services\ASP.NET_4.0.30319\Performance]
"Last Help" = "4195"
"Object List" = "3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986"

[HKLM\System\CurrentControlSet\Services\aspnet_state\Performance]
"First Help" = "3765"

[HKLM\SOFTWARE\Microsoft\ASP.NET\4.0.30319.0]
"DefaultDoc" = "Default.aspx"

[HKLM\System\CurrentControlSet\Services\ASP.NET\Performance]
"Collect" = "CollectGenericCounters"
"Last Help" = "4407"

[HKLM\System\CurrentControlSet\Services\aspnet_state\Performance]
"Object List" = "3764 3764 3764 3764 3764 3764 3764 3764 3764 3764 3764 3764 3764 3764 3764 3764 3764 3764 3764 3764 3764 3764 3764 3764"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ASP.NET 4.0.30319.0]
"EventMessageFile" = "%WinDir%\Microsoft.NET\Framework\v4.0.30319\aspnet_rc.dll"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib]
"Last Help" = "3983"

[HKLM\SOFTWARE\Microsoft\MMC\NodeTypes\{a841b6c5-7577-11d0-bb1f-00a0c922e79c}\Extensions\PropertySheet]
"{fedb2179-2335-48f1-aa28-5cda35a2b36d}" = "ASP.NET MMC Extension"

[HKLM\System\CurrentControlSet\Services\ASP.NET\Performance]
"Library" = "aspnet_counters.dll"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ASP.NET 4.0.30319.0]
"CategoryCount" = "5"

[HKCR\CLSID\{5437FDFA-9EC9-4CCC-8531-42F8D9C19AF7}]
"AppID" = "{F75B6772-91E4-4D2F-9D44-61A447109C2B}"

[HKLM\SOFTWARE\Microsoft\MMC\NodeTypes\{a841b6c2-7577-11d0-bb1f-00a0c922e79c}\Extensions\PropertySheet]
"{fedb2179-2335-48f1-aa28-5cda35a2b36d}" = "ASP.NET MMC Extension IIS Snap in"

[HKLM\SOFTWARE\Microsoft\MMC\NodeTypes\{a841b6c4-7577-11d0-bb1f-00a0c922e79c}\Extensions\PropertySheet]
"{fedb2179-2335-48f1-aa28-5cda35a2b36d}" = "ASP.NET MMC Extension Machine Node"

[HKCR\AppID\{F75B6772-91E4-4D2F-9D44-61A447109C2B}]
"DllSurrogate" = ""

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ASP.NET 4.0.30319.0]
"TypesSupported" = "7"

[HKLM\System\CurrentControlSet\Services\aspnet_state\Performance]
"First Counter" = "3764"

[HKCR\TypeLib\{0015B4CC-EDC9-3A0E-B14A-AFB8F75F2A1C}\2.4\0\win32]
"(Default)" = "%WinDir%\Microsoft.NET\Framework\v4.0.30319\System.Web.tlb"

[HKLM\SOFTWARE\Microsoft\ASP.NET\4.0.30319.0]
"Mimemap" = ".wsdl,text/xml,.disco,text/xml,.xsd,text/xml,.wbmp,image/vnd.wap.wbmp,.png,image/png,.pnz,image/png,.smd,audio/x-smd,.smz,audio/x-smd,.smx,audio/x-smd,.mmf,application/x-smaf,.application,application/x-ms-application,.manifest,application/x-ms-manifest,.deploy,application/octet-stream,"

[HKCR\TypeLib\{0015B4CC-EDC9-3A0E-B14A-AFB8F75F2A1C}\2.4\FLAGS]
"(Default)" = "0"

[HKLM\System\CurrentControlSet\Services\ASP.NET_4.0.30319\Performance]
"Library" = "aspnet_counters.dll"

[HKCR\Microsoft.Aspnet.Snapin.AspNetManagementUtility.4\CLSID]
"(Default)" = "{5437FDFA-9EC9-4CCC-8531-42F8D9C19AF7}"

[HKLM\System\CurrentControlSet\Services\ASP.NET\Performance]
"Open" = "OpenGenericCounters"

[HKLM\System\CurrentControlSet\Services\aspnet_state\Parameters]
"AllowRemoteConnection" = "0"
"Port" = "42424"

[HKLM\System\CurrentControlSet\Services\ASP.NET_4.0.30319\Performance]
"First Counter" = "3984"

[HKCR\.ascx\PersistentHandler]
"(Default)" = "{eec97550-47a9-11cf-b952-00aa0051fe20}"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib]
"Updating" = "aspnet_state"

[HKLM\SOFTWARE\Microsoft\ASP.NET\4.0.30319.0]
"DllFullPath" = "%WinDir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll"

[HKLM\System\CurrentControlSet\Services\aspnet_state\Performance]
"Close" = "CloseStateCounters"

[HKLM\SOFTWARE\Microsoft\MMC\NodeTypes\{a841b6c7-7577-11d0-bb1f-00a0c922e79c}\Extensions\PropertySheet]
"{fedb2179-2335-48f1-aa28-5cda35a2b36d}" = "ASP.NET MMC Extension Instance Node"

[HKLM\SOFTWARE\Microsoft\ASP.NET\4.0.30319.0\CompilationMutexName]
"(Default)" = "3kKT8zb1cTxvRhiCcp7AxLadgyvqn0"

[HKLM\SOFTWARE\Microsoft\MMC\NodeTypes\{a841b6c3-7577-11d0-bb1f-00a0c922e79c}\Extensions\PropertySheet]
"{fedb2179-2335-48f1-aa28-5cda35a2b36d}" = "ASP.NET MMC Extension Static Node"

[HKCR\CLSID\{00000541-0000-0010-8000-00AA006D2EA4}\InprocServer32]
"ThreadingModel" = "Both"

[HKLM\System\CurrentControlSet\Services\aspnet_state\Linkage]
"Export" = "4.0.30319.0"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ASP.NET 4.0.30319.0]
"CategoryMessageFile" = "%WinDir%\Microsoft.NET\Framework\v4.0.30319\aspnet_rc.dll"

[HKCR\CLSID\{5437FDFA-9EC9-4CCC-8531-42F8D9C19AF7}]
"(Default)" = "Microsoft.Aspnet.Snapin.AspNetManagementUtility.4"

[HKCR\CLSID\{00000535-0000-0010-8000-00AA006D2EA4}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\CLSID\{FEDB2179-2335-48F1-AA28-5CDA35A2B36D}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList]
"ASPNET" = "0"

[HKLM\System\CurrentControlSet\Services\aspnet_state\Performance]
"Library" = "aspnet_counters.dll"

[HKCR\Interface\{98347F39-50EC-3894-AC43-E1948377FD43}\TypeLib]
"(Default)" = "{0015B4CC-EDC9-3A0E-B14A-AFB8F75F2A1C}"

[HKCR\CLSID\{5437FDFA-9EC9-4CCC-8531-42F8D9C19AF7}\ProgId]
"(Default)" = "Microsoft.Aspnet.Snapin.AspNetManagementUtility.4"

[HKLM\SOFTWARE\Microsoft\ASP.NET\4.0.30319.0]
"LastInstallTime" = "Type: REG_QWORD, Length: 8"

[HKLM\System\CurrentControlSet\Services\ASP.NET\Performance]
"Object List" = "4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198"

[HKLM\SOFTWARE\Microsoft\MMC\NodeTypes\{a841b6c9-7577-11d0-bb1f-00a0c922e79c}\Extensions\PropertySheet]
"{fedb2179-2335-48f1-aa28-5cda35a2b36d}" = "ASP.NET MMC Extension File Node"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib]
"Last Counter" = "3982"

[HKLM\System\CurrentControlSet\Services\ASP.NET\Linkage]
"Export" = "4.0.30319.0"

[HKLM\System\CurrentControlSet\Services\ASP.NET_4.0.30319\Performance]
"First Help" = "3985"

[HKCR\CLSID\{00000507-0000-0010-8000-00AA006D2EA4}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\CLSID\{0000050B-0000-0010-8000-00AA006D2EA4}\InprocServer32]
"ThreadingModel" = "Both"

[HKLM\SOFTWARE\Microsoft\ASP.NET\4.0.30319.0]
"Path" = "%WinDir%\Microsoft.NET\Framework\v4.0.30319"

[HKLM\SOFTWARE\Microsoft\MMC\SnapIns\{fedb2179-2335-48f1-aa28-5cda35a2b36d}]
"About" = "{4E9963B7-B2BF-4685-9378-8FEBEA364EF8}"

[HKCR\TypeLib\{0015B4CC-EDC9-3A0E-B14A-AFB8F75F2A1C}\2.4]
"(Default)" = "System_Web"

[HKLM\System\CurrentControlSet\Services\ASP.NET_4.0.30319\Performance]
"Collect" = "CollectVersion4Counters"

[HKLM\SOFTWARE\Microsoft\ASP.NET\4.0.30319.0]
"SupportedExts" = ".asax,1,.ascx,1,.ashx,0,.asmx,0,.aspx,0,.axd,0,.vsdisco,0,.rem,0,.soap,0,.config,1,.cs,1,.csproj,1,.vb,1,.vbproj,1,.webinfo,1,.licx,1,.resx,1,.resources,1,.master,1,.skin,1,.compiled,1,.browser,1,.mdb,1,.jsl,1,.vjsproj,1,.sitemap,1,.msgx,0,.ad,1,.dd,1,.ldd,1,.sd,1,.cd,1,.adprototype,1,.lddprototype,1,.sdm,1,.sdmDocument,1,.ldb,1,.svc,0,.mdf,1,.ldf,1,.java,1,.exclude,1,.refresh,1,.xoml,0,.xamlx,0,.rules,1,.aspq,1,.cshtm,1,.cshtml,1,.vbhtm,1,.vbhtml,1,"

[HKLM\SOFTWARE\Microsoft\MMC\SnapIns\{fedb2179-2335-48f1-aa28-5cda35a2b36d}]
"NameString" = "ASP.NET Management Extension"

[HKLM\System\CurrentControlSet\Services\aspnet_state\Performance]
"Collect" = "CollectStateCounters"
"Open" = "OpenStateCounters"

[HKLM\SOFTWARE\Microsoft\MMC\NodeTypes\{a841b6c6-7577-11d0-bb1f-00a0c922e79c}\Extensions\PropertySheet]
"{fedb2179-2335-48f1-aa28-5cda35a2b36d}" = "ASP.NET MMC Extension"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "52 2F 1C 7E 7C 06 95 A2 FA 32 D2 88 6D 7B ED E5"

[HKLM\System\CurrentControlSet\Services\ASP.NET\Performance]
"Close" = "CloseGenericCounters"
"First Help" = "4197"

[HKCR\CLSID\{FEDB2179-2335-48F1-AA28-5CDA35A2B36D}\InprocServer32]
"(Default)" = "%WinDir%\Microsoft.NET\Framework\v4.0.30319\MmcAspExt.dll"

[HKLM\System\CurrentControlSet\Services\ASP.NET_4.0.30319\Performance]
"Open" = "OpenVersion4Counters"

[HKLM\System\CurrentControlSet\Services\ASP.NET\Performance]
"First Counter" = "4196"

[HKCR\Interface\{A99B591A-23C6-4238-8452-C7B0E895063D}\TypeLib]
"Version" = "2.4"
"(Default)" = "{0015B4CC-EDC9-3A0E-B14A-AFB8F75F2A1C}"

[HKCR\AppID\{F75B6772-91E4-4D2F-9D44-61A447109C2B}]
"(Default)" = "Microsoft.Aspnet.Snapin.AspNetManagementUtility.4"

[HKLM\System\CurrentControlSet\Services\aspnet_state\Performance]
"Last Help" = "3983"

[HKLM\System\CurrentControlSet\Services\ASP.NET_4.0.30319\Performance]
"Close" = "CloseVersion4Counters"

[HKCR\Interface\{98347F39-50EC-3894-AC43-E1948377FD43}\TypeLib]
"Version" = "2.4"

[HKLM\System\CurrentControlSet\Services\ASP.NET_4.0.30319\Linkage]
"Export" = "4.0.30319.0"

[HKLM\System\CurrentControlSet\Services\ASP.NET_4.0.30319\Performance]
"Last Counter" = "4194"

[HKCR\TypeLib\{0015B4CC-EDC9-3A0E-B14A-AFB8F75F2A1C}\2.4\HELPDIR]
"(Default)" = "%WinDir%\Microsoft.NET\Framework\v4.0.30319"

[HKLM\SOFTWARE\Microsoft\ASP.NET\4.0.30319.0]
"AssemblyVersion" = "4.0.0.0"

[HKLM\System\CurrentControlSet\Services\aspnet_state\Performance]
"Last Counter" = "3982"

[HKCR\.aspx\PersistentHandler]
"(Default)" = "{eec97550-47a9-11cf-b952-00aa0051fe20}"

[HKLM\System\CurrentControlSet\Services\ASP.NET\Performance]
"Last Counter" = "4406"

The Trojan deletes the following registry key(s):

[HKLM\SOFTWARE\Microsoft\ASP.NET\4.0.30319.0]

The Trojan deletes the following value(s) in system registry:

[HKLM\System\CurrentControlSet\Services\ASP.NET\Performance]
"Last Help"

[HKLM\System\CurrentControlSet\Services\aspnet_state\Performance]
"Disable Performance Counters"

[HKLM\System\CurrentControlSet\Services\aspnet_state\Parameters]
"AllowRemoteConnection"
"Port"

[HKLM\SOFTWARE\Microsoft\ASP.NET\4.0.30319.0]
"DefaultDoc"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib]
"Updating"

[HKLM\System\CurrentControlSet\Services\ASP.NET\Performance]
"Object List"

[HKLM\SOFTWARE\Microsoft\ASP.NET\4.0.30319.0]
"DllFullPath"

[HKLM\System\CurrentControlSet\Services\ASP.NET\Performance]
"First Help"

[HKLM\SOFTWARE\Microsoft\ASP.NET\4.0.30319.0]
"Path"
"AssemblyVersion"

[HKLM\System\CurrentControlSet\Services\ASP.NET\Performance]
"Library Validation Code"

[HKLM\SOFTWARE\Microsoft\ASP.NET\4.0.30319.0]
"SupportedExts"

[HKLM\System\CurrentControlSet\Services\ASP.NET_4.0.30319\Performance]
"Disable Performance Counters"

[HKLM\System\CurrentControlSet\Services\ASP.NET\Performance]
"Last Counter"
"First Counter"
"Disable Performance Counters"

[HKLM\SOFTWARE\Microsoft\ASP.NET\4.0.30319.0]
"Mimemap"

The process idman621f.exe:1276 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5B C5 61 74 85 4E 69 5E B6 94 A5 33 54 DC 4C 57"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process mscorsvw.exe:2860 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA 6C D2 2F 67 BA 44 F6 CE 3B 31 4A 38 4C 04 4E"

The process mscorsvw.exe:2904 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C0 B9 7B EA 49 04 BB 7D 73 DF B1 04 B8 E7 F0 52"

The process mscorsvw.exe:1204 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7C FF 99 73 DE 36 4F 06 7D 4E 41 32 B7 7B 17 BD"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:336 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D0 0C D5 08 A9 75 34 01 D9 61 EB 4F B6 8F 11 21"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:3944 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BD D3 E8 41 09 DC 22 64 B8 62 9F 3A E5 75 4E 86"

The process mscorsvw.exe:3800 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E6 5A F1 14 A3 C8 7E 8B 08 4A 01 FE 45 D8 50 95"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:3060 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DF 0F 5E 57 59 7F F6 38 3A 79 68 47 FA FE B1 F2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process mscorsvw.exe:1908 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "73 04 1B 11 AC 6E DD 9D FE 1B 9F 84 BC 6D D2 A2"

The process mscorsvw.exe:1488 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "18 54 DE 59 83 34 08 FF 79 E4 74 70 17 BC 77 12"

The process mscorsvw.exe:3292 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9D 16 28 B6 23 5F 49 DD CF D4 E9 5E 31 6E 13 B8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:4008 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\7e441e10\2807462a]
"1b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\740e747\583670c4]
"3f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\1a714620\2f0c2e3a]
"1c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\46b91004\571609c]
"5" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\3e5c014b\2933b5e4]
"35" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\7a819b88\1229dc20]
"50" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\6087e565\6f05f6e3]
"b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\48cbec9d\4c0baa3d\53]
"ILDependencies" = "3F BC 10 09 9E B8 6D 30 09 00 00 00 04 00 00 00"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\7a819b88\1229dc20]
"50" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\768ca187\29eb70c6\3\InvertDependencies\226b2009\768ca187]
"14" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7ac727df\4c76d55c]
"3" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\44ec6d48\74c9f6c5]
"27" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7f0603e4\ecd2583]
"40" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\6960d6d7\4b18a453]
"3d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\179bc95c\2202b9f5]
"34" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d0933fc\a425901\28\InvertDependencies\61e7e666\27e1f7e2]
"17" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32]
"Status" = "1"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\179bc95c\2202b9f5]
"34" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\768ca187\29eb70c6\3\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\48cbec9d\4c0baa3d\53]
"MVID" = "95 A4 6D 47 75 42 8A CF 5D D8 4F 12 AA A9 F0 6F"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\368e5e51\5cbefaea]
"58" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\1320606e\5f605a0e]
"19" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\4c0baa3d\6b6b1c13\53]
"DisplayName" = "System.Design,4.0.0.0,,b03f5f7f11d50a3a"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\4f1555b2\4383b32f]
"24" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\5764ec77\5f62750e]
"56" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\6087e565\6f05f6e3]
"b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\2ef268ac\497c9d44]
"4f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\4d5ecec1\58ac8060]
"9" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\64be1fa4\58364143]
"2a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\3e5c014b\2933b5e4]
"35" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\3d67735\7bda07cc]
"7" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\48cbec9d\4c0baa3d\53]
"ConfigMask" = "4361"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\649348ce\60337166]
"2c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\7e420f89\11c357a1]
"1a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\48cbec9d\4c0baa3d\53]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\4f1555b2\4383b32f]
"24" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\1bc5b14b\7dd65e4]
"4d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\25ed4857\426d019e\52]
"SIG" = "46 11 84 04 3F 14 BA 45 9A 58 F3 DE 0D C0 DD 5D"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\1c22df2f\6ae28f47]
"1d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\226b2009\768ca187]
"14" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\1a714620\2f0c2e3a]
"1c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\298818d6\3d37e654]
"26" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\55d78379\3d9f8012]
"6" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\159a66b8\5d94bc56]
"10" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\311f1bc6\78ce3965]
"43" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\368e5e51\5cbefaea]
"58" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\1c22df2f\6ae28f47]
"1d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\429b0dd8\1d9a9270]
"39" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d0933fc\a425901\28\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\2ef268ac\497c9d44]
"4f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\48cbec9d\4c0baa3d\53]
"ConfigString" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\72522657\467dfbf7]
"51" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\6faf58\34f474d5]
"F" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5b86bed\63ca5c10\5f]
"Status" = "4098"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\5f079895\3e0d252d]
"4e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7a819b88\1229dc20]
"50" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\19a3ab9\9adbb50]
"23" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\640d09ef\10ac776b]
"e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\6960d6d7\4b18a453]
"3d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\64be1fa4\58364143]
"2a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\226b2009\768ca187]
"14" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\4f0ed0af\4b333e2c]
"3b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\60049528\69f655c0]
"54" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\77a2835c\447dbcd8]
"25" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\61e7e666\27e1f7e2]
"17" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\768ca187\29eb70c6\3\InvertDependencies\368e5e51\5cbefaea]
"58" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\25ed4857\426d019e\52\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\53e01c0b\3aecd0a4]
"38" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\3d67735\7bda07cc]
"7" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\61e7e666\27e1f7e2]
"17" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\3a50533c\769fc3d5]
"2d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\6f06001f\62a6b5be]
"d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\48cbec9d\4c0baa3d\53]
"NIDependencies" = "C6 38 19 18 42 CA 99 14 01 00 00 00 04 00 00 00"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\3cca06a0\910bc3f]
"4" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\55d78379\3d9f8012]
"6" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\368e5e51\5cbefaea]
"58" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\340dcf4c\55b350eb]
"30" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\2a7f0223\16be2bc2]
"1f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\6f06001f\62a6b5be]
"d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\432ba598\2ab76b15]
"2f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\159a66b8\5d94bc56]
"10" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\53e01c0b\3aecd0a4]
"38" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\53e01c0b\3aecd0a4]
"38" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7ac727df\4c76d55c]
"3" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\3d67735\7bda07cc]
"7" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\2708d9ec\352e0e84]
"18" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\7940d148\2bfa95e0]
"36" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\40087b74\3bb0edb3\60]
"DisplayName" = "System.Web,4.0.0.0,,b03f5f7f11d50a3a"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5b86bed\63ca5c10\5f]
"LastModTime" = "EC EF D8 9F A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\340dcf4c\55b350eb]
"30" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\561175dc\261d3b7b]
"47" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\552fa235\a3eaecd]
"4a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\6960d6d7\4b18a453]
"3d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\585c020c\7c0832a4]
"37" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\1c22df2f\6ae28f47]
"1d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\6eae2d34\566d82b2]
"22" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\64be1fa4\58364143]
"2a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\2a7f0223\16be2bc2]
"1f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7e420f89\11c357a1]
"1a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\7ac727df\4c76d55c]
"3" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\5132fda3\47899b1f]
"46" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\1c22df2f\6ae28f47]
"1d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\298818d6\3d37e654]
"26" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\2a7f0223\16be2bc2]
"1f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\5fcea75a\57e574f9]
"4c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\1904b408\7e673d85]
"2" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\740e747\583670c4]
"3f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\61e7e666\27e1f7e2]
"17" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\61e7e666\27e1f7e2]
"17" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\2a8ab4f5\43eec18d]
"55" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\4eb53aa8\50e4c026]
"3e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\1c22df2f\6ae28f47]
"1d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\60049528\69f655c0]
"54" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\40087b74\3bb0edb3\60]
"SIG" = "65 80 64 CA A9 CD 05 40 AB 2E 7E A8 40 E9 32 4A"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\46b91004\571609c]
"5" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\73320ae2\63e86779]
"4b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\6faf58\34f474d5]
"F" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\6c9a55d4\78d3666c]
"31" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\53ab1129\25acd1c0]
"a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\index57]
"NIUsageMask" = "FF FF FF FF FF FF FF FF FF FF FD"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\6faf58\34f474d5]
"F" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\40087b74\3bb0edb3\60\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\5149b6c8\70e4f760]
"16" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\db950d6\2f66e4ee]
"44" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\2708d9ec\352e0e84]
"18" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\585c020c\7c0832a4]
"37" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\212ef70c\701aec8a]
"41" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\768ca187\29eb70c6\3\InvertDependencies\3e5c014b\2933b5e4]
"35" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\4c0baa3d\6b6b1c13\53]
"SIG" = "BC EB DD 90 43 40 35 45 8D 0A 8A AC 2A E3 93 76"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\65e9966b\102e28b1\59\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\109d7e79\50c7cc18]
"20" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\30bc7c4f\5a99e5cd]
"8" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\179bc95c\2202b9f5]
"34" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\368e5e51\5cbefaea]
"58" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\25ed4857\426d019e\52]
"DisplayName" = "System.Web.RegularExpressions,4.0.0.0,,b03f5f7f11d50a3a"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\50a69a2e\491f93ce]
"13" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\19a3ab9\9adbb50]
"23" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5b86bed\63ca5c10\5f]
"DisplayName" = "System.Drawing.Design,4.0.0.0,,b03f5f7f11d50a3a"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\3693fb48\607100c5]
"2b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\179bc95c\2202b9f5]
"34" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\2a7f0223\16be2bc2]
"1f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\4eb53aa8\50e4c026]
"3e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\585c020c\7c0832a4]
"37" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7dfaa0d2\6ac7e50]
"48" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7e441e10\2807462a]
"1b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\72522657\467dfbf7]
"51" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\46b91004\571609c]
"5" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\46b91004\571609c]
"5" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\505c41c7\52a7cb45]
"33" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\73320ae2\63e86779]
"4b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\505c41c7\52a7cb45]
"33" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\226b2009\768ca187]
"14" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\5fcea75a\57e574f9]
"4c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\4ed0765e\5d0933fc]
"2e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\1c22df2f\6ae28f47]
"1d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\3693fb48\607100c5]
"2b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\4c0baa3d\6b6b1c13\53]
"Status" = "4098"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\57d4b1bf\23a76b5d]
"29" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\4f0ed0af\4b333e2c]
"3b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\209ced07\2cd602a7]
"15" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\50a69a2e\491f93ce]
"13" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\25ed4857\426d019e\52]
"Status" = "4098"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\f3eb9d9\49cb8779]
"3a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\179bc95c\2202b9f5]
"34" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\5a8de2c3\1dfa8c62]
"45" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\6c9a55d4\78d3666c]
"31" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\4d5ecec1\58ac8060]
"9" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\4b235cde\55b9967d]
"12" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\209ced07\2cd602a7]
"15" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\db950d6\2f66e4ee]
"44" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\1bc5b14b\7dd65e4]
"4d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\60049528\69f655c0]
"54" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\77a2835c\447dbcd8]
"25" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\4c0baa3d\6b6b1c13\53]
"LastModTime" = "0E B6 BE 9F A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\552fa235\a3eaecd]
"4a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\3cca06a0\910bc3f]
"4" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\159a66b8\5d94bc56]
"10" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\311f1bc6\78ce3965]
"43" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\2a8ab4f5\43eec18d]
"55" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\768ca187\29eb70c6\3\InvertDependencies\46b91004\571609c]
"5" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\6697a4\58a1f3bd]
"21" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32]
"ILUsageMask" = "FF FF FF FF FF FF FF FF FF FF FF C1"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\55d78379\3d9f8012]
"6" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\740e747\583670c4]
"3f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\index57]
"ILUsageMask" = "FF FF FF FF FF FF FF FF FF FF FF C1"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\6eae2d34\566d82b2]
"22" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\378d4dc7\3be36366]
"1e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\30bc7c4f\5a99e5cd]
"8" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\5f079895\3e0d252d]
"4e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\6eae2d34\566d82b2]
"22" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\226b2009\768ca187]
"14" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\378d4dc7\3be36366]
"1e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\432ba598\2ab76b15]
"2f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\19a3ab9\9adbb50]
"23" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\71d90c39\3eec59d8]
"32" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\368e5e51\5cbefaea]
"58" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5b86bed\63ca5c10\5f]
"SIG" = "9E AC CE 5F 42 A6 CF 46 B5 66 DD 1F EA 78 22 6B"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\5f079895\3e0d252d]
"4e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\2ef268ac\497c9d44]
"4f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\3e5c014b\2933b5e4]
"35" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\414147a5\77165922]
"c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7b7b125f\7b4bfd]
"42" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\3b9d4dd3\a52a751]
"49" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7940d148\2bfa95e0]
"36" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\6eae2d34\566d82b2]
"22" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\1320606e\5f605a0e]
"19" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\209ced07\2cd602a7]
"15" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\5fcea75a\57e574f9]
"4c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\159a66b8\5d94bc56]
"10" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\6087e565\6f05f6e3]
"b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\7e441e10\2807462a]
"1b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\298818d6\3d37e654]
"26" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\25ed4857\426d019e\52]
"LastModTime" = "A8 90 3E A1 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\4c0baa3d\6b6b1c13\53]
"TargetedPatchBand" = "01 31 2E 30 2E 32 31 2D 30 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\432ba598\2ab76b15]
"2f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\429b0dd8\1d9a9270]
"39" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\f3eb9d9\49cb8779]
"3a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\5a8de2c3\1dfa8c62]
"45" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\53775644\6d8a6bc2]
"57" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d0933fc\a425901\28\InvertDependencies\432ba598\2ab76b15]
"2f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\768ca187\29eb70c6\3\InvertDependencies\740e747\583670c4]
"3f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\1bc5b14b\7dd65e4]
"4d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\4f1555b2\4383b32f]
"24" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\57d4b1bf\23a76b5d]
"29" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\6faf58\34f474d5]
"F" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\70e80e6e\51a1b706]
"28" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\44ec6d48\74c9f6c5]
"27" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\70e80e6e\51a1b706]
"28" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\19a3ab9\9adbb50]
"23" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\40087b74\3bb0edb3\60]
"Status" = "8194"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\65e9966b\102e28b1\59]
"LastModTime" = "F8 DF 87 9F A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\6960d6d7\4b18a453]
"3d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32]
"NIUsageMask" = "FF FF FF FF FF FF FF FF FF FF FD"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\48cbec9d\4c0baa3d\53]
"DisplayName" = "System.Design,4.0.0.0,,b03f5f7f11d50a3a"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\561175dc\261d3b7b]
"47" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\7dfaa0d2\6ac7e50]
"48" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\768ca187\29eb70c6\3\InvertDependencies\4eb53aa8\50e4c026]
"3e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\40087b74\3bb0edb3\60]
"LastModTime" = "62 CD 1A A1 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\57d4b1bf\23a76b5d]
"29" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\3b9d4dd3\a52a751]
"49" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\6087e565\6f05f6e3]
"b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\2eb0c927\2f6391bf]
"11" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7e420f89\11c357a1]
"1a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\4ed0765e\5d0933fc]
"2e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\1320606e\5f605a0e]
"19" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\db950d6\2f66e4ee]
"44" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\7f0603e4\ecd2583]
"40" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7f0603e4\ecd2583]
"40" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\4c0baa3d\6b6b1c13\53\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\179bc95c\2202b9f5]
"34" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\311f1bc6\78ce3965]
"43" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\298818d6\3d37e654]
"26" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\2a8ab4f5\43eec18d]
"55" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\3b9d4dd3\a52a751]
"49" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\4eb53aa8\50e4c026]
"3e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\5132fda3\47899b1f]
"46" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\7f0603e4\ecd2583]
"40" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\7940d148\2bfa95e0]
"36" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\768ca187\29eb70c6\3\InvertDependencies\3d67735\7bda07cc]
"7" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\73320ae2\63e86779]
"4b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\2eb0c927\2f6391bf]
"11" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\1bc5b14b\7dd65e4]
"4d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\5fcea75a\57e574f9]
"4c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\64be1fa4\58364143]
"2a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\61e7e666\27e1f7e2]
"17" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32]
"LatestIndex" = "87"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\70e80e6e\51a1b706]
"28" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\77a2835c\447dbcd8]
"25" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\65e9966b\102e28b1\59]
"DisplayName" = "System.Data.OracleClient,4.0.0.0,,b77a5c561934e089"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\46b91004\571609c]
"5" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\4eb53aa8\50e4c026]
"3e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d0933fc\a425901\28\InvertDependencies\4ed0765e\5d0933fc]
"2e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\5764ec77\5f62750e]
"56" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\340dcf4c\55b350eb]
"30" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\25ed4857\426d019e\52]
"TargetedPatchBand" = "01 31 2E 30 2E 32 31 2D 30 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\44ec6d48\74c9f6c5]
"27" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7e441e10\2807462a]
"1b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\5f079895\3e0d252d]
"4e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\545c5dd6\3d40af53]
"3c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\226b2009\768ca187]
"14" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7dfaa0d2\6ac7e50]
"48" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\585c020c\7c0832a4]
"37" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\6f06001f\62a6b5be]
"d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\2ef268ac\497c9d44]
"4f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\6c9a55d4\78d3666c]
"31" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\1bc5b14b\7dd65e4]
"4d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\72522657\467dfbf7]
"51" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\429b0dd8\1d9a9270]
"39" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\7940d148\2bfa95e0]
"36" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\4f0ed0af\4b333e2c]
"3b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\77a2835c\447dbcd8]
"25" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\64be1fa4\58364143]
"2a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\65e9966b\102e28b1\59]
"SIG" = "2E 32 FF D2 C0 99 DA 42 B1 28 5E 01 FE A9 62 52"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BE 55 C6 E5 02 09 00 76 65 73 5C 67 55 55 49 A3"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\3b9d4dd3\a52a751]
"49" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\3693fb48\607100c5]
"2b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\212ef70c\701aec8a]
"41" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\4f0ed0af\4b333e2c]
"3b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\340dcf4c\55b350eb]
"30" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\19a3ab9\9adbb50]
"23" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\368e5e51\5cbefaea]
"58" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\3b9d4dd3\a52a751]
"49" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\61e7e666\27e1f7e2]
"17" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7940d148\2bfa95e0]
"36" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\4eb53aa8\50e4c026]
"3e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\5149b6c8\70e4f760]
"16" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\311f1bc6\78ce3965]
"43" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5b86bed\63ca5c10\5f\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\545c5dd6\3d40af53]
"3c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\212ef70c\701aec8a]
"41" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\3d67735\7bda07cc]
"7" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\740e747\583670c4]
"3f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\72522657\467dfbf7]
"51" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\40087b74\3bb0edb3\60]
"TargetedPatchBand" = "01 31 2E 30 2E 32 31 2D 30 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\552fa235\a3eaecd]
"4a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\768ca187\29eb70c6\3\InvertDependencies\72522657\467dfbf7]
"51" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\212ef70c\701aec8a]
"41" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\212ef70c\701aec8a]
"41" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\55d78379\3d9f8012]
"6" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\53ab1129\25acd1c0]
"a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\30bc7c4f\5a99e5cd]
"8" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\70e80e6e\51a1b706]
"28" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\1904b408\7e673d85]
"2" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7a819b88\1229dc20]
"50" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\3d67735\7bda07cc]
"7" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\7e420f89\11c357a1]
"1a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\77a2835c\447dbcd8]
"25" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\640d09ef\10ac776b]
"e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\65e9966b\102e28b1\59]
"Status" = "8194"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\5f079895\3e0d252d]
"4e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32]
"SystemStoreChangeId" = "227"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\3e5c014b\2933b5e4]
"35" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\f3eb9d9\49cb8779]
"3a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\1a714620\2f0c2e3a]
"1c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\7a819b88\1229dc20]
"50" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\5764ec77\5f62750e]
"56" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\4f1555b2\4383b32f]
"24" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\5132fda3\47899b1f]
"46" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\768ca187\29eb70c6\3\InvertDependencies\6087e565\6f05f6e3]
"b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\2ef268ac\497c9d44]
"4f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5b86bed\63ca5c10\5f]
"TargetedPatchBand" = "01 31 2E 30 2E 32 31 2D 30 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\4d5ecec1\58ac8060]
"9" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\311f1bc6\78ce3965]
"43" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7b7b125f\7b4bfd]
"42" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\1904b408\7e673d85]
"2" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\3cca06a0\910bc3f]
"4" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\53e01c0b\3aecd0a4]
"38" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\60049528\69f655c0]
"54" = ""

The Trojan deletes the following registry key(s):

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\index55]

The process mscorsvw.exe:2568 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3E 0E 7D 8E A6 72 54 6E FB D2 AC B5 F1 A5 44 E1"

The process mscorsvw.exe:1984 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7e420f89\11c357a1]
"1a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\73320ae2\63e86779]
"4b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\42d76e4d\5b86bed\52]
"ILDependencies" = "3F BC 10 09 9E B8 6D 30 09 00 00 00 04 00 00 00"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\7e441e10\2807462a]
"1b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\2a8ab4f5\43eec18d]
"55" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\42d76e4d\5b86bed]
"52" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\311f1bc6\78ce3965]
"43" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\1c22df2f\6ae28f47]
"1d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\298818d6\3d37e654]
"26" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\6697a4\58a1f3bd]
"21" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\1bc5b14b\7dd65e4]
"4d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\740e747\583670c4]
"3f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32]
"ILUsageMask" = "FF FF FF FF FF FF FF FF FF FF FF C1"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\55d78379\3d9f8012]
"6" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\5fcea75a\57e574f9]
"4c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\1320606e\5f605a0e]
"19" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\1a714620\2f0c2e3a]
"1c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\46b91004\571609c]
"5" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\740e747\583670c4]
"3f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\64be1fa4\58364143]
"2a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\378d4dc7\3be36366]
"1e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\3cca06a0\910bc3f]
"4" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\30bc7c4f\5a99e5cd]
"8" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\5f079895\3e0d252d]
"4e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\61e7e666\27e1f7e2]
"17" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\2a8ab4f5\43eec18d]
"55" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\1904b408\7e673d85]
"2" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\2eb0c927\2f6391bf]
"11" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\432ba598\2ab76b15]
"2f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\60049528\69f655c0]
"54" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7f0603e4\ecd2583]
"40" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32]
"LatestIndex" = "88"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\70e80e6e\51a1b706]
"28" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\6960d6d7\4b18a453]
"3d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\368e5e51\5cbefaea]
"58" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\71d90c39\3eec59d8]
"32" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\42d76e4d\5b86bed\52]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\46b91004\571609c]
"5" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32]
"Status" = "1"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\179bc95c\2202b9f5]
"34" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\index58]
"ILUsageMask" = "FF FF FF FF FF FF FF FF FF FF FF C1"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\6faf58\34f474d5]
"F" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\77a2835c\447dbcd8]
"25" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\6c9a55d4\78d3666c]
"31" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\46b91004\571609c]
"5" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\53ab1129\25acd1c0]
"a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\368e5e51\5cbefaea]
"58" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\1320606e\5f605a0e]
"19" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7a819b88\1229dc20]
"50" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\5fcea75a\57e574f9]
"4c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\5149b6c8\70e4f760]
"16" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\5764ec77\5f62750e]
"56" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\5132fda3\47899b1f]
"46" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\index58]
"NIUsageMask" = "FF FF FF FF FF FF FF FF FF FF FF"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\db950d6\2f66e4ee]
"44" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\2708d9ec\352e0e84]
"18" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\64be1fa4\58364143]
"2a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\5764ec77\5f62750e]
"56" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\44ec6d48\74c9f6c5]
"27" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\6c9a55d4\78d3666c]
"31" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\1904b408\7e673d85]
"2" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7e441e10\2807462a]
"1b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\3d67735\7bda07cc]
"7" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\42d76e4d\5b86bed]
"52" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\42d76e4d\5b86bed\52]
"DisplayName" = "System.Drawing.Design,4.0.0.0,,b03f5f7f11d50a3a"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\545c5dd6\3d40af53]
"3c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\414147a5\77165922]
"c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7b7b125f\7b4bfd]
"42" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\226b2009\768ca187]
"14" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\3b9d4dd3\a52a751]
"49" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7940d148\2bfa95e0]
"36" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\6eae2d34\566d82b2]
"22" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\109d7e79\50c7cc18]
"20" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\7e420f89\11c357a1]
"1a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7dfaa0d2\6ac7e50]
"48" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\552fa235\a3eaecd]
"4a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\585c020c\7c0832a4]
"37" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\1bc5b14b\7dd65e4]
"4d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\209ced07\2cd602a7]
"15" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\61e7e666\27e1f7e2]
"17" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\6f06001f\62a6b5be]
"d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\42d76e4d\5b86bed]
"52" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\5fcea75a\57e574f9]
"4c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\368e5e51\5cbefaea]
"58" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\2ef268ac\497c9d44]
"4f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\50a69a2e\491f93ce]
"13" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\42d76e4d\5b86bed\52]
"MVID" = "8F 99 93 D3 EB 4C D3 3D 14 52 15 5F 79 B2 3D 65"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\1a714620\2f0c2e3a]
"1c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\4f0ed0af\4b333e2c]
"3b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\55d78379\3d9f8012]
"6" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\77a2835c\447dbcd8]
"25" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\6087e565\6f05f6e3]
"b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\7e441e10\2807462a]
"1b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\311f1bc6\78ce3965]
"43" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\368e5e51\5cbefaea]
"58" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\1c22df2f\6ae28f47]
"1d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\3693fb48\607100c5]
"2b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\6087e565\6f05f6e3]
"b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\429b0dd8\1d9a9270]
"39" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\70e80e6e\51a1b706]
"28" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\61e7e666\27e1f7e2]
"17" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\3693fb48\607100c5]
"2b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\44ec6d48\74c9f6c5]
"27" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\429b0dd8\1d9a9270]
"39" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\2ef268ac\497c9d44]
"4f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\19a3ab9\9adbb50]
"23" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\368e5e51\5cbefaea]
"58" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\f3eb9d9\49cb8779]
"3a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\5a8de2c3\1dfa8c62]
"45" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\179bc95c\2202b9f5]
"34" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\7f0603e4\ecd2583]
"40" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\6faf58\34f474d5]
"F" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\505c41c7\52a7cb45]
"33" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\561175dc\261d3b7b]
"47" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7940d148\2bfa95e0]
"36" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\4eb53aa8\50e4c026]
"3e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\5149b6c8\70e4f760]
"16" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\5f079895\3e0d252d]
"4e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7a819b88\1229dc20]
"50" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\4f1555b2\4383b32f]
"24" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\57d4b1bf\23a76b5d]
"29" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7dfaa0d2\6ac7e50]
"48" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5b86bed\63ca5c10\5f\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7e441e10\2807462a]
"1b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\159a66b8\5d94bc56]
"10" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\72522657\467dfbf7]
"51" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\545c5dd6\3d40af53]
"3c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\3e5c014b\2933b5e4]
"35" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\19a3ab9\9adbb50]
"23" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\640d09ef\10ac776b]
"e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\46b91004\571609c]
"5" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\6960d6d7\4b18a453]
"3d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\64be1fa4\58364143]
"2a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\212ef70c\701aec8a]
"41" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\226b2009\768ca187]
"14" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\42d76e4d\5b86bed]
"52" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\70e80e6e\51a1b706]
"28" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\72522657\467dfbf7]
"51" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\73320ae2\63e86779]
"4b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\42d76e4d\5b86bed\52]
"ConfigMask" = "4361"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C2 E5 DD C2 9E F3 1A AB 8A 51 6D 2F D7 0C 00 BB"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\179bc95c\2202b9f5]
"34" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\53e01c0b\3aecd0a4]
"38" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\60049528\69f655c0]
"54" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\55d78379\3d9f8012]
"6" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\3d67735\7bda07cc]
"7" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\53ab1129\25acd1c0]
"a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\61e7e666\27e1f7e2]
"17" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\3a50533c\769fc3d5]
"2d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32]
"NIUsageMask" = "FF FF FF FF FF FF FF FF FF FF FF"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\70e80e6e\51a1b706]
"28" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\378d4dc7\3be36366]
"1e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\53775644\6d8a6bc2]
"57" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\561175dc\261d3b7b]
"47" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7ac727df\4c76d55c]
"3" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\5fcea75a\57e574f9]
"4c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\6f06001f\62a6b5be]
"d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\649348ce\60337166]
"2c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\1c22df2f\6ae28f47]
"1d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\212ef70c\701aec8a]
"41" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\3d67735\7bda07cc]
"7" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\3cca06a0\910bc3f]
"4" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\42d76e4d\5b86bed\52]
"ConfigString" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\7e420f89\11c357a1]
"1a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\640d09ef\10ac776b]
"e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\42d76e4d\5b86bed\52]
"NIDependencies" = "C6 38 19 18 42 CA 99 14 01 00 00 00 04 00 00 00"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\505c41c7\52a7cb45]
"33" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\42d76e4d\5b86bed]
"52" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\57d4b1bf\23a76b5d]
"29" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32]
"SystemStoreChangeId" = "227"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\4f0ed0af\4b333e2c]
"3b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\432ba598\2ab76b15]
"2f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\f3eb9d9\49cb8779]
"3a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7e420f89\11c357a1]
"1a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\50a69a2e\491f93ce]
"13" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\53e01c0b\3aecd0a4]
"38" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\2eb0c927\2f6391bf]
"11" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\159a66b8\5d94bc56]
"10" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7ac727df\4c76d55c]
"3" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\3cca06a0\910bc3f]
"4" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\3d67735\7bda07cc]
"7" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\4ed0765e\5d0933fc]
"2e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\2708d9ec\352e0e84]
"18" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\3b9d4dd3\a52a751]
"49" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\5764ec77\5f62750e]
"56" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\179bc95c\2202b9f5]
"34" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\5a8de2c3\1dfa8c62]
"45" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\4f1555b2\4383b32f]
"24" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\6c9a55d4\78d3666c]
"31" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\4d5ecec1\58ac8060]
"9" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\4b235cde\55b9967d]
"12" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\209ced07\2cd602a7]
"15" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7f0603e4\ecd2583]
"40" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\53e01c0b\3aecd0a4]
"38" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\340dcf4c\55b350eb]
"30" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\3e5c014b\2933b5e4]
"35" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\db950d6\2f66e4ee]
"44" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\311f1bc6\78ce3965]
"43" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\340dcf4c\55b350eb]
"30" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\60049528\69f655c0]
"54" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\298818d6\3d37e654]
"26" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\552fa235\a3eaecd]
"4a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\2a8ab4f5\43eec18d]
"55" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\585c020c\7c0832a4]
"37" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\4d5ecec1\58ac8060]
"9" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\1c22df2f\6ae28f47]
"1d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\4eb53aa8\50e4c026]
"3e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\311f1bc6\78ce3965]
"43" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7b7b125f\7b4bfd]
"42" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\5132fda3\47899b1f]
"46" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\2a7f0223\16be2bc2]
"1f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\6eae2d34\566d82b2]
"22" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\64be1fa4\58364143]
"2a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5b86bed\63ca5c10\5f\InvertDependencies\42d76e4d\5b86bed]
"52" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\2a7f0223\16be2bc2]
"1f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\60049528\69f655c0]
"54" = ""

The Trojan deletes the following registry key(s):

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\index56]

The process mscorsvw.exe:2540 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A0 09 A4 BF 3B 35 96 8D CD D9 9F E2 BE 0D 4D C6"

The process mscorsvw.exe:2132 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "62 0C 02 E1 27 90 A4 FC 47 21 73 43 8E 3C 23 62"

The process mscorsvw.exe:1616 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C4 9A A7 02 D0 32 1A 64 39 A3 B8 AA 77 80 5A 52"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:2300 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7D 1B 0A 46 DD 06 A9 59 C6 5F A1 49 92 88 3C D9"

The process mscorsvw.exe:772 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C0 D1 77 B8 C3 EE B4 DE 84 34 87 21 F0 AF BE CB"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:2384 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2A 40 54 8E 3F 15 98 81 A9 35 F4 A5 87 11 D5 44"

The process mscorsvw.exe:572 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3E B5 C5 0A 4A 28 93 0A 7B 6C 2D B1 BF 39 05 BD"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:2240 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E0 12 8C 24 C5 11 57 57 68 E6 AF 29 F3 31 40 3B"

The process mscorsvw.exe:2816 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0E B9 F3 A6 7A 88 CF B6 F0 64 C0 49 2B 7D 5F 0D"

The process mscorsvw.exe:3584 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3C A7 9A B1 3D A1 CC 74 0E 35 18 7E AB 9C E4 06"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:2720 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C8 0D DF 5A FA 7D 3D 4C DE 2E A9 F6 EC C2 5B 79"

The process mscorsvw.exe:3744 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9A 5B 23 5A 70 54 AE 7F 5E 84 50 36 10 A0 DC 5A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:2468 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B9 98 C9 89 A2 A4 5E D6 CE 13 BB EE 4D 83 43 23"

The process mscorsvw.exe:3708 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "34 55 1F 11 DA 98 66 E3 1A AB 17 92 E4 46 71 95"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:3356 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3E 55 BC 9A 2E C5 6A 8B 92 C3 F0 7D A4 B7 11 20"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:1952 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1C 87 5B C3 3D 46 99 85 85 00 DF 08 65 CA 6F 65"

The process mscorsvw.exe:4040 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "29 EF D1 89 EA 52 56 F6 39 67 1A AC 53 7F 81 0D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:2956 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "77 1B DD FD EA 1D 32 66 9A 16 6B CE 80 01 DC 9D"

The process mscorsvw.exe:3640 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AA 91 0C F4 46 59 37 64 AC 1B CE 51 FE F8 56 2D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:1284 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9B EC 5F A2 64 DD 16 7C E1 FE 9D FA 20 EC 69 24"

The process mscorsvw.exe:1044 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "74 A8 7F 02 AC 02 61 53 7E 5B 00 B6 C4 E1 24 88"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:3896 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "22 A1 6E 1C 96 B4 A8 B5 07 F7 86 8A C2 FE AB 9F"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\ListenedState]
"RootstoreDirty" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\State]
"AccumulatedWaitIdleTime" = "0"

The process mscorsvw.exe:3016 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CD 78 0C 31 D7 6B 06 16 7B 24 B2 CE 1C D9 F3 4F"

The process mscorsvw.exe:2672 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "02 6B FE 96 76 01 6D D4 EF 6A 79 02 1E 2C 1D 20"

The process mscorsvw.exe:352 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB 72 75 C8 45 79 E9 4B 93 71 23 83 B7 64 C5 CF"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:3848 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "15 0F 3E 1C D7 81 16 76 3B 0A 97 42 30 54 63 7F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:3532 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D7 83 3C A7 14 41 80 F6 BC 75 DE 74 69 05 27 D8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process %original file name%.exe:1724 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1A AB EB 0E 29 E7 8F C9 41 63 B8 08 4C 97 B4 83"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\RarSFX0]
"idman621f.exe" = "Internet Download Manager installer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\RarSFX0]
"support.exe" = "This installer database contains the logic and data required to install Support."

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process MsiExec.exe:2192 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "29 55 7C CF E3 4D CA 88 53 87 42 E2 EC B9 36 EF"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process MsiExec.exe:2492 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.WorkflowServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Web.DataVisualization,4.0.0.0,,31bf3856ad364e35,MSIL" = "56 B0 3A A0 A8 11 D1 01"
"System.Data.Entity.Design,4.0.0.0,,b77a5c561934e089,MSIL" = "DC 91 79 9F A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=x86\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Workflow.ComponentModel,4.0.0.0,,31bf3856ad364e35,MSIL" = "2E 9F AE A1 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Data.Services.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"Microsoft.Build.Tasks.v4.0,4.0.0.0,,b03f5f7f11d50a3a,MSIL" = "3E D0 DC A0 A8 11 D1 01"
"System.Web.Extensions.Design,4.0.0.0,,31bf3856ad364e35,MSIL" = "E8 AE 59 A0 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Web.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{4B861EBF-6843-416A-9BA8-6BAB08050610}]
"(Default)" = "install System.Windows.Forms.DataVisualization.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{81325DA4-A2B9-46CE-A9BD-7A73BD33FBA9}]
"(Default)" = "install System.Workflow.Runtime, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Web.DynamicData.Design,4.0.0.0,,31bf3856ad364e35,MSIL" = "4E 01 0B A0 A8 11 D1 01"
"System.Xaml.Hosting,4.0.0.0,,31bf3856ad364e35,MSIL" = "36 4E DE A1 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Windows.Forms.DataVisualization.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\PresentationBuildTasks, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Data.OracleClient,4.0.0.0,,b77a5c561934e089,x86" = "F8 DF 87 9F A8 11 D1 01"
"System.Design,4.0.0.0,,b03f5f7f11d50a3a,MSIL" = "0E B6 BE 9F A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\Microsoft.Build.Framework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{5081A45B-FFFB-4484-BC0E-A063C404CB2B}]
"(Default)" = "install System.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a /NoDependencies /queue:1 /nologo /netfxpri1"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{8599635E-E655-46D3-AEEA-CFF0E1233F24}]
"(Default)" = "install System.ServiceModel.ServiceMoniker40, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Web.Entity.Design,4.0.0.0,,b77a5c561934e089,MSIL" = "C4 B1 1B A0 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{7FBD49AE-BAEF-44DB-81C5-65E921E28998}]
"(Default)" = "install System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Drawing.Design,4.0.0.0,,b03f5f7f11d50a3a,MSIL" = "EC EF D8 9F A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\Microsoft.Build, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{F0D6B202-8F47-48B9-ACA9-94CD9741F82E}]
"(Default)" = "install Microsoft.Build.Tasks.v4.0, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"Microsoft.Workflow.Compiler,4.0.0.0,,31bf3856ad364e35,MSIL" = "78 A3 51 A1 A8 11 D1 01"
"System.Data.Services.Design,4.0.0.0,,b77a5c561934e089,MSIL" = "14 2E 96 9F A8 11 D1 01"
"StoreChangeIDFor64BitProcesses" = "166"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{5436CFCD-5A2E-49DF-A30E-163DE766DB88}]
"(Default)" = "install System.Web.Abstractions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"Microsoft.Build.Framework,4.0.0.0,,b03f5f7f11d50a3a,MSIL" = "6E BD C9 A0 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\Microsoft.VisualC.STLCLR, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\Microsoft.Build.Tasks.v4.0, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{34CBD628-D83B-4D82-995D-C0EA70F5551C}]
"(Default)" = "install System.Web.Extensions.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Web.Entity.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{24402CF6-ADBB-478B-A57E-54FCBC978AC8}]
"(Default)" = "install %WinDir%\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Web.Routing,4.0.0.0,,31bf3856ad364e35,MSIL" = "5E 5F 6A A0 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Data.Entity.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{8EE0FF2D-EF3D-4DE3-AAEB-C96B18B5AC71}]
"(Default)" = "install System.Web.DataVisualization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{6B49CD46-9442-4EC7-BC3C-F744392F7A9D}]
"(Default)" = "install System.ServiceModel.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{02AD274F-7EBB-4767-B328-5F9660867A54}]
"(Default)" = "install AspNetMMCExt, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Web.RegularExpressions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Web.Entity,4.0.0.0,,b77a5c561934e089,MSIL" = "86 9D 27 A0 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{A5104A72-86F7-40D8-BCD0-11B537BFFEBE}]
"(Default)" = "install Microsoft.Workflow.Compiler, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"Microsoft.Build,4.0.0.0,,b03f5f7f11d50a3a,MSIL" = "DC BE AA A0 A8 11 D1 01"
"System.ServiceModel.WasHosting,4.0.0.0,,b77a5c561934e089,MSIL" = "B0 3F 6E A1 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{ABB9A98B-1C9A-4CBB-BCC5-8833745DD704}]
"(Default)" = "install Microsoft.Build.Utilities.v4.0, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{7845D75A-B668-40FB-8E40-4FDC41BAFAAA}]
"(Default)" = "install System.Web.DataVisualization.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{0A039F53-BB78-43B4-8B2A-8034CD28A1E9}]
"(Default)" = "install Microsoft.Build.Engine, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{B9743B3C-DA68-48F9-B2EB-6F8CE89D7301}]
"(Default)" = "install System.Workflow.ComponentModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Web.DataVisualization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Workflow.ComponentModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"AspNetMMCExt,4.0.0.0,,b03f5f7f11d50a3a,MSIL" = "84 93 00 A1 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{1D9E33A6-FC41-4B2F-B058-5D8CE6D2FE09}]
"(Default)" = "install System.Workflow.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{35041460-F91F-429E-8B1D-C174A86760D8}]
"(Default)" = "install System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Web.Abstractions,4.0.0.0,,31bf3856ad364e35,MSIL" = "16 65 EE 9F A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\Microsoft.Build.Conversion.v4.0, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{1CC5409A-3CE2-435A-869C-3B4414EC3B20}]
"(Default)" = "install System.WorkflowServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{107D49CA-C6B0-455B-A6DA-5BC3DDC39780}]
"(Default)" = "install System.Web.Mobile, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Data.OracleClient, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=x86\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\Microsoft.Workflow.Compiler, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{72B6E2AD-1847-42E7-8F41-E9825637F060}]
"(Default)" = "install System.Runtime.Caching, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"StoreChangeIDFor32BitProcesses" = "187"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB FB 11 BE 5C AB A0 09 AA 03 82 46 F7 DE 1C FC"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{D09DE84F-CE7A-491E-877F-6449E9514E89}]
"(Default)" = "install System.Web.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Web.DataVisualization.Design,4.0.0.0,,31bf3856ad364e35,MSIL" = "CC 60 4B A0 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Web.Extensions.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Runtime.Caching,4.0.0.0,,b03f5f7f11d50a3a,MSIL" = "C0 43 6B 9F A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{E8C58978-1C4F-481B-A943-2BA052A0BFF3}]
"(Default)" = "install System.Web.Entity, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"XamlBuildTask,4.0.0.0,,31bf3856ad364e35,MSIL" = "AC FE EE A1 A8 11 D1 01"
"StoreChangeID" = "188"
"System.WorkflowServices,4.0.0.0,,31bf3856ad364e35,MSIL" = "1A 00 D0 A1 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Xaml.Hosting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{ECEEFE61-B8A9-40A1-BBF8-D34358338DB5}]
"(Default)" = "install Microsoft.Build, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"Microsoft.Build.Conversion.v4.0,4.0.0.0,,b03f5f7f11d50a3a,MSIL" = "66 0E 9A A0 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.ServiceModel.ServiceMoniker40, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{2E03E10B-ABF3-4348-BA6F-7E45A2A43886}]
"(Default)" = "install XamlBuildTask, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{9A0D2850-13BC-442B-9567-8E14308EC73E}]
"(Default)" = "install System.Data.OracleClient, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Web.DynamicData, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Web.Mobile,4.0.0.0,,b03f5f7f11d50a3a,MSIL" = "8C 42 30 A1 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Web.Entity, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Web,4.0.0.0,,b03f5f7f11d50a3a,x86" = "62 CD 1A A1 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{0B0609B6-17BB-44ED-8E7B-503DB3FABD48}]
"(Default)" = "install PresentationBuildTasks, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Workflow.Activities,4.0.0.0,,31bf3856ad364e35,MSIL" = "5E 8C 9B A1 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{625DE7FC-9162-4EA3-B7C2-156C367EA3F1}]
"(Default)" = "install System.ServiceModel.Activation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{F0A5C196-29CE-4B05-9027-6964C23B2B72}]
"(Default)" = "install System.Web.DynamicData.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{F630FF42-B742-4806-AC55-119EFD8B7182}]
"(Default)" = "install Microsoft.Build.Conversion.v4.0, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{F517B337-E306-4DB6-BCB7-B3DF5E45E8FB}]
"(Default)" = "install System.Web.RegularExpressions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.ServiceModel.Web,4.0.0.0,,31bf3856ad364e35,MSIL" = "E8 DB 8A A1 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{47710961-8CBA-4C7F-A1B6-3D09F0BA62CE}]
"(Default)" = "install System.Web.DynamicData, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.ServiceModel.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.ServiceModel.WasHosting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\Microsoft.Build.Engine, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Workflow.Runtime,4.0.0.0,,31bf3856ad364e35,MSIL" = "A4 4F BF A1 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{A8407368-C2CC-4527-A58B-DA69E3EC60BD}]
"(Default)" = "install Microsoft.Build.Framework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.ServiceModel.Activation,4.0.0.0,,31bf3856ad364e35,MSIL" = "CC 8D 7C A1 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{ABEA4575-7209-4F72-B875-0283B81AB9DB}]
"(Default)" = "install System.Web.Entity.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"Microsoft.Build.Engine,4.0.0.0,,b03f5f7f11d50a3a,MSIL" = "52 6F BB A0 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{16041400-BAA4-4BC6-BB78-95B6A6311B22}]
"(Default)" = "install System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32]
"SystemStoreChangeId" = "187"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Drawing.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"Microsoft.Build.Utilities.v4.0,4.0.0.0,,b03f5f7f11d50a3a,MSIL" = "B4 80 ED A0 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.ServiceModel.Activation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{1A0AE05F-5E03-4DC5-9D6B-DE0363564289}]
"(Default)" = "install System.Xaml.Hosting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Web.Abstractions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Web.DataVisualization.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\XamlBuildTask, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{5F7D2414-D352-417F-896D-46C95DE6B544}]
"(Default)" = "install System.Data.Services.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\AspNetMMCExt, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Web.RegularExpressions,4.0.0.0,,b03f5f7f11d50a3a,MSIL" = "A8 90 3E A1 A8 11 D1 01"
"System.Web.Extensions,4.0.0.0,,31bf3856ad364e35,MSIL" = "D4 0F 7B A0 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Workflow.Runtime, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Runtime.Caching, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"Microsoft.VisualC.STLCLR,2.0.0.0,,b03f5f7f11d50a3a,MSIL" = "A4 F5 5C 9F A8 11 D1 01"
"System.Windows.Forms.DataVisualization.Design,4.0.0.0,,31bf3856ad364e35,MSIL" = "A4 22 8E A0 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Workflow.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{8E2DCDD1-EDCE-468E-B788-9147D39CEB68}]
"(Default)" = "install System.Drawing.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a /NoDependencies /queue:1 /nologo /netfxpri1"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.ServiceModel.ServiceMoniker40,4.0.0.0,,b77a5c561934e089,MSIL" = "94 F1 5F A1 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{1F2828E6-0236-4D6C-A904-E482193265C2}]
"(Default)" = "install System.Data.Entity.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Web.DynamicData,4.0.0.0,,31bf3856ad364e35,MSIL" = "32 B3 FC 9F A8 11 D1 01"
"System.Data.Services,4.0.0.0,,b77a5c561934e089,MSIL" = "30 7C A4 9F A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Web.DynamicData.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"PresentationBuildTasks,4.0.0.0,,31bf3856ad364e35,MSIL" = "C8 4C FD A1 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\Microsoft.Build.Utilities.v4.0, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{E62F1F07-607D-48C1-8A76-41D1A40AEC4B}]
"(Default)" = "install %WinDir%\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Web.Mobile, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{03AA07EE-8EF4-47C6-91B0-587AE8E058FA}]
"(Default)" = "install %WinDir%\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe /NoDependencies /queue:3 /nologo"

The process MsiExec.exe:2732 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "57 BD CE EA B1 F2 10 95 3F 73 BB 13 77 DC CD 2F"

The process ServiceModelReg.exe:2756 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1F 7F 80 05 BD AE 74 C8 96 A4 74 20 AC E8 18 E0"

The process unlodctr.exe:2632 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E0 FF 5B 0F A7 21 21 4E A4 B3 FF 4F 09 39 35 72"

The process mofcomp.exe:3252 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BD 05 40 1D 94 20 1B 8F 0C 8F 86 D1 03 85 11 D7"

[HKLM\SOFTWARE\Microsoft\WBEM\CIMOM]
"Autorecover MOFs timestamp" = "130905280148333750"
"Autorecover MOFs" = "%System%\WBEM\cimwin32.mof, %System%\WBEM\cimwin32.mfl, %System%\WBEM\system.mof, %System%\WBEM\wmipcima.mof, %System%\WBEM\wmipcima.mfl, %System%\WBEM\regevent.mof, %System%\WBEM\regevent.mfl, %System%\WBEM\ntevt.mof, %System%\WBEM\ntevt.mfl, %System%\WBEM\secrcw32.mof, %System%\WBEM\secrcw32.mfl, %System%\WBEM\dsprov.mof, %System%\WBEM\dsprov.mfl, %System%\WBEM\msi.mof, %System%\WBEM\msi.mfl, %System%\WBEM\policman.mof, %System%\WBEM\policman.mfl, %System%\WBEM\subscrpt.mof, %System%\WBEM\wmi.mof, %System%\WBEM\wmi.mfl, %System%\WBEM\scm.mof, %System%\WBEM\fevprov.mof, %System%\WBEM\fevprov.mfl, %System%\WBEM\wmitimep.mof, %System%\WBEM\wmitimep.mfl, %System%\WBEM\wmipdskq.mof, %System%\WBEM\wmipdskq.mfl, %System%\WBEM\wmipicmp.mof0"

The process dotNetFx40_Full_setup.exe:652 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A1 29 EA F1 B4 37 8B F3 13 C0 05 80 46 A1 25 E7"

The process TMP12.tmp.exe:2324 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "97 97 23 C5 18 72 09 D4 B2 E8 34 DC 67 4D F0 74"

The process Autoupdate.exe:3448 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "12 55 13 CE E7 C3 C7 C7 95 9A 2F 2D A5 AB 85 75"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\LocalService\Cookies"
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"

The process ngen.exe:3920 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.Net/Framework/v3.0/WPF/PresentationFontCache.exe\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.DataVisualization.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Abstractions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 9E 00 00 00 57 00 69"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.DynamicData.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.Composition, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"ImageList" = "08 00 00 00 01 4A 51 8B 84 1F 06 EE 4F 07 32 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"ImageList" = "0D 00 00 00 01 01 1F 8E 31 D1 97 B4 CC B6 A6 1C"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"ImageList" = "0C 00 00 00 01 87 A7 13 CE E6 13 D0 8E E0 4A E9"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Mobile, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Extensions.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.DynamicData, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 9E 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 B2 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Priority" = "1"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.Runtime, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Workflow.Compiler, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 A4 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"ImageList" = "05 00 00 00 01 9D F6 1E C7 AA D3 9F E0 BA C8 21"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/MSBuild.exe\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.RegularExpressions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 A4 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 BC 00 00 00 50 00 72"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 9C 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.Net/Framework/v3.0/WPF/PresentationFontCache.exe\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.DynamicData.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/MSBuild.exe\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.Net/Framework/v3.0/WPF/PresentationFontCache.exe\0]
"ImageList" = "08 00 00 00 01 4C E7 FD 62 D4 10 7F BE 99 6A B3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xaml.Hosting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"ImageList" = "04 00 00 00 01 96 4D A0 27 EB CA 3B 26 3A 05 CA"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms.DataVisualization.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Tasks.v4.0, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\AspNetMMCExt, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 C0 00 00 00 50 00 72"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 BC 00 00 00 50 00 72"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.Composition, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 98 00 00 00 6D 00 73"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"ImageList" = "05 00 00 00 01 81 D2 54 0B C1 C1 81 90 D0 43 1D"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Mobile, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"KeepPriority" = "1"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"ImageList" = "08 00 00 00 01 5F 66 9E 81 9D A7 01 0C 1D CA 34"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.OracleClient, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/WsatConfig.exe\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 A4 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 BC 00 00 00 50 00 72"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Activation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/ComSvcConfig.exe\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Framework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.ComponentModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Caching, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\XamlBuildTask, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"ImageList" = "0A 00 00 00 01 17 E0 20 AE 92 D7 FA B3 3B CC 1C"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.ComponentModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms.DataVisualization.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/WsatConfig.exe]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/MSBuild.exe]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.Composition, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Caching, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.DataVisualization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Abstractions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 9E 00 00 00 57 00 69"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.DataVisualization.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"ImageList" = "05 00 00 00 01 C9 8C B6 5A 79 CF CC B4 4E A7 27"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.OracleClient, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.ServiceMoniker40, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Abstractions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 A2 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/ComSvcConfig.exe\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.WorkflowServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Workflow.Compiler, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"ImageList" = "05 00 00 00 01 DD 57 BC 19 F5 80 7C 6D BE 8F 88"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 A8 00 00 00 50 00 72"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Tasks.v4.0, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.Composition, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 CA 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"ImageList" = "0C 00 00 00 01 D1 76 06 E8 13 F0 13 76 BD 0D EF"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Conversion.v4.0, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"ImageList" = "05 00 00 00 01 E9 97 D0 20 0C 25 F7 DB 6B D3 23"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"KeepPriority" = "1"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Engine, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Engine, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"ImageList" = "04 00 00 00 01 BA 0E 3A 22 21 1B A7 34 3E 01 16"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\AspNetMMCExt, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 B2 00 00 00 50 00 72"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"ImageList" = "01 00 00 00 00 02 00 00 00 B2 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 A8 00 00 00 50 00 72"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"ImageList" = "0E 00 00 00 01 C1 E1 6B 40 E3 0A 05 C3 9B E8 AE"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"ImageList" = "05 00 00 00 01 0E 83 AA C3 7B 26 23 F1 A2 4C 70"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.Composition, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"ImageList" = "0B 00 00 00 01 92 CC CE DC 7C DA 41 3F F6 FC 64"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Entity, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"ImageList" = "09 00 00 00 01 35 55 F5 F7 4C 56 FA 92 C0 AB 7A"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Caching, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Entity.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xaml.Hosting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"ImageList" = "06 00 00 00 01 11 A9 CF 08 E5 BB 06 E0 77 0B 2B"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.DataVisualization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Utilities.v4.0, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Entity.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"ImageList" = "09 00 00 00 01 13 31 EE 3A 71 46 21 83 88 53 7A"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationBuildTasks, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.RegularExpressions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.WorkflowServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\XamlBuildTask, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationBuildTasks, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/WsatConfig.exe\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.OracleClient, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Framework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Engine, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Activation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"ImageList" = "05 00 00 00 01 36 C6 CF D5 D4 E8 0D 5C 54 8F 82"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\ListenedState]
"RootstoreDirty" = "1"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Entity, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 C2 00 00 00 50 00 72"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.WorkflowServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.Net/Framework/v3.0/WPF/PresentationFontCache.exe\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"ImageList" = "01 00 00 00 00 02 00 00 00 A2 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 98 00 00 00 6D 00 73"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 B0 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Activation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"ImageList" = "16 00 00 00 01 7F 91 EE CD A3 FF 7C E4 78 14 6B"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Utilities.v4.0, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"ImageList" = "05 00 00 00 01 3F 18 BF F5 10 7C 9A 8A CC AE 6C"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.Net/Framework/v3.0/WPF/PresentationFontCache.exe]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Framework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 9E 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 A8 00 00 00 4D 00 69"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.ComponentModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"ImageList" = "12 00 00 00 01 39 63 E9 CE 8D 44 F5 0E 83 67 E9"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Entity.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 BC 00 00 00 50 00 72"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 B0 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Conversion.v4.0, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"ImageList" = "07 00 00 00 01 71 36 47 B9 87 B1 40 A1 7E 3C 4F"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 C0 00 00 00 50 00 72"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms.DataVisualization.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.Net/Framework/v3.0/WPF/PresentationFontCache.exe\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 9E 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Services.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 9E 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Entity.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.Net/Framework/v3.0/WPF/PresentationFontCache.exe\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Tasks.v4.0, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"ImageList" = "07 00 00 00 01 B9 74 F6 C1 7D 17 A5 33 AD F6 E7"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 A8 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.DynamicData.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 94 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.Composition, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Conversion.v4.0, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 C2 00 00 00 50 00 72"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Extensions.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"ImageList" = "0A 00 00 00 01 3D 8C 79 C4 5A A6 74 E4 3F 07 5E"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\XamlBuildTask, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.Runtime, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Services.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"ImageList" = "09 00 00 00 01 F5 E0 29 E2 21 5C 95 AB 38 A1 EE"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Entity, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.ServiceMoniker40, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Priority" = "1"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"ImageList" = "09 00 00 00 01 01 6F 9A 15 0F CE 0E 0A 4C 93 53"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.Runtime, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 9C 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.Composition, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.DynamicData, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"ImageList" = "0A 00 00 00 01 05 50 3F 37 AE F5 26 1D 80 CC CA"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Services.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"ImageList" = "06 00 00 00 01 07 03 02 14 37 C2 EC 71 21 3A 6B"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Mobile, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"ImageList" = "01 00 00 00 01 32 E6 F7 03 C1 14 F3 A9 71 CB E7"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/ComSvcConfig.exe]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationBuildTasks, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 A8 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Utilities.v4.0, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 94 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Entity.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.DataVisualization.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"ImageList" = "12 00 00 00 01 60 42 1D DA 88 80 0B 14 DC 10 1E"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EE 27 FF 0F 93 C5 24 56 C4 28 46 53 93 EE 45 DB"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.RegularExpressions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"ImageList" = "09 00 00 00 01 04 05 71 D6 5D C8 22 E5 DF 02 0D"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.DynamicData, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 B2 00 00 00 50 00 72"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Entity.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Workflow.Compiler, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.DataVisualization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"ImageList" = "0B 00 00 00 01 B7 64 AE B8 80 06 08 5C 9C C4 20"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.Net/Framework/v3.0/WPF/PresentationFontCache.exe\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 8C 00 00 00 43 00 3A"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"ImageList" = "01 00 00 00 01 24 6F 1A 5A BB 68 6B 9D CD F2 2D"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Extensions.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xaml.Hosting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.Composition, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\AspNetMMCExt, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.ServiceMoniker40, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

The Trojan deletes the following registry key(s):

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{E8C58978-1C4F-481B-A943-2BA052A0BFF3}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{02AD274F-7EBB-4767-B328-5F9660867A54}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{B9743B3C-DA68-48F9-B2EB-6F8CE89D7301}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{625DE7FC-9162-4EA3-B7C2-156C367EA3F1}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.Net/Framework/v3.0/WPF/PresentationFontCache.exe\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.Net/Framework/v3.0/WPF/PresentationFontCache.exe\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{24402CF6-ADBB-478B-A57E-54FCBC978AC8}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{5081A45B-FFFB-4484-BC0E-A063C404CB2B}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{8EE0FF2D-EF3D-4DE3-AAEB-C96B18B5AC71}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{F630FF42-B742-4806-AC55-119EFD8B7182}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{35041460-F91F-429E-8B1D-C174A86760D8}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{1A0AE05F-5E03-4DC5-9D6B-DE0363564289}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{ABEA4575-7209-4F72-B875-0283B81AB9DB}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{2E03E10B-ABF3-4348-BA6F-7E45A2A43886}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{1CC5409A-3CE2-435A-869C-3B4414EC3B20}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{A8407368-C2CC-4527-A58B-DA69E3EC60BD}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{F0D6B202-8F47-48B9-ACA9-94CD9741F82E}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{6B49CD46-9442-4EC7-BC3C-F744392F7A9D}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{0B0609B6-17BB-44ED-8E7B-503DB3FABD48}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{F517B337-E306-4DB6-BCB7-B3DF5E45E8FB}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{A5104A72-86F7-40D8-BCD0-11B537BFFEBE}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{5436CFCD-5A2E-49DF-A30E-163DE766DB88}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{1F2828E6-0236-4D6C-A904-E482193265C2}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{1D9E33A6-FC41-4B2F-B058-5D8CE6D2FE09}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{7FBD49AE-BAEF-44DB-81C5-65E921E28998}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{107D49CA-C6B0-455B-A6DA-5BC3DDC39780}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.Composition, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.Composition, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{81325DA4-A2B9-46CE-A9BD-7A73BD33FBA9}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{ECEEFE61-B8A9-40A1-BBF8-D34358338DB5}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{72B6E2AD-1847-42E7-8F41-E9825637F060}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{16041400-BAA4-4BC6-BB78-95B6A6311B22}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{03AA07EE-8EF4-47C6-91B0-587AE8E058FA}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{0A039F53-BB78-43B4-8B2A-8034CD28A1E9}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{9A0D2850-13BC-442B-9567-8E14308EC73E}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{4B861EBF-6843-416A-9BA8-6BAB08050610}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{7845D75A-B668-40FB-8E40-4FDC41BAFAAA}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{D09DE84F-CE7A-491E-877F-6449E9514E89}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{E62F1F07-607D-48C1-8A76-41D1A40AEC4B}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{5F7D2414-D352-417F-896D-46C95DE6B544}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{8599635E-E655-46D3-AEEA-CFF0E1233F24}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{ABB9A98B-1C9A-4CBB-BCC5-8833745DD704}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{8E2DCDD1-EDCE-468E-B788-9147D39CEB68}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{F0A5C196-29CE-4B05-9027-6964C23B2B72}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{34CBD628-D83B-4D82-995D-C0EA70F5551C}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{47710961-8CBA-4C7F-A1B6-3D09F0BA62CE}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]

The process ngen.exe:3888 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.Net/Framework/v3.0/WPF/PresentationFontCache.exe\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xaml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceProcess, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn.Contract, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Net, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/SMDiagnostics.dll]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Web, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.ServiceModel.dll\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel.Selectors, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v2.0.50727/dfsvc.exe\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Printing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationUI, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/SMSvcHost.exe\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Accessibility, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/Microsoft.Transactions.Bridge.dll\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Input.Manipulations, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.DataAnnotations, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationBuildTasks, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.EnterpriseServices, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.ApplicationServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.ComponentModel, Version=3.0.0.000000, Culture=neutral, PublicKeyToken=31BF3856AD364E35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities.Core.Presentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.Protocols, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClientsideProviders, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Serialization, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/SMSvcHost.exe\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Framework, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationBuildTasks, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities.Core.Presentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.SqlXml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Utilities.v3.5, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Messaging, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Deployment, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/WsatConfig.exe\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Presentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Tasks.v3.5, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities.Presentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Printing, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel.Selectors, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Framework, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel.Selectors, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualC, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IO.Log, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Services, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\CustomMarshalers, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.RegularExpressions, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v2.0.50727/dfsvc.exe\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationTypes, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn.Contract, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.AccountManagement, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\ReachFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/Microsoft.Transactions.Bridge.Dtc.dll\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.RegularExpressions, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.WorkflowServices, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic.Compatibility.Data, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities.DurableInstancing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\SMDiagnostics, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xaml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Transactions, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Mobile, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Management.Instrumentation, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/Microsoft.Transactions.Bridge.Dtc.dll\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\ReachFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.Composition, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.Composition, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Deployment, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Presentation, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationTypes, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Printing, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/Microsoft.Transactions.Bridge.dll]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.ComponentModel, Version=3.0.0.000000, Culture=neutral, PublicKeyToken=31BF3856AD364E35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/SMDiagnostics.dll\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IO.Log, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationTypes, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities.Core.Presentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Numerics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic, Version=8.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Presentation, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Services, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/Microsoft.Transactions.Bridge.dll\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots]
"WorkPending" = "1"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Services.Client, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Mobile, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\AspNetMMCExt, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/dfsvc.exe\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.DataSetExtensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.EnterpriseServices, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Services, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Net, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn.Contract, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic, Version=8.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Remoting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationProvider, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationProvider, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Engine, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Printing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\CustomMarshalers, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xaml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Framework, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Serialization, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClientsideProviders, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/SMSvcHost.exe\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClientsideProviders, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms.DataVisualization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Management.Instrumentation, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Conversion.v3.5, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.SqlXml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Security, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\ReachFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel.Selectors, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.IdentityModel.dll\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsFormsIntegration, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.Runtime, Version=3.0.0.000000, Culture=neutral, PublicKeyToken=31BF3856AD364E35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Accessibility, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.IdentityModel.dll\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic.Activities.Compiler, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Printing, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/ComSvcConfig.exe\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Channels, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/dfsvc.exe]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Tasks.v3.5, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceProcess, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Utilities.v3.5, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Extensions.Design, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Transactions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.Composition, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsFormsIntegration, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Speech, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IO.Log, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.DataAnnotations, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Discovery, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Input.Manipulations, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\ReachFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\CustomMarshalers, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\CustomMarshalers, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Deployment, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/SMDiagnostics.dll\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/ServiceModelReg.exe\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Accessibility, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/Microsoft.Transactions.Bridge.Dtc.dll]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualC, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Serialization.Formatters.Soap, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities.Presentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Framework, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Serialization.Formatters.Soap, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xaml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClient, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Tasks, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Speech, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Management.Instrumentation, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge.Dtc, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Serialization.Formatters.Soap, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClientsideProviders, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Printing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.RegularExpressions, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Speech, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Serialization, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Speech, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationTypes, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/SMSvcHost.exe\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.DataAnnotations, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.5/MSBuild.exe]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/WsatConfig.exe\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.Activities, Version=3.0.0.000000, Culture=neutral, PublicKeyToken=31BF3856AD364E35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Tasks, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Serialization, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IO.Log, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Device, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/SMSvcHost.exe]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Accessibility, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.DurableInstancing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.5/MSBuild.exe\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationTypes, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.RegularExpressions, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Printing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn.Contract, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Device, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.SqlXml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Engine, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Speech, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClientsideProviders, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Presentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.DurableInstancing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Web, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Services.Client, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Entity, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Deployment, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationUI, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.5/MSBuild.exe\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.AccountManagement, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Configuration.Install, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.EnterpriseServices, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Transactions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Presentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Remoting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Utilities, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Channels, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/ComSvcConfig.exe\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/ServiceModelReg.exe\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\SMDiagnostics, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.ComponentModel, Version=3.0.0.000000, Culture=neutral, PublicKeyToken=31BF3856AD364E35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Net, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic.Compatibility.Data, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Utilities, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.Runtime, Version=3.0.0.000000, Culture=neutral, PublicKeyToken=31BF3856AD364E35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/Microsoft.Transactions.Bridge.Dtc.dll\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.DataSetExtensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Management.Instrumentation, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.DurableInstancing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge.Dtc, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.IdentityModel.dll\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge.Dtc, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.DataSetExtensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Presentation, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\CustomMarshalers, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/ServiceModelReg.exe\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic.Activities.Compiler, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Conversion.v3.5, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.Protocols, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities.Core.Presentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.Runtime, Version=3.0.0.000000, Culture=neutral, PublicKeyToken=31BF3856AD364E35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Numerics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Mobile, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel.Selectors, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Management.Instrumentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationTypes, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Engine, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.Runtime.Serialization.dll\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Messaging, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/WsatConfig.exe]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Engine, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\CustomMarshalers, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Channels, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.IdentityModel.dll]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationProvider, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Entity, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.5/MSBuild.exe\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Numerics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn.Contract, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IO.Log, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn.Contract, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.AccountManagement, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\SMDiagnostics, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.DataSetExtensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Device, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClient, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Security, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Accessibility, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms.DataVisualization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Engine, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Discovery, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Management.Instrumentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.AccountManagement, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Accessibility, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Transactions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Extensions.Design, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Printing, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceProcess, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.AccountManagement, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.Activities, Version=3.0.0.000000, Culture=neutral, PublicKeyToken=31BF3856AD364E35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Tasks.v3.5, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge.Dtc, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic.Activities.Compiler, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Utilities, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.IdentityModel.Selectors.dll\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.WorkflowServices, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel.Selectors, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.WorkflowServices, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IO.Log, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.Protocols, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.IO.Log.dll\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClient, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClientsideProviders, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\ListenedState]
"RootstoreDirty" = "1"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Entity, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/Microsoft.Transactions.Bridge.dll\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.EnterpriseServices, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge.Dtc, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Deployment, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.ApplicationServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationUI, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCFFRasterizer, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsFormsIntegration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.Net/Framework/v3.0/WPF/PresentationFontCache.exe\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationProvider, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge.Dtc, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Management.Instrumentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Management.Instrumentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClient, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Tasks.v3.5, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\CustomMarshalers, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Numerics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v2.0.50727/dfsvc.exe\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationUI, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\AspNetMMCExt, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Speech, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Channels, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Speech, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationProvider, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/ComSvcConfig.exe\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/SMSvcHost.exe\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.SqlXml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Web, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Net, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Input.Manipulations, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Input.Manipulations, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClient, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic.Activities.Compiler, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/dfsvc.exe\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsFormsIntegration, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms.DataVisualization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Conversion.v3.5, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.Net/Framework/v3.0/WPF/PresentationFontCache.exe]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IO.Log, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Mobile, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/ServiceModelReg.exe]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationTypes, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.WorkflowServices, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.AccountManagement, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Deployment, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Configuration.Install, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.IdentityModel.Selectors.dll\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.Runtime.Serialization.dll\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationUI, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Speech, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\SMDiagnostics, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Net, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.Protocols, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic.Compatibility, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.DataSetExtensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Framework, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/WsatConfig.exe\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Security, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Transactions, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Extensions.Design, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClient, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.DataAnnotations, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn.Contract, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.DataSetExtensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.IO.Log.dll\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.AccountManagement, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities.Presentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/dfsvc.exe\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClientsideProviders, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationUI, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Discovery, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Presentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualC, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms.DataVisualization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities.Presentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Framework, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationProvider, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Framework, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Accessibility, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Transactions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.Activities, Version=3.0.0.000000, Culture=neutral, PublicKeyToken=31BF3856AD364E35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.Protocols, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.DataSetExtensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.DurableInstancing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.Protocols, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Utilities.v3.5, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge.Dtc, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Messaging, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.ServiceModel.dll]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge.Dtc, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Engine, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.Runtime.Serialization.dll\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/SMSvcHost.exe\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities.DurableInstancing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCFFRasterizer, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.IdentityModel.Selectors.dll]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Transactions, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\ReachFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\AspNetMMCExt, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Net, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic, Version=8.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/ComSvcConfig.exe]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.Activities, Version=3.0.0.000000, Culture=neutral, PublicKeyToken=31BF3856AD364E35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel.Selectors, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Engine, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationProvider, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Configuration.Install, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\ReachFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsFormsIntegration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Engine, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationBuildTasks, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v2.0.50727/dfsvc.exe]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClient, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic.Compatibility.Data, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Deployment, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.Protocols, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.ComponentModel, Version=3.0.0.000000, Culture=neutral, PublicKeyToken=31BF3856AD364E35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.Runtime, Version=3.0.0.000000, Culture=neutral, PublicKeyToken=31BF3856AD364E35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationUI, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsFormsIntegration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Net, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Messaging, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IO.Log, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\CustomMarshalers, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\ReachFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.Net/Framework/v3.0/WPF/PresentationFontCache.exe\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AD 09 45 F2 E6 D6 89 CA 58 2C E5 73 F4 A7 13 42"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.Protocols, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic, Version=8.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic.Compatibility, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Services.Client, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Configuration.Install, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Web, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCFFRasterizer, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Accessibility, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.ServiceModel.dll\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.ServiceModel.dll\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Services.Client, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceProcess, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Deployment, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic.Compatibility, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.IO.Log.dll\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel.Selectors, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/SMDiagnostics.dll\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn.Contract, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Extensions.Design, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities.DurableInstancing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/SMSvcHost.exe]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Tasks, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Net, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCFFRasterizer, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Utilities.v3.5, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationTypes, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\ReachFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic.Compatibility, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Serialization.Formatters.Soap, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationBuildTasks, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.ApplicationServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\AspNetMMCExt, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Presentation, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.AccountManagement, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Device, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClient, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Security, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Transactions, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Entity, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.ApplicationServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsFormsIntegration, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Remoting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.Composition, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.IdentityModel.Selectors.dll\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.IO.Log.dll]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Discovery, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Conversion.v3.5, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Framework, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic.Compatibility.Data, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Utilities, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClientsideProviders, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Services, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualC, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Tasks, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities.DurableInstancing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.Runtime.Serialization.dll]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsFormsIntegration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.DataSetExtensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationUI, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Remoting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationProvider, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

Dropped PE files

MD5 File path
53406e9988306cbd4537677c5336aba4 c:\Documents and Settings\"%CurrentUserName%"\Application Data\Adobe\Support\prerequisites\.NET Framework 4.0\dotNetFx40_Full_setup.exe
ffd68bdede50e5d9d90aacd63cd2404a c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM1.tmp
ce284454c16cd202961bd4a7f1ff105d c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM100.tmp
c03ef8e3d7e432d7f4fd515e75ce18fb c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM106.tmp
d1a1bac3f04a71fdbbcae5c2a3203bb6 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM3.tmp
50c2e62660c7c1d26c60d320cc61f8a6 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM35.tmp
12f5582eeef2464f90f37d288fe8a159 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM36.tmp
8733245b8d7a0038f46f65f945584e6f c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM39.tmp
bd95e822e7a958bbca842d078426a151 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM40.tmp
eafda5be5899d806afde417f71d43a1c c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM45.tmp
48db4bfce6f3476dfa6602546f5fb5d4 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM46.tmp
019ab25686601f42444208fefc86bc59 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM49.tmp
311db28045536889fc0fd43148c1921f c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM5.tmp
075c68f408d8d810e85122e334e6dbbb c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM52.tmp
d4805fb81d30b128eb081750885a31dd c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM53.tmp
22ece0bc222b54ca73ae37d7a65ea93f c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM54.tmp
4c1a8b0cdc3454b8817997520d5304bd c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM55.tmp
b9f719b572d8d440dd8b5401c35b3b6f c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM56.tmp
9d5901b51ffee8766db7d34fa1ed232c c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM57.tmp
9472a0184e75c8733d9faf8c20e867b4 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM66.tmp
ac822be8ffb08e7ea2ad573b9f87ea71 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM67.tmp
b06190af451b2037ff075aeb5d21e26f c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM68.tmp
07a5f2043bab61711f1c955f61df70d6 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM69.tmp
8c6af35602856595601f3cffc70317d8 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM7.tmp
c976ceb4be1daf3a848c11a4adf224ba c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM71.tmp
ded9ec09a15757005bae4d7e39cdf6a8 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM72.tmp
aea0323e45bcfce6fe396cb6463e948b c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM73.tmp
3b2574a4bcaab325288db198e4b9cae6 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM8.tmp
0df73b628afb86410d7a03cd3b3794a8 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM88.tmp
090a189f4eeb3c0b76e97acdb1a71c92 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM92.tmp
50542c90567698cb0c0c02f71eebea60 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM94.tmp
35b62b395968b7754c298fbb410e9821 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1025\SetupResources.dll
7c136b92983cec25f85336056e45f3e8 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1028\SetupResources.dll
62876c2fe28b1b5c434b9fad80abe9f9 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1029\SetupResources.dll
9f0cd8981979154cc2a6393da42731c5 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1030\SetupResources.dll
7c9ae49b3a400c728a55dd1cacc8ffb2 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1031\SetupResources.dll
e663b67a66adf9375d1d183ca5fdd23d c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1032\SetupResources.dll
9547d24ac04b4d0d1dbf84f74f54faf7 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1033\SetupResources.dll
881adf55d51976ca592033a7adf620b8 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1035\SetupResources.dll
93f57216fe49e7e2a75844edfccc2e09 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1036\SetupResources.dll
06cc83e6c677db13757df4242f5679f7 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1037\SetupResources.dll
c1bf3d63576d619b24837b72986dfad4 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1038\SetupResources.dll
e4860fc5d4c114d5c0781714f3bf041a c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1040\SetupResources.dll
278fd7595b580a016705d00be363612f c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1041\SetupResources.dll
fcfd69ec15a6897a940b0435439bf5fc c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1042\SetupResources.dll
76d6e9f15d842e6a56ee42c9c5ccabca c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1043\SetupResources.dll
bacea57a781c43738a3b065103479bb5 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1044\SetupResources.dll
550c79640eee713c73eb67b0736a92e6 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1045\SetupResources.dll
86cb58f2b6bc1174d200d0abe5497233 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1046\SetupResources.dll
7ef74af6ab5760950a1d233c582099f1 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1049\SetupResources.dll
28813510b82f45868b5bdc67fff9c9fa c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1053\SetupResources.dll
357a1cbf08a83e657ffae8639ac1212a c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1055\SetupResources.dll
407cdb7e1c2c862b486cde45f863ae6e c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2052\SetupResources.dll
58cb55fa4d9e2f62f675720b1269137d c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2070\SetupResources.dll
7c136b92983cec25f85336056e45f3e8 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3076\SetupResources.dll
b057315a8c04df29b7e4fd2b257b75f4 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3082\SetupResources.dll
006f8a615020a4a17f5e63801485df46 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Setup.exe
84c1daf5f30ff99895ecab3a55354bcf c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupEngine.dll
eb881e3dddc84b20bd92abcec444455f c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupUi.dll
8dfbb95989af28058c7431704ce7cd66 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupUtility.exe
3f0363b40376047eff6a9b97d633b750 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\sqmapi.dll
9fef3c3da45fa856d9ec0da6fde9af6b c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\1033\FileTrackerUI.dll
ac055c2bf56886ca96042fcde2d722da c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\AspNetMMCExt.dll
f4e9693f449600a30088a0b16079f3cd c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\Aspnet_perf.dll
26a196cf6a37cc9834a2ca9b3d1b34ff c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe
e544e3f91c08f428cf6b760dbd5ff01f c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe
cc5bb3c28d24acde026493a7b31d7b06 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe
fd9f17a461322f0dc8e40c42b4bbdaff c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\FileTracker.dll
4498209a4aede645a257d641d9946271 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
dbe5f7b95d15ce1e8fec589e2be7048a c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\Microsoft.Build.Conversion.v4.0.dll
8933c2a4df165ea7127e8e60f66cbd22 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\Microsoft.Build.Engine.dll
711f010517dd19571386a5a681b2a2b6 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\Microsoft.Build.Framework.dll
9adf90088ac811f0902131d45cc50cd1 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll
a6384603a99f24faf7bc364d841a21ff c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\Microsoft.Build.Utilities.v4.0.dll
e6d36a05a5544122395aeb305d5f4fc0 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\Microsoft.Build.dll
2d717cdcaf0cddf6f46ed6383cf0e268 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\Microsoft.Data.Entity.Build.Tasks.dll
0c3dce64502a7034a7046a9858376377 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\Microsoft.VisualC.STLCLR.dll
e3a48a1de8670112323b47225a9bc19d c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe
4c35454ccda6fbddcf64301a63058149 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\MmcAspExt.dll
e75731a59119aeda27ba4d52117c7570 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\ServiceMonikerSupport.dll
35b62b395968b7754c298fbb410e9821 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1025\SetupResources.dll
7c136b92983cec25f85336056e45f3e8 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1028\SetupResources.dll
62876c2fe28b1b5c434b9fad80abe9f9 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1029\SetupResources.dll
9f0cd8981979154cc2a6393da42731c5 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1030\SetupResources.dll
7c9ae49b3a400c728a55dd1cacc8ffb2 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1031\SetupResources.dll
e663b67a66adf9375d1d183ca5fdd23d c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1032\SetupResources.dll
9547d24ac04b4d0d1dbf84f74f54faf7 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1033\SetupResources.dll
881adf55d51976ca592033a7adf620b8 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1035\SetupResources.dll
93f57216fe49e7e2a75844edfccc2e09 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1036\SetupResources.dll
06cc83e6c677db13757df4242f5679f7 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1037\SetupResources.dll
c1bf3d63576d619b24837b72986dfad4 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1038\SetupResources.dll
e4860fc5d4c114d5c0781714f3bf041a c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1040\SetupResources.dll
278fd7595b580a016705d00be363612f c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1041\SetupResources.dll
fcfd69ec15a6897a940b0435439bf5fc c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1042\SetupResources.dll
76d6e9f15d842e6a56ee42c9c5ccabca c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1043\SetupResources.dll
bacea57a781c43738a3b065103479bb5 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1044\SetupResources.dll
550c79640eee713c73eb67b0736a92e6 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1045\SetupResources.dll
86cb58f2b6bc1174d200d0abe5497233 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1046\SetupResources.dll
7ef74af6ab5760950a1d233c582099f1 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1049\SetupResources.dll
28813510b82f45868b5bdc67fff9c9fa c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1053\SetupResources.dll
357a1cbf08a83e657ffae8639ac1212a c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1055\SetupResources.dll
407cdb7e1c2c862b486cde45f863ae6e c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2052\SetupResources.dll
58cb55fa4d9e2f62f675720b1269137d c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2070\SetupResources.dll
7c136b92983cec25f85336056e45f3e8 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3076\SetupResources.dll
b057315a8c04df29b7e4fd2b257b75f4 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3082\SetupResources.dll
006f8a615020a4a17f5e63801485df46 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Setup.exe
84c1daf5f30ff99895ecab3a55354bcf c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\SetupEngine.dll
eb881e3dddc84b20bd92abcec444455f c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\SetupUi.dll
8dfbb95989af28058c7431704ce7cd66 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\SetupUtility.exe
3f0363b40376047eff6a9b97d633b750 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\sqmapi.dll
9738fd0238ee4a0832f2a9d4cf69a71a c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Data.Entity.Design.dll
1f398290f4de7b00bccc4dddc193e2d5 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Data.OracleClient.dll
59e3a44249d12758566b9a58c28faec0 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Data.Services.Design.dll
65bbc872e434ff876ab82046cb108c35 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Data.Services.dll
927ee51ae8a5a7666fa0eb0fb9cfb8e1 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Design.dll
da1309d96adb0276985d7acf1dc77c5a c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Drawing.Design.dll
dc0995d3745e11a58264f6bb69702d8c c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Runtime.Caching.dll
09fca625eb5152001aa99b1b1d404382 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.Activation.dll
5e837c27c062ac913e83ad8d49046a96 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.ServiceMoniker40.dll
71864eb9b9b48e6c8d33bfcd123ed465 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.WasHosting.dll
013265dba4d8b6c8c48456902887d515 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.Web.dll
a10dba25feb4c4d816df6ee66840097a c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Web.Abstractions.dll
d9a9f1100f7748b57de453f8667e8dfe c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Web.DataVisualization.Design.dll
f43f36ded8f0dabc95191e0563483fdf c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Web.DataVisualization.dll
ad5657238bfca2a5eede44dab576a877 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Web.DynamicData.Design.dll
4bb5ce66e9f6190ac45a34ba4a460bf2 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Web.DynamicData.dll
9f47605fa58b9d87003ec77c158f38df c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Web.Entity.Design.dll
82f4a38b85c9cb91cd9f10f2f60f22d6 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Web.Entity.dll
c408b912eee4cbbc19fe4b0de272e1b8 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Web.Extensions.Design.dll
4a67e924531d4a58cc7eb33116718858 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Web.Extensions.dll
000176f11ebcf4c256090ee8bdbfadb9 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Web.Mobile.dll
9cdd5c9237d10a8c02860235873aea35 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Web.RegularExpressions.dll
0cd550d02f084d8fd63a26fc94e50c6b c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Web.Routing.dll
cb32cd6955cefc73da2725d570315915 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Web.dll
292734a187736dcd0f96e093586f0f41 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Web.tlb
05e072292a6fb43abcd3e492bcc1bd65 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Windows.Forms.DataVisualization.Design.dll
d5494339252dc11b351084102a1572b0 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Workflow.Activities.dll
a85830d2bfc21f220e7b084899be3f70 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Workflow.ComponentModel.dll
0bdf0abedc0270775b027e7b44807578 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Workflow.Runtime.dll
6f317f21781e7d5914d9a1e8f52b4f84 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.WorkflowServices.dll
e9b6dfeda771c5c9aeaa54bc05627d31 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Xaml.Hosting.dll
431fb33c3a5797238c7d98ca4a4b4060 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\TLBREF.DLL
c5a38fd6f3706a9a12d3557324799652 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationBuildTasks.dll
83cf5753e1c680e5a9245f8e3b177354 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe
a94969a8f7fdd2f12f630638fec1580a c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\XamlBuildTask.dll
a3779c23ecf454b1b280ed251ee0cd5b c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
9b609463552d4413b4e37c9f0870f386 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_filter.dll
7aa67f809b29d42af1723ae9d8b2c9f5 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll
51df5aa2fb9ce29ca9b386889a5262c5 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_rc.dll
eac6e98872921ac26f51822de7217d31 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
9a53baa8684f1b21ee8ba37b0f8a67a9 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
e5883f29a90fc5bb9e6e7aa3c469c103 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe
776acefa0ca9df0faa51a5fb2f435705 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
3e5969dd217a142017bd8a8841c2d68c c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
1a3d6725fe85ae298b002b776eb5db10 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
da312ef6ca9fb3768063bd801ff38a00 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsn.dll
386b17250a9fa30a3346134627e80e64 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\peverify.dll
534fc93a10ec3bc2d045f1228fa758d5 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\webengine.dll
b5ff5ca778284cdc758502282d7eacf3 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\webengine4.dll
1f398290f4de7b00bccc4dddc193e2d5 c:\WINDOWS\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
cb32cd6955cefc73da2725d570315915 c:\WINDOWS\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll
ac055c2bf56886ca96042fcde2d722da c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\AspNetMMCExt\v4.0_4.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
dbe5f7b95d15ce1e8fec589e2be7048a c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Conversion.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Conversion.v4.0.dll
8933c2a4df165ea7127e8e60f66cbd22 c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Engine\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
711f010517dd19571386a5a681b2a2b6 c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
9adf90088ac811f0902131d45cc50cd1 c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Tasks.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.v4.0.dll
a6384603a99f24faf7bc364d841a21ff c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Utilities.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.v4.0.dll
e6d36a05a5544122395aeb305d5f4fc0 c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.dll
0c3dce64502a7034a7046a9858376377 c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\v4.0_2.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.STLCLR.dll
e3a48a1de8670112323b47225a9bc19d c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe
c5a38fd6f3706a9a12d3557324799652 c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\PresentationBuildTasks\v4.0_4.0.0.0__31bf3856ad364e35\PresentationBuildTasks.dll
9738fd0238ee4a0832f2a9d4cf69a71a c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity.Design\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Entity.Design.dll
59e3a44249d12758566b9a58c28faec0 c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Design\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Services.Design.dll
65bbc872e434ff876ab82046cb108c35 c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Services.dll
927ee51ae8a5a7666fa0eb0fb9cfb8e1 c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Design\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Design.dll
da1309d96adb0276985d7acf1dc77c5a c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Drawing.Design\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
dc0995d3745e11a58264f6bb69702d8c c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Caching\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Caching.dll
09fca625eb5152001aa99b1b1d404382 c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Activation\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Activation.dll
5e837c27c062ac913e83ad8d49046a96 c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.ServiceMoniker40\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.ServiceMoniker40.dll
71864eb9b9b48e6c8d33bfcd123ed465 c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.WasHosting\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.WasHosting.dll
013265dba4d8b6c8c48456902887d515 c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Web\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Web.dll
a10dba25feb4c4d816df6ee66840097a c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Web.Abstractions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Abstractions.dll
d9a9f1100f7748b57de453f8667e8dfe c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Web.DataVisualization.Design\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.DataVisualization.Design.dll
f43f36ded8f0dabc95191e0563483fdf c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Web.DataVisualization\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.DataVisualization.dll
ad5657238bfca2a5eede44dab576a877 c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Web.DynamicData.Design\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.DynamicData.Design.dll
4bb5ce66e9f6190ac45a34ba4a460bf2 c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Web.DynamicData\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.DynamicData.dll
9f47605fa58b9d87003ec77c158f38df c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Web.Entity.Design\v4.0_4.0.0.0__b77a5c561934e089\System.Web.Entity.Design.dll
82f4a38b85c9cb91cd9f10f2f60f22d6 c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Web.Entity\v4.0_4.0.0.0__b77a5c561934e089\System.Web.Entity.dll
c408b912eee4cbbc19fe4b0de272e1b8 c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions.Design\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.Design.dll
4a67e924531d4a58cc7eb33116718858 c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll
000176f11ebcf4c256090ee8bdbfadb9 c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Web.Mobile\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
9cdd5c9237d10a8c02860235873aea35 c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Web.RegularExpressions\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
0cd550d02f084d8fd63a26fc94e50c6b c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Web.Routing\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Routing.dll
05e072292a6fb43abcd3e492bcc1bd65 c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.DataVisualization.Design\v4.0_4.0.0.0__31bf3856ad364e35\System.Windows.Forms.DataVisualization.Design.dll
d5494339252dc11b351084102a1572b0 c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.Activities\v4.0_4.0.0.0__31bf3856ad364e35\System.Workflow.Activities.dll
a85830d2bfc21f220e7b084899be3f70 c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.ComponentModel\v4.0_4.0.0.0__31bf3856ad364e35\System.Workflow.ComponentModel.dll
0bdf0abedc0270775b027e7b44807578 c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.Runtime\v4.0_4.0.0.0__31bf3856ad364e35\System.Workflow.Runtime.dll
6f317f21781e7d5914d9a1e8f52b4f84 c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.WorkflowServices\v4.0_4.0.0.0__31bf3856ad364e35\System.WorkflowServices.dll
e9b6dfeda771c5c9aeaa54bc05627d31 c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Xaml.Hosting\v4.0_4.0.0.0__31bf3856ad364e35\System.Xaml.Hosting.dll
a94969a8f7fdd2f12f630638fec1580a c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\XamlBuildTask\v4.0_4.0.0.0__31bf3856ad364e35\XamlBuildTask.dll
e3a48a1de8670112323b47225a9bc19d c:\WINDOWS\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5\Microsoft.Workflow.Compiler.exe
6222a4d7dd7a7a4a74f51c712221ccd3 c:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Design\95a46d4775428acf5dd84f12aaa9f06f\System.Design.ni.dll
b4929eb9cb46d2c344801106ed3f07f2 c:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Drawing.Desi#\8f9993d3eb4cd33d1452155f79b23d65\System.Drawing.Design.ni.dll
add7a08e7016694fe1c73dd7498dead6 c:\WINDOWS\system32\aspnet_counters.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 165203 165376 4.66056 0d2680623ee21ef164d1e5badd4a9069
.rdata 172032 20307 20480 3.70974 11d309e79376f3aea13d40c8fca6dd3e
.data 192512 137468 5632 2.40524 599cdae4e964b67335324e67538c2a9c
.rsrc 331776 15196 15360 3.27307 71d84148ffe09e6fc955019e614b777d

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://a1363.dscg.akamai.net/pki/crl/products/tspca.crl
hxxp://e11290.dspg.akamaiedge.net/fwlink/?LinkId=164166&clcid=0x409
hxxp://e3673.dspg.akamaiedge.net/download/6/7/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/NETFX/windows6.0-kb956250-v6001-x86.msu
hxxp://a1363.dscg.akamai.net/pki/crl/products/microsoftrootcert.crl
hxxp://a1363.dscg.akamai.net/pki/crl/products/CodeSigPCA.crl
hxxp://a1363.dscg.akamai.net/pki/crl/products/MicrosoftTimeStampPCA.crl
hxxp://e11290.dspg.akamaiedge.net/fwlink/?LinkId=164169&clcid=0x409
hxxp://e3673.dspg.akamaiedge.net/download/6/7/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/NETFX/windows6.1-kb958488-v6001-x86.msu
hxxp://e11290.dspg.akamaiedge.net/fwlink/?LinkId=164186&clcid=0x409
hxxp://e3673.dspg.akamaiedge.net/download/6/7/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/NETFX/netfx_extendedcab.exe
hxxp://e11290.dspg.akamaiedge.net/fwlink/?LinkId=164180&clcid=0x409
hxxp://e3673.dspg.akamaiedge.net/download/6/7/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/NETFX/netfx_extended_x86.msi
hxxp://crl.microsoft.com/pki/crl/products/tspca.crl 212.30.134.182
hxxp://download.microsoft.com/download/6/7/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/NETFX/windows6.1-kb958488-v6001-x86.msu 23.64.236.73
hxxp://download.microsoft.com/download/6/7/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/NETFX/netfx_extended_x86.msi 23.64.236.73
hxxp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl 212.30.134.182
hxxp://go.microsoft.com/fwlink/?LinkId=164186&clcid=0x409 23.64.230.120
hxxp://go.microsoft.com/fwlink/?LinkId=164169&clcid=0x409 23.64.230.120
hxxp://download.microsoft.com/download/6/7/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/NETFX/windows6.0-kb956250-v6001-x86.msu 23.64.236.73
hxxp://crl.microsoft.com/pki/crl/products/CodeSigPCA.crl 212.30.134.182
hxxp://download.microsoft.com/download/6/7/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/NETFX/netfx_extendedcab.exe 23.64.236.73
hxxp://go.microsoft.com/fwlink/?LinkId=164166&clcid=0x409 23.64.230.120
hxxp://tonghopgia.net/WebServiceGoogleSearch.asmx 42.112.31.59
hxxp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl 212.30.134.182
hxxp://go.microsoft.com/fwlink/?LinkId=164180&clcid=0x409 23.64.230.120
google.com 216.58.209.206


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST /WebServiceGoogleSearch.asmx HTTP/1.1
Content-Type: text/xml; charset=utf-8
SOAPAction: "hXXp://tempuri.org/checkVersion"
Host: tonghopgia.net
Content-Length: 243
Expect: 100-continue
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

<s:Envelope xmlns:s="hXXp://schemas.xmlsoap.org/soap/envelope/"><s:Body><checkVersion xmlns="hXXp://tempuri.org/" xmlns:i="hXXp://VVV.w3.org/2001/XMLSchema-instance"><versionCurrent>1.0.0.3</versionCurrent></checkVersion></s:Body></s:Envelope>
HTTP/1.1 100 Continue
HTTP/1.1 100 Continue..



HEAD /fwlink/?LinkId=164166&clcid=0x409 HTTP/1.1
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/6.7
Host: go.microsoft.com
Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily
Cache-Control: private
Content-Length: 238
Content-Type: text/html; charset=utf-8
Expires: Wed, 28 Oct 2015 17:45:20 GMT
Location: hXXp://download.microsoft.com/download/6/7/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/NETFX/windows6.0-kb956250-v6001-x86.msu
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 28 Oct 2015 17:46:20 GMT
Connection: keep-alive
HTTP/1.1 302 Moved Temporarily..Cache-Control: private..Content-Length
: 238..Content-Type: text/html; charset=utf-8..Expires: Wed, 28 Oct 20
15 17:45:20 GMT..Location: hXXp://download.microsoft.com/download/6/7/
F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/NETFX/windows6.0-kb956250-v6001
-x86.msu..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4.0.30319..X-Po
wered-By: ASP.NET..Date: Wed, 28 Oct 2015 17:46:20 GMT..Connection: ke
ep-alive......


GET /fwlink/?LinkId=164166&clcid=0x409 HTTP/1.1


Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/6.7
Host: go.microsoft.com
Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily
Cache-Control: private
Content-Type: text/html; charset=utf-8
Expires: Wed, 28 Oct 2015 17:45:20 GMT
Location: hXXp://download.microsoft.com/download/6/7/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/NETFX/windows6.0-kb956250-v6001-x86.msu
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Length: 238
Date: Wed, 28 Oct 2015 17:46:21 GMT
Connection: keep-alive
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://downl
oad.microsoft.com/download/6/7/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/
NETFX/windows6.0-kb956250-v6001-x86.msu">here</a>.</h2>
..</body></html>..HTTP/1.1 302 Moved Temporarily..Cache-Co
ntrol: private..Content-Type: text/html; charset=utf-8..Expires: Wed, 
28 Oct 2015 17:45:20 GMT..Location: hXXp://download.microsoft.com/down
load/6/7/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/NETFX/windows6.0-kb956
250-v6001-x86.msu..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4.0.30
319..X-Powered-By: ASP.NET..Content-Length: 238..Date: Wed, 28 Oct 201
5 17:46:21 GMT..Connection: keep-alive..<html><head><ti
tle>Object moved</title></head><body>..<h2>
Object moved to <a href="hXXp://download.microsoft.com/download/6/7
/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/NETFX/windows6.0-kb956250-v600
1-x86.msu">here</a>.</h2>..</body></html>..
....


HEAD /fwlink/?LinkId=164169&clcid=0x409 HTTP/1.1


Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/6.7
Host: go.microsoft.com
Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily
Cache-Control: private
Content-Length: 238
Content-Type: text/html; charset=utf-8
Expires: Wed, 28 Oct 2015 17:45:22 GMT
Location: hXXp://download.microsoft.com/download/6/7/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/NETFX/windows6.1-kb958488-v6001-x86.msu
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 28 Oct 2015 17:46:22 GMT
Connection: keep-alive
....


GET /fwlink/?LinkId=164169&clcid=0x409 HTTP/1.1


Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/6.7
Host: go.microsoft.com
Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily
Cache-Control: private
Content-Type: text/html; charset=utf-8
Expires: Wed, 28 Oct 2015 17:45:22 GMT
Location: hXXp://download.microsoft.com/download/6/7/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/NETFX/windows6.1-kb958488-v6001-x86.msu
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Length: 238
Date: Wed, 28 Oct 2015 17:46:22 GMT
Connection: keep-alive
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://downl
oad.microsoft.com/download/6/7/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/
NETFX/windows6.1-kb958488-v6001-x86.msu">here</a>.</h2>
..</body></html>..HTTP/1.1 302 Moved Temporarily..Cache-Co
ntrol: private..Content-Type: text/html; charset=utf-8..Expires: Wed, 
28 Oct 2015 17:45:22 GMT..Location: hXXp://download.microsoft.com/down
load/6/7/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/NETFX/windows6.1-kb958
488-v6001-x86.msu..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4.0.30
319..X-Powered-By: ASP.NET..Content-Length: 238..Date: Wed, 28 Oct 201
5 17:46:22 GMT..Connection: keep-alive..<html><head><ti
tle>Object moved</title></head><body>..<h2>
Object moved to <a href="hXXp://download.microsoft.com/download/6/7
/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/NETFX/windows6.1-kb958488-v600
1-x86.msu">here</a>.</h2>..</body></html>..
....


HEAD /fwlink/?LinkId=164186&clcid=0x409 HTTP/1.1


Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/6.7
Host: go.microsoft.com
Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily
Cache-Control: private
Content-Length: 226
Content-Type: text/html; charset=utf-8
Expires: Wed, 28 Oct 2015 17:45:23 GMT
Location: hXXp://download.microsoft.com/download/6/7/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/NETFX/netfx_extendedcab.exe
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 28 Oct 2015 17:46:23 GMT
Connection: keep-alive
....


GET /fwlink/?LinkId=164186&clcid=0x409 HTTP/1.1


Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/6.7
Host: go.microsoft.com
Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily
Cache-Control: private
Content-Type: text/html; charset=utf-8
Expires: Wed, 28 Oct 2015 17:45:23 GMT
Location: hXXp://download.microsoft.com/download/6/7/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/NETFX/netfx_extendedcab.exe
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Length: 226
Date: Wed, 28 Oct 2015 17:46:23 GMT
Connection: keep-alive
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://downl
oad.microsoft.com/download/6/7/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/
NETFX/netfx_extendedcab.exe">here</a>.</h2>..</body&
gt;</html>..HTTP/1.1 302 Moved Temporarily..Cache-Control: priva
te..Content-Type: text/html; charset=utf-8..Expires: Wed, 28 Oct 2015 
17:45:23 GMT..Location: hXXp://download.microsoft.com/download/6/7/F/6
7F8030F-2EB0-44F0-A533-63C1AC3BA719/NETFX/netfx_extendedcab.exe..Serve
r: Microsoft-IIS/8.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.N
ET..Content-Length: 226..Date: Wed, 28 Oct 2015 17:46:23 GMT..Connecti
on: keep-alive..<html><head><title>Object moved</
title></head><body>..<h2>Object moved to <a hr
ef="hXXp://download.microsoft.com/download/6/7/F/67F8030F-2EB0-44F0-A5
33-63C1AC3BA719/NETFX/netfx_extendedcab.exe">here</a>.</h2
>..</body></html>......


HEAD /fwlink/?LinkId=164180&clcid=0x409 HTTP/1.1


Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/6.7
Host: go.microsoft.com
Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily
Cache-Control: private
Content-Length: 227
Content-Type: text/html; charset=utf-8
Expires: Wed, 28 Oct 2015 17:45:32 GMT
Location: hXXp://download.microsoft.com/download/6/7/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/NETFX/netfx_extended_x86.msi
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 28 Oct 2015 17:46:32 GMT
Connection: keep-alive
....


GET /fwlink/?LinkId=164180&clcid=0x409 HTTP/1.1


Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/6.7
Host: go.microsoft.com
Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily
Cache-Control: private
Content-Type: text/html; charset=utf-8
Expires: Wed, 28 Oct 2015 17:45:32 GMT
Location: hXXp://download.microsoft.com/download/6/7/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/NETFX/netfx_extended_x86.msi
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Length: 227
Date: Wed, 28 Oct 2015 17:46:32 GMT
Connection: keep-alive
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://downl
oad.microsoft.com/download/6/7/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/
NETFX/netfx_extended_x86.msi">here</a>.</h2>..</body
></html>..HTTP/1.1 302 Moved Temporarily..Cache-Control: priv
ate..Content-Type: text/html; charset=utf-8..Expires: Wed, 28 Oct 2015
 17:45:32 GMT..Location: hXXp://download.microsoft.com/download/6/7/F/
67F8030F-2EB0-44F0-A533-63C1AC3BA719/NETFX/netfx_extended_x86.msi..Ser
ver: Microsoft-IIS/8.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP
.NET..Content-Length: 227..Date: Wed, 28 Oct 2015 17:46:32 GMT..Connec
tion: keep-alive..<html><head><title>Object moved<
;/title></head><body>..<h2>Object moved to <a 
href="hXXp://download.microsoft.com/download/6/7/F/67F8030F-2EB0-44F0-
A533-63C1AC3BA719/NETFX/netfx_extended_x86.msi">here</a>.<
/h2>..</body></html>....



HEAD /download/6/7/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/NETFX/windows6.0-kb956250-v6001-x86.msu HTTP/1.1
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/6.7
Connection: Keep-Alive
Host: download.microsoft.com


HTTP/1.1 200 OK
Content-Length: 850644
Content-Type: application/octet-stream
Last-Modified: Sat, 05 Dec 2009 06:18:10 GMT
Accept-Ranges: bytes
ETag: "9e10eb87275ca1:0"
Server: Microsoft-IIS/8.5
Content-Disposition: attachment
Date: Wed, 28 Oct 2015 17:46:20 GMT
Connection: keep-alive
HTTP/1.1 200 OK..Content-Length: 850644..Content-Type: application/oct
et-stream..Last-Modified: Sat, 05 Dec 2009 06:18:10 GMT..Accept-Ranges
: bytes..ETag: "9e10eb87275ca1:0"..Server: Microsoft-IIS/8.5..Content-
Disposition: attachment..Date: Wed, 28 Oct 2015 17:46:20 GMT..Connecti
on: keep-alive......


GET /download/6/7/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/NETFX/windows6.0-kb956250-v6001-x86.msu HTTP/1.1


Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/6.7
Connection: Keep-Alive
Host: download.microsoft.com


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Sat, 05 Dec 2009 06:18:10 GMT
Accept-Ranges: bytes
ETag: "9e10eb87275ca1:0"
Server: Microsoft-IIS/8.5
Content-Disposition: attachment
Content-Length: 850644
Date: Wed, 28 Oct 2015 17:46:21 GMT
Connection: keep-alive
MSCF............D....................................................w
........h;XV .WSUSSCAN.cab..y...w....h;.V .Windows6.0-KB956250-x86.cab
...],....CKM..TT..5<3.00...CHK...34......AB......Di..i...[Ri....~..
......n.s....~.....j.(.....W............ ..............._......h......
......7Kk'K{[!kK ..i..*.......................!fL....E.5E..rpi4.....|.
.-.f.B.........Q....b..6.o._..O.eNZ}..d6..H.....j.&....._.....v.Ej...6
c..%J:.X...6.D....J..>. ..K.....#...ji..>..l0...B.z......a....0.
U...v..x........".T...^~l...#.....a.;}U..._..jMp..Fv..xp...f &..V....u
3x.>.N.6...Tx.|.5/X.>....u.$*J $..v.[\q...`Z...g..'0.L..W.|U..&Z
..F...*.[.S.d.t)j.w..C.P....\.o.....cU\`..F}3.a.#..h.MyBJ. ...o.6.C..N
]._...Pq..9B..SB(5o.{......a{-F\..b.....%.t.........]5......Oy!a.TN.Q.
A#...*....{.._..........]...#..>C.h...].3..N...3.._S..\*3..I..>)
F...4....?r$.....bF..]..'.....J=....v3..p.....x[g.QP.E.........X..s%op
.JZ.. .dr..H9.....>.O!.^........O.d..a...F..>3........g..b....c.
Z=}...}i.'ab.|A.....r.t,T4.....y.M.=.Y..=..1..d.-........r.....B..z..:
..-......-.u.,.R...t...i.D.*S-WM.K.:...r....I.....f..9J.b3.)....;u....
..('[email protected].,<{&....YLm.].._^.../6....Z..E.Z [email protected] e.....o[.
..D...{.,....E...........n...P.p.....j.....K..c6<..cU.X.... k Cg..P
....t..C.e...........6....#A%|.Llu#...p..1.X.lx...2...1S..\..?]83.'.x^
.......Z.....~.7.<..4.g8.I...U{]......>{...u.1K...g}8u[.).f...X.
g..W.=...0........,B...........!.E_..?..a!....t...f.]&.e.....&G~..7b..
..W.....N.`m._..t.Kk3.Y-....F.CT.{_..em...J.Q.........:.E_X....*..
<<< skipped >>>

HEAD /download/6/7/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/NETFX/windows6.1-kb958488-v6001-x86.msu HTTP/1.1


Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/6.7
Connection: Keep-Alive
Host: download.microsoft.com


HTTP/1.1 200 OK
Content-Length: 849830
Content-Type: application/octet-stream
Last-Modified: Thu, 11 Feb 2010 03:37:03 GMT
Accept-Ranges: bytes
ETag: "a29c187acbaaca1:0"
Server: Microsoft-IIS/8.5
Content-Disposition: attachment
Date: Wed, 28 Oct 2015 17:46:22 GMT
Connection: keep-alive
HTTP/1.1 200 OK..Content-Length: 849830..Content-Type: application/oct
et-stream..Last-Modified: Thu, 11 Feb 2010 03:37:03 GMT..Accept-Ranges
: bytes..ETag: "a29c187acbaaca1:0"..Server: Microsoft-IIS/8.5..Content
-Disposition: attachment..Date: Wed, 28 Oct 2015 17:46:22 GMT..Connect
ion: keep-alive......


GET /download/6/7/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/NETFX/windows6.1-kb958488-v6001-x86.msu HTTP/1.1


Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/6.7
Connection: Keep-Alive
Host: download.microsoft.com


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Thu, 11 Feb 2010 03:37:03 GMT
Accept-Ranges: bytes
ETag: "a29c187acbaaca1:0"
Server: Microsoft-IIS/8.5
Content-Disposition: attachment
Content-Length: 849830
Date: Wed, 28 Oct 2015 17:46:22 GMT
Connection: keep-alive
MSCF............D....................................................k
........<<.| .WSUSSCAN.cab......k....<<u| .Windows6.1-KB95
8488-x86.cab...........<<o} .Windows6.1-KB958488-x86.xml.k......
...<<o} .Windows6.1-KB958488-x86-pkgProperties.txt..3......CKE.c
.0M.&:.m..m..m..m..;.m.s.s..nv4..".:.....U..../...... .............Q..
...}0...o..wB...&....oxx.|........M........X.0.....b...^....w.v.D7.Q. 
)....~l5(.......Z.-.-h..U-..i.!.4....E..B...>........w....S.D.... 7
..AD.....F6...Cu3.2.-4.......4.=..c.5....k5V..............[..d........
;...O....."[email protected]...<.|..>. ...'[email protected]. ..Yt. .`@..._..f.......
........................./...H ....{#..UD.T/..L.;.:.ar.u...D..N...%...
....;....k..=<.Q.....z.Cn].T.y.8..].H.......h.&.Vs."......."...f...
.R H....X.k?.......|]u.......R.e..1.)^}..L......n. n......Mb...$.F.?..
.AJ..6..R"..J.2".=.}..w.sSr.}.d....dp$...9....o.p3W..u...*5....\..%.D.
9..z"..F........B...S...*._y.]...fl...t. ....&...=..........:-.!...T.g
.K..>....z.Ax..nt..N......).9B......aTt...Y6S. ._.2..B7..l(..M.9.@a
....B%/...a>U..C..(h.9....w.G.)....b...<,........;..S.....'z...'
'.2"..G.....^.......Mh.....}.......E..6X...P.z..] gT...... ..?.~.~.[..
.u.....Y..P3.X..o....qS....1ra.."..t...?^.>\:r>..#l..NZ..5......
.omn.l......`/Mxu.3$.....>..... .~f..1.8.....a.............87....L.
.wG.....C.S...&:p,.XGr..,.6/p$d&IZ.{...Igz../o%..<OM.#.......=.=.U.
.,Q....q........>.'pE..:f!..E.o....vu..g....Pr..3.Nn....$~.]...AS..
. !.[.p.....,..a........!.XjX..W-...Wl...` V.<V.D|I.M......nMm.
<<< skipped >>>

HEAD /download/6/7/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/NETFX/netfx_extendedcab.exe HTTP/1.1


Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/6.7
Connection: Keep-Alive
Host: download.microsoft.com


HTTP/1.1 200 OK
Content-Length: 7360560
Content-Type: application/octet-stream
Last-Modified: Fri, 19 Mar 2010 00:05:47 GMT
Accept-Ranges: bytes
ETag: "cf502dedf7c6ca1:0"
Server: Microsoft-IIS/8.5
Content-Disposition: attachment
Date: Wed, 28 Oct 2015 17:46:23 GMT
Connection: keep-alive
HTTP/1.1 200 OK..Content-Length: 7360560..Content-Type: application/oc
tet-stream..Last-Modified: Fri, 19 Mar 2010 00:05:47 GMT..Accept-Range
s: bytes..ETag: "cf502dedf7c6ca1:0"..Server: Microsoft-IIS/8.5..Conten
t-Disposition: attachment..Date: Wed, 28 Oct 2015 17:46:23 GMT..Connec
tion: keep-alive......


GET /download/6/7/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/NETFX/netfx_extendedcab.exe HTTP/1.1


Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/6.7
Connection: Keep-Alive
Host: download.microsoft.com


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Fri, 19 Mar 2010 00:05:47 GMT
Accept-Ranges: bytes
ETag: "cf502dedf7c6ca1:0"
Server: Microsoft-IIS/8.5
Content-Disposition: attachment
Content-Length: 7360560
Date: Wed, 28 Oct 2015 17:46:24 GMT
Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$............}...}..
.}...,...}.......}.......}...//..}.../...}.../...}.......}...}...}...,
 ..}...,/..}...,...}...,...}...,...}..Rich.}..........................
PE..L......J.........."..........^....................@...............
...........@......._p...@...... [email protected]...........
.............8p.`.......l....................................V..@.....
.......................................text...........................
.... ..`[email protected].............
..............@[email protected]...............................@[email protected]...(..
.....*[email protected]..........................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................([email protected]...|...
....................................*...:...N...b...p...............r.
..X... ...H.......................r...Z...@...(.......................
................................................0...F...`...v.........
.........................."...2...H...`...n...........................
........(...2...>...P...\...l...x..................................
.....*...>...L...\...p...|............................... ...,.
<<< skipped >>>

HEAD /download/6/7/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/NETFX/netfx_extended_x86.msi HTTP/1.1


Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/6.7
Connection: Keep-Alive
Host: download.microsoft.com


HTTP/1.1 200 OK
Content-Length: 495616
Content-Type: application/octet-stream
Last-Modified: Thu, 18 Mar 2010 23:55:17 GMT
Accept-Ranges: bytes
ETag: "4ffef75f6c6ca1:0"
Server: Microsoft-IIS/8.0
Content-Disposition: attachment
Date: Wed, 28 Oct 2015 17:46:32 GMT
Connection: keep-alive
HTTP/1.1 200 OK..Content-Length: 495616..Content-Type: application/oct
et-stream..Last-Modified: Thu, 18 Mar 2010 23:55:17 GMT..Accept-Ranges
: bytes..ETag: "4ffef75f6c6ca1:0"..Server: Microsoft-IIS/8.0..Content-
Disposition: attachment..Date: Wed, 28 Oct 2015 17:46:32 GMT..Connecti
on: keep-alive......


GET /download/6/7/F/67F8030F-2EB0-44F0-A533-63C1AC3BA719/NETFX/netfx_extended_x86.msi HTTP/1.1


Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/6.7
Connection: Keep-Alive
Host: download.microsoft.com


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Thu, 18 Mar 2010 23:55:17 GMT
Accept-Ranges: bytes
ETag: "4ffef75f6c6ca1:0"
Server: Microsoft-IIS/8.5
Content-Disposition: attachment
Content-Length: 495616
Date: Wed, 28 Oct 2015 17:46:32 GMT
Connection: keep-alive
........................>..........................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................."..............
......... ...!.......#...$...%...&...'...(...)...*... ...,...-......./
...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?
...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P..
.Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b
...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s..
.t...u...v...w...x...y...z...{...|...}...~...........R.o.o.t. .E.n.t.r
.y....................................................................
........F.........................W........S.u.m.m.a.r.y.I.n.f.o.r.m.a
.t.i.o.n...........................(...'..............................
.................$...@.......@H.?.C.A.E.D1H...........................
......................................................................
[email protected].;;B&F7B.B4FhD&B...............................
...............................................................@..
<<< skipped >>>


POST /WebServiceGoogleSearch.asmx HTTP/1.1
Content-Type: text/xml; charset=utf-8
SOAPAction: "hXXp://tempuri.org/checkVersion"
Host: tonghopgia.net
Content-Length: 243
Expect: 100-continue
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

<s:Envelope xmlns:s="hXXp://schemas.xmlsoap.org/soap/envelope/"><s:Body><checkVersion xmlns="hXXp://tempuri.org/" xmlns:i="hXXp://VVV.w3.org/2001/XMLSchema-instance"><versionCurrent>1.0.0.3</versionCurrent></checkVersion></s:Body></s:Envelope>
HTTP/1.1 100 Continue
HTTP/1.1 100 Continue..HTTP/1.1 200 OK..Cache-Control: private, max-ag
e=0..Content-Type: text/xml; charset=utf-8..Content-Encoding: gzip..Va
ry: Accept-Encoding..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.
30319..X-Powered-By: ASP.NET..Date: Wed, 28 Oct 2015 17:47:19 GMT..Con
tent-Length: 305...............`.I.%&/m.{.J.J..t...`[email protected]#)
.*..eVe]f.@......{....{....;.N'...?\fd.l..J...!....?~|.?".....ez..MQ-?
.hw..Q./...X^|...=.>...8z.T.....2/.U.. ...>...y......L.."k...>
;.W..].r7...~...k.........7......{...5....M.-..{kv.[.).O....c.h..'ed..
fU-.E.Bj..j]...^.......^...F..}...c..........l.|l...HTTP/1.1 200 OK..C
ache-Control: private, max-age=0..Content-Type: text/xml; charset=utf-
8..Content-Encoding: gzip..Vary: Accept-Encoding..Server: Microsoft-II
S/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Wed, 
28 Oct 2015 17:47:19 GMT..Content-Length: 305...............`.I.%&/m.{
.J.J..t...`[email protected]#).*..eVe]f.@......{....{....;.N'...?\fd.l.
.J...!....?~|.?".....ez..MQ-?.hw..Q./...X^|...=.>...8z.T.....2/.U..
 ...>...y......L.."k...>.W..].r7...~...k.........7......{...5...
.M.-..{kv.[.).O....c.h..'ed..fU-.E.Bj..j]...^.......^...F..}...c......
....l.|l.....



GET /pki/crl/products/tspca.crl HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: crl.microsoft.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache


HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Sat, 24 May 2014 05:04:54 GMT
Accept-Ranges: bytes
ETag: "8ab194b3d77cf1:0"
Server: Microsoft-IIS/8.0
VTag: 791337642300000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Content-Length: 521
Cache-Control: max-age=900
Date: Wed, 28 Oct 2015 17:46:09 GMT
Connection: keep-alive
0...0.....0...*.H........0y1.0...U....US1.0...U....Washington1.0...U..
..Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Timestam
ping PCA..140514201017Z..440513202154Z.A0?0...U.#..0...o.N?..4.K......
;AC..0... .....7.......0...U......)0...*.H..............*..6k..s...e".
x(........C..L......rE/^......m....t.....I^.W.. ........`.Qa....V.c.3o
A.....7.w...>.)...[IeO!.lm.....8`.v....Y.......z?.......n).~.:....\
.l>.J.I2.17>.*...tl9.C.z."..BP..N. ..0....H......J?...>XF.G..
...@....".Y..V.].?.7..7`.7...r...~.3..c..4.HTTP/1.1 200 OK..Content-Ty
pe: application/pkix-crl..Last-Modified: Sat, 24 May 2014 05:04:54 GMT
..Accept-Ranges: bytes..ETag: "8ab194b3d77cf1:0"..Server: Microsoft-II
S/8.0..VTag: 791337642300000000..P3P: CP="ALL IND DSP COR ADM CONo CUR
 CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE 
PUR UNI"..X-Powered-By: ASP.NET..Content-Length: 521..Cache-Control: m
ax-age=900..Date: Wed, 28 Oct 2015 17:46:09 GMT..Connection: keep-aliv
e..0...0.....0...*.H........0y1.0...U....US1.0...U....Washington1.0...
U....Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Times
tamping PCA..140514201017Z..440513202154Z.A0?0...U.#..0...o.N?..4.K...
...;AC..0... .....7.......0...U......)0...*.H..............*..6k..s...
e".x(........C..L......rE/^......m....t.....I^.W.. ........`.Qa....V.c
.3oA.....7.w...>.)...[IeO!.lm.....8`.v....Y.......z?.......n).~.:..
..\.l>.J.I2.17>.*...tl9.C.z."..BP..N. ..0....H......J?...>XF.
G.....@....".Y..V.].?.7..7`.7...r...~.3..c..4.....
<<< skipped >>>

GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1


Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: crl.microsoft.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache


HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Sun, 23 Aug 2015 05:00:45 GMT
Accept-Ranges: bytes
ETag: "7e1557ab60ddd01:0"
Server: Microsoft-IIS/8.5
VTag: 279369258200000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Content-Length: 813
Cache-Control: max-age=900
Date: Wed, 28 Oct 2015 17:46:22 GMT
Connection: keep-alive
0..)0......0...*.H........0_1.0.....&...,d....com1.0.....&...,d....mic
rosoft1-0 ..U...$Microsoft Root Certificate Authority..150822204833Z..
151121090833Z0.0...a......../..100208014912Z._0]0...U.#..0......`@V'..
%..*..S.Y..0... .....7.......0...U...... 0... .....7......151120205833
Z0...*.H.............f....I...P...n..r.'}X].u..Cn...Y......J...?.s....
....S.8..g.2.D.&0.}.,.....o...5O..."s...j.(r..%@..O`..&.nA..W/..y.f..t
^...X..BF..b..K{..|Jo.\....J..(.#o.). @..|rK.5.........~.O.......~...D
.UT...P.."x}x.C.M.........[tm$2. ...LOR...8.[[email protected]..&
gt;$.....IKU/.Va.......B.........T}o.. ..).d...W..fJ!S.'..N...Cr.^u&;.
...hm.|.....B>......T..N...b........{.....`[email protected][3..I....
......>....Z{.M....U.f.}y.8..iy...%.....W-..aU....{.}..#.4.,...).d.
.>..jM|`[email protected]] [email protected].......


GET /pki/crl/products/CodeSigPCA.crl HTTP/1.1


Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: crl.microsoft.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache


HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Sun, 13 Sep 2015 05:01:06 GMT
Accept-Ranges: bytes
ETag: "cbc45432e1edd01:0"
Server: Microsoft-IIS/8.5
VTag: 791784058200000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Content-Length: 597
Cache-Control: max-age=900
Date: Wed, 28 Oct 2015 17:46:22 GMT
Connection: keep-alive
0..Q0..9...0...*.H........0y1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Code Si
gning PCA..150912163239Z..151212045239Z0 0)..a.\......5..091029235355Z
0.0...U........_0]0...U.#..0...WEt.]...C...T-.2..H.0... .....7.......0
...U......\0... .....7......151211164239Z0...*.H..................\Z."
m=.6.)..[E27...../......) ...f.....l....(8....p.Ap...$...{'..;B.;..w.{
.e.2\c,3.f.S....L.. ..x0..^...wj.....f...6JA^I;.u....G....7..K.......@
..v..."..dx.d......O..%..........`.._{..(B.3..l.:%...N. %oGr....%..xr|
.x............Q!.0..........d...^{N......


GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1


Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: crl.microsoft.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache


HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Mon, 19 Oct 2015 05:00:50 GMT
Accept-Ranges: bytes
ETag: "6cb92202bad11:0"
Server: Microsoft-IIS/8.5
VTag: 279261025900000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Content-Length: 550
Cache-Control: max-age=900
Date: Wed, 28 Oct 2015 17:46:22 GMT
Connection: keep-alive
0.."0......0...*.H........0w1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1!0...U....Microsoft Time-St
amp PCA..151018211629Z..160117093629Z._0]0...U.#..0...#[email protected].. .
.5..0... .....7.......0...U......50... .....7......160116212629Z0...*.
H..................h.h...1e...ld.q....].89....Q.k....f.l&s..[2%4..=.8.
...v2.=......eh..^,S.4K.P.........l....4.l....".%.5r\....`.[..... 3..}
p.}.,.Yz...4m..i...0.z.T. ..=..H.R!.......z.2..a[.d...D...OP...}s....t
-.mE.CP...=.....jd..!..u..oY.]...J.....ka}.e....On..GJ...&7.HTTP/1.1 2
00 OK..Content-Type: application/pkix-crl..Last-Modified: Mon, 19 Oct 
2015 05:00:50 GMT..Accept-Ranges: bytes..ETag: "6cb92202bad11:0"..Serv
er: Microsoft-IIS/8.5..VTag: 279261025900000000..P3P: CP="ALL IND DSP 
COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT 
NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Content-Length: 550..
Cache-Control: max-age=900..Date: Wed, 28 Oct 2015 17:46:22 GMT..Conne
ction: keep-alive..0.."0......0...*.H........0w1.0...U....US1.0...U...
.Washington1.0...U....Redmond1.0...U....Microsoft Corporation1!0...U..
..Microsoft Time-Stamp PCA..151018211629Z..160117093629Z._0]0...U.#..0
...#[email protected].. ..5..0... .....7.......0...U......50... .....7......
160116212629Z0...*.H..................h.h...1e...ld.q....].89....Q.k..
..f.l&s..[2%4..=.8....v2.=......eh..^,S.4K.P.........l....4.l....".%.5
r\....`.[..... 3..}p.}.,.Yz...4m..i...0.z.T. ..=..H.R!.......z.2..a[.d
...D...OP...}s....t-.mE.CP...=.....jd..!..u..oY.]...J.....ka}.e...
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

IDM1.tmp_1760:

.text
.rdata
@.data
.rsrc
PSSht
PSSh|
SShX*A
PSSSSSSh!
COMCTL32.dll
SHDeleteKeyW
SHLWAPI.dll
GetWindowsDirectoryW
GetProcessHeap
KERNEL32.dll
MsgWaitForMultipleObjects
EnumWindows
ExitWindowsEx
USER32.dll
RegOpenKeyExW
RegEnumKeyW
RegQueryInfoKeyW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
ADVAPI32.dll
ShellExecuteExW
ShellExecuteW
SHELL32.dll
ole32.dll
OLEAUT32.dll
MSVCRT.dll
_wcmdln
webHancer
New.net
\StringFileInfo\xx\FileVersion
%sLanguages\%s
%sIDM*.*
%sLanguages\inst_*.lng
version="1.0.0.0"
name="Tonec.IDM.Uninstall"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
<requestedExecutionLevel level="requireAdministrator" uiAccess="false"/>
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
-<6^>~>^:]6]6<2<2=6=6<2
91%2%s-
%XRp1
)<6]:~:~>~>}:}>
-V%U)
%S-q-
-w%U!3
1%S)S)
[?_?___?[
52%s-'
%S)t)S)
%s1t1
[>_?_?_?___?[
^.JsRWNR-
!%%%)%)%-
__[?[____
2_*_*_*_*
!r%3%u!
>{:[:|>;6
696:6:6:6;6;6[6[6[6[6[6\6\6[6\6[6;6
%t%s!S!R!R!R!S!s%s%
Q!R%s%s)
0!0!0!Q!S%R%s)
!V)x%x)
4%V)4!U%U%
2<6]6]6]6\6\6|6|:
.:2;6]:~>
2:6;6\:}:
>|>|:[::6
%u%u!u!U!3
12%u1
fceb7191-46c6-4fb2-bc5f-a10317cd4b1a
fc21ec12-91cc-4546-8ce9-0fea34ce5ad9
f1b17826-2437-4a4d-a9d0-97ee5c76c164
db47a145-d5cc-424d-885d-7a305ebc25b0
d177c6d9-1454-476c-bcc3-1195d036d6e0
cf2d8c1d-bb0e-4cdc-9e97-3cc6da9f48c7
cb6498f3-91f5-4e72-bdd3-35e5a6dc6d5f
851aba31-d661-4825-a37f-5bd0faeb4d88
80993b9b-0cd0-4b2d-864c-88151c635fe5
77e27bc6-988a-4b45-bdf1-85a8928f86ea
6528e7db-f86d-4398-a3df-abf0e7b70aa2
64a72197-bda2-449e-ba78-8e0335442661
205801ea-84b1-4085-b818-b1c6fb567bd7
179619ba-deeb-4436-abaf-82eeaf2f3816
144323b7-20c3-4b5f-b2a5-1cd0d6996dbc
02c1811b-6b25-416a-aca8-dc671d68056d
00645ccd-b777-44a2-9b36-1fb3f423b559
NPIDMan2.dll
NPIDMan1.dll
%sNP_IDM%d.dll
{0055C089-8582-441B-A0BF-17B458C2A3A8}
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
rIDMShellExt.dll
%s\IDMShellExt.dll
regsvr32.exe
/u /s IDMShellExt64.dll
/u /s "%s\IDMShellExt64.dll"
IDMan.exe
MozillaFirebird.exe
Mozilla.exe
SOFTWARE\FullCircle\TalkBack\%s
Software\Microsoft\Windows\CurrentVersion\Run
Software\Opera Software
MozillaFirebird
mozilla
Opera
firefox
SOFTWARE\mozilla.org\Mozilla
Mozilla
sporder.dll
\idmmbc.dll
Wrpcrt4.dll
%s%s\
%s\settings.bak
%s%sDMCache\%s
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
%s%sDMCache
fceb7191-46c6-4fb2-bc5f-000000000000
%s%sIDMShellExt.dll
/s "%s%sIDMShellExt64.dll"
%s %s
RUNDLL32.EXE
Sysnative\RUNDLL32.EXE
%s%sIDMIntegrator64.exe
SETUPAPI.DLL,InstallHinfSection DefaultUninstall 128 %s
SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 %s
idmtdi.inf
idmtdi32.sys
idmwfp.inf
%s%s%s
idmwfp32.sys
\\.\IDMTDI
\\.\IDMWFP
net.exe
%s\%s
idmmbc.dll
avwebgrd
setup_error.log
Internet Download Manager.lnk
%s.lnk
%s\%s\
IDMSetup2.log
Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
WVERSION.dll
%s%s%i.tmp
%s%i%s
IDM0.tmp
IDMNetMon64.dll
IDMNetMon.dll
\WinInit.Ini
Error ID: %s
%s. %s Error ID=%s
%s. Error ID=%s
It is necessary to install IDM to "%s" folder.
"%s"?
Please select "Tasks->Exit" (or "URL->Exit" for old versions) menu item in the main IDM window to close Internet Download Manager before proceeding.
The "Access denied" error occurred while copying main IDM executable file into the specified location!
Cannot install main IDM executable file! The installation cannot be continued.
Do not cancel Windows dialog of copying files
Windows will not be able to register all IDM components in folder
"%s".
An unknown error occurred while removing IDM integration from web browsers!
An unknown error occurred while removing IDM integration from %s browser. You may need to delete %s file manually
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\
%sProgram Files\%s
SOFTWARE\Microsoft\Windows\CurrentVersion
{59FB2056-D625-48D0-A944-1A85B5AB2640}
CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\Implemented Categories
idmBroker.exe
Software\Mozilla
/s "%s\downlWithIDM64.dll"
/s "%s\IDMGetAll64.dll"
/s "%s\IDMIECC64.dll"
%s\idmfsa.dll
%s\downlWithIDM.dll
%s\IDMIECC.dll
%s\IDMGetAll.dll
%s\IDManTypeInfo.tlb
SOFTWARE\Classes\AppID\%s
AppID\%s
CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}
{AC746233-E9D3-49CD-862F-068F7B7CCCA4}
IDMan.CIDMLinkTransmitter
Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{F6E1B27E-F2DA-4919-9DBD-CAB90A1D662B}
IEMonitor.exe
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}
"%s" /rtr%s%s%s%s
/rbmsg
/setlngid %d
/setlngid %d /fulllngfile %s
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
<DEL%s
Could not create/open registry key
%s%i="%s\
IDM2.tmp
Kernel32.DLL
VDMDBG.DLL
PSAPI.DLL
idman.exe
{7D11E719-FF90-479C-B0D7-96EB43EE55D7}
https\
http\
IEGetVL2.htm
IEGetVL.htm
IEGetAll.htm
IEExt.htm
https
%s%sGoogle\Chrome\User Data\Default\Extensions\jmolcgpienlcieaajfkkdamlngancncm
SOFTWARE\Google\Chrome\Extensions
Software\Mozilla\SeaMonkey\Extensions
[email protected]
Software\Mozilla\Firefox\Extensions
%sGrabberData\
%sDwnlData\
%s\idmpla.ini
%s\idmpldr.ini
GlobalErrors.log
UrlHistory.txt
dnlbtmn.txt
%sidmmzcc5\
%sidmmzcc03\
%sidmmzcc3\
%sidmmzcc02\
%sidmmzcc01\
%sidmmzcc2\
%sidmmzcc\
scheduler.chm
defexclist.txt
%s\idmBroker.exe
%s\idmvconv.dll
%s\idmvs.dll
%s\setup_error.log
%s\IDMGCExt.crx
%s\IDMNetMon64.dll
%s\IDMNetMon.dll
%s\idmcchandler2_64.dll
%s\idmcchandler2.dll
%s\idmcchandler64.dll
%s\idmcchandler.dll
%s\idmftype.dll
%s\IDMFType64.dll
%s\IDMFType.dat
%s\downlWithIDM64.dll
%s\IDMGetAll64.dll
%s\IDMIECC64.dll
%s\IDMIntegrator64.exe
%s\idmtdi64.sys
%s\idmtdi32.sys
%s\idmwfp64.sys
%s\idmwfp32.sys
%s\idmtdi.cat
%s\idmwfp.cat
%s\idmtdi.inf
%s\idmwfp.inf
%s\idmbrbtn64.dll
%s\IDMShellExt64.dll
idmbrbtn.dll
NP_IDM.dll
idmmzcc.xpi
grabber.chm
IDMGrHlp.exe
downlWithIDM.dll
idmupdt.exe
INSTALL.LOG
DelPlug.exe
UNWISE.EXE
UNWISE.INI
Uninstall.exe
IDMSetup.log
tutor.hlp
tutor.chm
tips.txt
etcprotocol.dll
nnprotocol.exe
nnprotocol.dll
idmmkb.dll
IDMGetAll.dll
IDManTypeInfo.tlb
idman.hlp
idman.chm
IDMIECC.dll
license.txt
Uninstall IDM.lnk
Grabber Help.lnk
TUTORIALS.lnk
license.lnk
IDM Help.lnk
%s%s%s%s
SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Internet Download Manager
%Program Files%\Internet Download Manager
%Documents and Settings%\%current user%\Local Settings\Temp\IDM_Setup_Temp\setup_error.log
It is neccessary to close all web browsers before running this Setup Program. Click Next to continue installation.
Unauthorized reproduction or distribution of this program, or any portion of it, may result in severe civil and criminal penalties, and will by prosecuted to the maximum extent possible under law.
If you want IDM to take over your downloads immediately after the installation, please close all web browsers before proceeding. You may open your browser after starting IDM.
The "Default" option will delete all executive files of IDM, and the integration of IDM into browsers.
Please visit hXXp://VVV.internetdownloadmanager.com
6, 21, 1, 1

mscorsvw.exe_3896:

.text
`.data
.rsrc
@.reloc
EX_CATCH line %d
CACHE_S_FORMATETC_NOTSUPPORTED
CTL_E_GETNOTSUPPORTEDATRUNTIME
CTL_E_GETNOTSUPPORTED
CTL_E_SETNOTSUPPORTEDATRUNTIME
CTL_E_SETNOTSUPPORTED
CO_E_SERVER_EXEC_FAILURE
MK_E_INTERMEDIATEINTERFACENOTSUPPORTED
REGDB_E_KEYMISSING
OLE_E_ADVISENOTSUPPORTED
CO_E_INIT_SCM_EXEC_FAILURE
EX_THROW Type = 0x%x HR = 0x%x, line %d
ThrowHR: HR = %x
mscorsvw.pdb
_amsg_exit
_acmdln
MSVCR100_CLR0400.dll
_crt_debugger_hook
RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW
ADVAPI32.dll
GetWindowsDirectoryW
GetCPInfo
GetProcessHeap
KERNEL32.dll
MsgWaitForMultipleObjectsEx
USER32.dll
mscoree.dll
ole32.dll
OLEAUT32.dll
.PAVException@@
v1.0.3705
.PAVOutOfMemoryException@@
.PAVHRException@@
7 7$7(7,7074787
6$6,686\6|6
advapi32.dll
Wtsapi32.dll
kernel32.dll
mscorsvc.dll
Microsoft .NET Runtime Optimization Service
Microsoft .NET Runtime Optimization Service has been uninstalled
Failed to uninstall Microsoft .NET Runtime Optimization Service
Microsoft .NET Runtime Optimization Service has been installed
Failed to install Microsoft .NET Runtime Optimization Service
Failed to retrieve Microsoft .NET Runtime Optimization Service interface
Set service status to %d
Service control handler op %u, event type %u
\ndpsetup.bat
Created repair process in session %d, process ID %d
Unable to create repair process, error %d
Microsoft.NET\NETFXRepair.exe
Error changing token session ID, error %d
Error duplicating current process token, error %d
Error getting current process token, error %d
Session %u has become active.
Aborting repair due to unexpected wait status %u
Found active session %u
Aborting repair due to error %u from WTSEnumerateSessions
StartServiceCtrlDispatcher failed with error %d. Will try slow path
\fusion.localgac
\v2.0.50727
SOFTWARE\Microsoft\.NetFramework
v4.0.0
SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default
SOFTWARE\Microsoft\.NETFramework\NGenQueue\WIN32\Default
ngenrootstorelock.dat
ngenservicelock.dat
FastStartupCheck(isPrivateRuntime=%d)
yKERNEL32.DLL
Software\Microsoft\.NETFramework
RestrictedGCStressExe
EnableInternetHREFexes
NGENServiceWaitPassiveWork
NGENServicePassiveWorkWaitTimeout
NGENServicePassiveHardDiskIdleTimeout
NGENServicePassiveExceptInputTimeout
MD_ForceNoColDesSharing
UNSUPPORTED_DbgDontResumeThreadsOnUnhandledException
DbgTransportProxyAddress
DbgRedirectCreateCmd
DbgRedirectCommonCmd
DbgRedirectAttachCmd
mscorrc.dll
v4.0.30319
.NET Runtime Optimization Service
4.0.30319.1 (RTMRel.030319-0100)
mscorsvw.exe
.NET Framework
4.0.30319.1

WMIADAP.EXE_3492:

.text
`.data
.rsrc
msvcrt.dll
MSVCP60.dll
ADVAPI32.dll
KERNEL32.dll
NTDLL.DLL
wbemcomn.dll
OLEAUT32.dll
ole32.dll
loadperf.dll
USER32.dll
ForeceStatus %S x
failure in loading HKEY %p for locale %S err: %d
CLocaleDefn failed hr = x
CLocaleDefn(%S) failed hr = x
DeleteClass %s from %s 0xx
InsertLocale PutClass(%S) x
ValidateObject(%S) x
class %S: Display for counter %d not found
class %S: Description for counter %d not found
class %S: DisplayName for counter %d not found
ConnectServer on namespace %S hr = x
CAdapSync::VerifyProviderClasses() failed: %X.
The ADAP process ( PID: %d ) is connected to the WinMgmt service
CAdapSync::VerifyBaseClasses() failed when comparing Win32_PerfFormattedData: %X.
CAdapSync::VerifyBaseClasses() failed when comparing Win32_PerfRawData: %X.
CAdapSync::VerifyBaseClasses() failed when comparing Win32_Perf: %X.
unable to obtain class CIM_StatisticalInformation for namespace %S: hr = x
Collect for service %S returned 0-Size BLOBs
Collect for service %S for %s counters failed
Skipping Object of index %d of service %S because index does not belong to the range %d - %d assigned to the service by LodCtr
CNTRegistry::GetStr() failed: %X.
CNTRegistry::GetMultiStr() failed: %X.
Library for Service %S Freed.
FreeLibrary for Service %S threw an exception
Destructing the %S performance library wrapper.
GetFileSignature for %S err %d
CheckFileSignature for %S x
Performance library %S status was left in the "Processing" state.
Performance library for %S has previously been disabled.
Performance library %S: status is still ADAP_PERFLIB_OK.
Performance library %S: status is in an unknown state.
Performance library for %S: status is corrupt.
The performance library for %S failed to load.
A performance library function in %S failed to load.
** %S Library Loaded.
Performance library %S has not been loaded.
Could not open the %S registry key.
Perflib Open function has thrown an exception in %S.
Open called for %S returned %d
Perflib access mutex was abandoned in %S.
Perflib access mutex timed out in %S.
Unknown error with perflib access mutex in %S.
Serivce %S has a non MSDN compliant or invalid Linkage Key
Perflib Collection function has returned an unknown error(%d) in %S.
Perflib Collection function has thrown an exception in %S.
Collect called for %S returned %d
Library %S: Collect function requires more than 0xx bytes to complete
Perflib Close function has thrown an exception in %S.
Close called for %S returned %d
Construction of the %S perflib wrapper failed hr = x.
VerifyLoaded for %S hr = x.
Constructing the %S performance library wrapper.
CAdapThread::RealEntry() for %S failed: %X.
Thread 0x%x for %S is terminating
CAdapThread::Begin() failed: %X.
Worker thread for %S is 0x%x
Worker thread for %S could not be verified.
CAdapRegPerf::Clean() failed: %X.
ProcessLibrary ForceStatus for %S hr = x
m_apMasterClassList[%d]->Merge for %S hr x
GetClassList for %S hr x
CPerfLibSchema::Initialize for %S hr x
CAdapRegPerf::Dredge() for %S succeeded.
CAdapRegPerf::Dredge() failed: %X.
The Monitor thread ID is 0x%x
ADAP_WMI_ENTRY mutex creation failed %d
WMI_SysEvent_Semaphore semaphore creation failed %d
WMIADAP.pdb
|%SSSj
VSSSSSSh
t)SSh
_acmdln
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
RegNotifyChangeKeyValue
GetProcessHeap
?Report@CEventLog@@QAEHGKVCInsertionString@@000000000@Z
ntdll.dll
RegCreateKeyExW
RegCreateKeyExA
RegDeleteKeyA
RegDeleteKeyW
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryInfoKeyW
RegEnumKeyA
RegEnumKeyW
WMIADAP.exe
?CloseSubKey@CRegistry@@AAEXXZ
?CreateOpen@CRegistry@@QAEJPAUHKEY__@@PBGPAGKKPAU_SECURITY_ATTRIBUTES@@PAK@Z
?DeleteCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBG@Z
?DeleteCurrentKeyValue@CRegistry@@QAEKPBG@Z
?DeleteKey@CRegistry@@QAEJPAVCHString@@@Z
?GetCurrentBinaryKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGPAEPAK@Z
?GetCurrentBinaryKeyValue@CRegistry@@QAEKPBGAAVCHString@@@Z
?GetCurrentBinaryKeyValue@CRegistry@@QAEKPBGPAEPAK@Z
?GetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAK@Z
?GetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAVCHString@@@Z
?GetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAVCHStringArray@@@Z
?GetCurrentKeyValue@CRegistry@@QAEKPBGAAK@Z
?GetCurrentKeyValue@CRegistry@@QAEKPBGAAVCHString@@@Z
?GetCurrentKeyValue@CRegistry@@QAEKPBGAAVCHStringArray@@@Z
?GetCurrentRawKeyValue@CRegistry@@AAEKPAUHKEY__@@PBGPAXPAK3@Z
?GetCurrentRawSubKeyValue@CRegistry@@AAEKPBGPAXPAK2@Z
?GetCurrentSubKeyCount@CRegistry@@QAEKXZ
?GetCurrentSubKeyName@CRegistry@@QAEKAAVCHString@@@Z
?GetCurrentSubKeyPath@CRegistry@@QAEKAAVCHString@@@Z
?GetCurrentSubKeyValue@CRegistry@@QAEKPBGAAK@Z
?GetCurrentSubKeyValue@CRegistry@@QAEKPBGAAVCHString@@@Z
?GetCurrentSubKeyValue@CRegistry@@QAEKPBGPAXPAK@Z
?GetLongestSubKeySize@CRegistry@@QAEKXZ
?GethKey@CRegistry@@QAEPAUHKEY__@@XZ
?LocateKeyByNameOrValueName@CRegistrySearch@@QAEHPAUHKEY__@@PBG1PAPBGKAAVCHString@@3@Z
?NextSubKey@CRegistry@@QAEKXZ
?Open@CRegistry@@QAEJPAUHKEY__@@PBGK@Z
?OpenAndEnumerateSubKeys@CRegistry@@QAEJPAUHKEY__@@PBGK@Z
?OpenLocalMachineKeyAndReadValue@CRegistry@@QAEJPBG0AAVCHString@@@Z
?OpenSubKey@CRegistry@@AAEKXZ
?RewindSubKeys@CRegistry@@QAEXXZ
?SearchAndBuildList@CRegistrySearch@@QAEHVCHString@@AAVCHPtrArray@@00HPAUHKEY__@@@Z
?SetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAK@Z
?SetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAVCHString@@@Z
?SetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAVCHStringArray@@@Z
?SetCurrentKeyValue@CRegistry@@QAEKPBGAAK@Z
?SetCurrentKeyValue@CRegistry@@QAEKPBGAAVCHString@@@Z
?SetCurrentKeyValue@CRegistry@@QAEKPBGAAVCHStringArray@@@Z
?SetCurrentKeyValueExpand@CRegistry@@QAEKPAUHKEY__@@PBGAAVCHString@@@Z
?myRegCreateKeyEx@CRegistry@@AAEJPAUHKEY__@@PBGKPAGKKPAU_SECURITY_ATTRIBUTES@@PAPAU2@PAK@Z
?myRegDeleteKey@CRegistry@@AAEJPAUHKEY__@@PBG@Z
?myRegDeleteValue@CRegistry@@AAEJPAUHKEY__@@PBG@Z
?myRegEnumKey@CRegistry@@AAEJPAUHKEY__@@KPAGK@Z
?myRegEnumValue@CRegistry@@AAEJPAUHKEY__@@KPAGPAK22PAE2@Z
?myRegOpenKeyEx@CRegistry@@AAEJPAUHKEY__@@PBGKKPAPAU2@@Z
?myRegQueryInfoKey@CRegistry@@AAEJPAUHKEY__@@PAGPAK22222222PAU_FILETIME@@@Z
?myRegQueryValueEx@CRegistry@@AAEJPAUHKEY__@@PBGPAK2PAE2@Z
?myRegSetValueEx@CRegistry@@AAEJPAUHKEY__@@PBGKKPBEK@Z
\\.\root\cimv2
registrykey
SYSTEM\CurrentControlSet\Services\%s\Performance
MSFTPSvc
TCPIP
%s_Base
{B0A2AB46-F612-4469-BEC4-7AB038BC476C}
{76A94DE3-7C26-44f5-8E98-C5AEA48186CB}
{FF37A93C-C28E-11d1-AEB6-00C04FB68820}
SupportsEnumeration
SupportsGet
\\.\root\cimv2:__Win32Provider.Name="%s"
__InstanceProviderRegistration.Provider="\\\\.\\root\\cimv2:__Win32Provider.Name=\"%s\""
__Win32Provider.Name="%s"
HKEY_PERFORMANCE_xxxTEXT
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\
Export
Global\%s_Perf_Library_Lock_PID_%x
%s%s%s
Mddddd.d%cd
Software\Microsoft\Windows NT\CurrentVersion\Perflib
Global\WMI_SysEvent_Semaphore_%d
PSAPI.DLL
xx %s
xx %s%s.ini
\\.\root\wmi
%s_x
x=%s
%s_x_
WMIApRes.dll
Describes all the counters supported via WMI Hi-Performance providers
_new.ini
%s\%s
5.1.2600.5512 (xpsp.080413-2108)
wmicookr.dll
Windows
Operating System
5.1.2600.5512


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    support.exe:1564
    Setup.exe:1896
    lodctr.exe:2772
    lodctr.exe:364
    lodctr.exe:2804
    IDM1.tmp:1760
    aspnet_regiis.exe:3232
    idman621f.exe:1276
    mscorsvw.exe:2860
    mscorsvw.exe:2904
    mscorsvw.exe:1204
    mscorsvw.exe:336
    mscorsvw.exe:3944
    mscorsvw.exe:3800
    mscorsvw.exe:3060
    mscorsvw.exe:1908
    mscorsvw.exe:1488
    mscorsvw.exe:3292
    mscorsvw.exe:4008
    mscorsvw.exe:2568
    mscorsvw.exe:1984
    mscorsvw.exe:2540
    mscorsvw.exe:2132
    mscorsvw.exe:1616
    mscorsvw.exe:2300
    mscorsvw.exe:772
    mscorsvw.exe:2384
    mscorsvw.exe:572
    mscorsvw.exe:2240
    mscorsvw.exe:2816
    mscorsvw.exe:3584
    mscorsvw.exe:2720
    mscorsvw.exe:3744
    mscorsvw.exe:2468
    mscorsvw.exe:3708
    mscorsvw.exe:3356
    mscorsvw.exe:1952
    mscorsvw.exe:4040
    mscorsvw.exe:2956
    mscorsvw.exe:3640
    mscorsvw.exe:1284
    mscorsvw.exe:1044
    mscorsvw.exe:3016
    mscorsvw.exe:2672
    mscorsvw.exe:352
    mscorsvw.exe:3848
    mscorsvw.exe:3532
    %original file name%.exe:1724
    MsiExec.exe:2192
    MsiExec.exe:2492
    MsiExec.exe:2732
    ServiceModelReg.exe:2756
    unlodctr.exe:2632
    mofcomp.exe:3252
    dotNetFx40_Full_setup.exe:652
    TMP12.tmp.exe:2324
    ngen.exe:3920
    ngen.exe:3888

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.vshost.exe.manifest (2 bytes)
    %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Services.msi (7386 bytes)
    %Documents and Settings%\%current user%\Application Data\Adobe\Support\prerequisites\.NET Framework 4.0\dotNetFx40_Full_setup.exe (8737 bytes)
    %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.exe.config (1 bytes)
    %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.vshost.exe (22 bytes)
    %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.vshost.exe.config (625 bytes)
    %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.vshost.exe.manifest (2 bytes)
    %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\decoder.dll (1137 bytes)
    %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Newtonsoft.Json.dll (319 bytes)
    %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.exe.config (625 bytes)
    %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\GoogleSearchDotnet.xml (140 bytes)
    %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\GoogleSearchDotnet.pdb (194 bytes)
    %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\GoogleSearchDotnet.dll (90 bytes)
    %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.pdb (73 bytes)
    %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.pdb (30 bytes)
    %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\CSCommonLib.dll (110 bytes)
    %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.vshost.exe.config (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1037\SetupResources.dll (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate8.ico (894 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1038\SetupResources.dll (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_20151028_194612849.html (1754040 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupUtility.exe (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1040\eula.rtf (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Setup_20151028_194612255.html (169496 bytes)
    %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759AD (813 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1036\SetupResources.dll (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Setup.ico (36 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1037\LocalizedData.xml (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1029\LocalizedData.xml (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1040\LocalizedData.xml (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1049\SetupResources.dll (18 bytes)
    %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\A1377F7115F1F126A15360369B165211 (597 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\SysReqNotMet.ico (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate1.ico (894 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1030\SetupResources.dll (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1033\LocalizedData.xml (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2052\eula.rtf (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1029\eula.rtf (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SplashScreen.bmp (41 bytes)
    %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\F90F18257CBB4D84216AC1E1F3BB2C76 (550 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3076\eula.rtf (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1038\eula.rtf (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1044\SetupResources.dll (17 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\stop.ico (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1037\eula.rtf (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate5.ico (894 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_20151028_194612849-MSI_netfx_Extended_x86.msi.txt (1088936 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate3.ico (894 bytes)
    %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\3130B1871A126520A8C47861EFE3ED4D (240 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1043\eula.rtf (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1028\LocalizedData.xml (60 bytes)
    %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\A1377F7115F1F126A15360369B165211 (260 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate6.ico (894 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Extended\UiInfo.xml (39 bytes)
    C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Setup_2015102 (1284 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate2.ico (894 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1046\eula.rtf (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1031\eula.rtf (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1049\eula.rtf (54 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1032\eula.rtf (8 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1031\SetupResources.dll (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\ParameterInfo.xml (1425 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1040\SetupResources.dll (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupUi.xsd (30 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Save.ico (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1031\LocalizedData.xml (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1041\LocalizedData.xml (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\DisplayIcon.ico (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\UiInfo.xml (38 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Print.ico (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2070\eula.rtf (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1042\SetupResources.dll (15 bytes)
    %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\3130B1871A126520A8C47861EFE3ED4D (521 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1045\LocalizedData.xml (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1036\LocalizedData.xml (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1041\SetupResources.dll (15 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1041\eula.rtf (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Client\Parameterinfo.xml (1281 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1030\eula.rtf (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1028\eula.rtf (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupUi.dll (1425 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1035\SetupResources.dll (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1046\SetupResources.dll (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3082\LocalizedData.xml (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1042\LocalizedData.xml (65 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1032\LocalizedData.xml (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3082\eula.rtf (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1029\SetupResources.dll (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1045\SetupResources.dll (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1046\LocalizedData.xml (601 bytes)
    %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\F90F18257CBB4D84216AC1E1F3BB2C76 (304 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1030\LocalizedData.xml (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1025\LocalizedData.xml (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1042\eula.rtf (12 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1033\SetupResources.dll (17 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1053\LocalizedData.xml (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2052\SetupResources.dll (14 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\warn.ico (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1038\LocalizedData.xml (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\HFI2.tmp.html (22 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1053\eula.rtf (3 bytes)
    %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\696F3DE637E6DE85B458996D49D759AD (288 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate4.ico (894 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1044\eula.rtf (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\header.bmp (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1035\eula.rtf (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3076\LocalizedData.xml (60 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1032\SetupResources.dll (19 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1043\LocalizedData.xml (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Strings.xml (14 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1025\SetupResources.dll (17 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupEngine.dll (5873 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1044\LocalizedData.xml (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\watermark.bmp (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1035\LocalizedData.xml (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\sqmapi.dll (673 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\HFI5.tmp.html (54394 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\SysReqMet.ico (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Client\UiInfo.xml (39 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1049\LocalizedData.xml (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1055\SetupResources.dll (17 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1045\eula.rtf (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1055\LocalizedData.xml (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2070\LocalizedData.xml (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1036\eula.rtf (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Setup.exe (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1028\SetupResources.dll (14 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1033\eula.rtf (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1055\eula.rtf (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Extended\Parameterinfo.xml (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3082\SetupResources.dll (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2052\LocalizedData.xml (60 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1043\SetupResources.dll (19 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate7.ico (894 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1025\eula.rtf (7 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\DHtmlHeader.html (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3076\SetupResources.dll (14 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2070\SetupResources.dll (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1053\SetupResources.dll (17 bytes)
    %System%\config (200 bytes)
    %System%\config\system (5239 bytes)
    %Program Files%\Adobe\Support\list.dll (97 bytes)
    %System%\config\SYSTEM.LOG (8433 bytes)
    %System%\perfc009.dat (76 bytes)
    %System%\PerfStringBackup.INI (3361 bytes)
    %System%\PerfStringBackup.TMP (1480360 bytes)
    %System%\perfh009.dat (1756 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\RGI58.tmp (9639 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\RGI55.tmp-tmp (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\RGI59.tmp (9639 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\RGI58.tmp-tmp (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ASPNETSetup_00000.log (91534 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\RGI57.tmp-tmp (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\RGI54.tmp (9639 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\RGI53.tmp-tmp (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\RGI59.tmp-tmp (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\RGI54.tmp-tmp (9 bytes)
    %WinDir%\assembly\NativeImages_v4.0.30319_32\Temp\fa8-0\System.Design.dll (821943 bytes)
    %WinDir%\assembly\NativeImages_v4.0.30319_32\Temp\7c0-0\System.Drawing.Design.dll (28176 bytes)
    %WinDir%\Microsoft.NET\Framework\v4.0.30319\ngen_service.log (514 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\support.exe (32766 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\idman621f.exe (21530 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\diskcost.html (145 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\rmfiles.html (145 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\cancel.png (395 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\jquery-1.3.2.js (61857 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\box-repair.png (457 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\resume.html (145 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\back.png (328 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\outofrbdisk.html (145 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\retry.png (415 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\welcome.html (145 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\progress.html (337 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\check.png (333 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\pngfix\DD_belatedPNG_0.0.8a.js (1969 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\customize.html (337 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\box-add-remove.png (457 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\common.js (145 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\folder.html (337 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\client.png (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\verifyrepair.html (145 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\exit.html (145 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\style.css (337 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\setuptype.html (337 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\client_server.png (73 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\outofdisk.html (145 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\progress\progressbar.js (302 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\fatalerror.html (337 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\box.png (337 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\verifyready.html (73 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\box-custom.png (457 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\prepare.html (73 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\print.png (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\server.png (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\box-remove.png (145 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\button-large-bg.png (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\userexit.html (145 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\fileinuse.html (145 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\varstyle.css (232 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\maintwelcome.html (145 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\progress\progressbar.css (407 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\next.png (333 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\verifyremove.html (145 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\maintype.html (457 bytes)
    %WinDir%\assembly\tmp\751VHO3H\System.ServiceModel.Activation.dll (6360 bytes)
    %WinDir%\assembly\tmp\5E7SDNDD\System.Web.DataVisualization.dll (48928 bytes)
    %WinDir%\assembly\tmp\8SHHTI8S\Microsoft.Workflow.Compiler.manifest (491 bytes)
    %WinDir%\assembly\tmp\G78P5KRU\Microsoft.VisualC.STLCLR.dll (1552 bytes)
    %WinDir%\assembly\tmp\I7AW9OUF\System.Web.Abstractions.dll (784 bytes)
    %WinDir%\assembly\tmp\QI3T4ABF\System.Data.Services.dll (23296 bytes)
    %WinDir%\assembly\tmp\19BC9HZ9\System.Web.Entity.Design.dll (5064 bytes)
    %WinDir%\assembly\tmp\EC0KHXJI\System.Web.Extensions.dll (56684 bytes)
    %WinDir%\assembly\tmp\N2NGQG0N\System.Xaml.Hosting.dll (784 bytes)
    %WinDir%\assembly\tmp\YCTE7B33\PresentationBuildTasks.dll (19592 bytes)
    %WinDir%\assembly\tmp\IZN06KEA\System.Web.dll (165798 bytes)
    %WinDir%\assembly\tmp\2HOW8PT9\System.Web.DynamicData.dll (8560 bytes)
    %WinDir%\assembly\tmp\5QX1UWUX\System.ServiceModel.ServiceMoniker40.dll (12 bytes)
    %WinDir%\assembly\tmp\PTS7XXL1\Microsoft.Build.Conversion.v4.0.dll (2392 bytes)
    %WinDir%\assembly\tmp\TZSDFI1C\System.Data.Services.Design.dll (6360 bytes)
    %WinDir%\assembly\tmp\QWR2CQVO\Microsoft.Build.Tasks.v4.0.dll (33391 bytes)
    %WinDir%\assembly\tmp\TVKYS1EU\System.Web.Entity.dll (5064 bytes)
    %WinDir%\assembly\tmp\MHBOWRSB\System.WorkflowServices.dll (15168 bytes)
    %WinDir%\assembly\tmp\RKNSA6MO\System.Workflow.ComponentModel.dll (44462 bytes)
    %WinDir%\assembly\tmp\M3WMBDX6\AspNetMMCExt.dll (16944 bytes)
    %WinDir%\assembly\tmp\DARCI67A\Microsoft.Build.dll (37025 bytes)
    %WinDir%\assembly\tmp\9XRLSSVY\System.Web.RegularExpressions.dll (2392 bytes)
    %WinDir%\assembly\tmp\2M9610E6\Microsoft.Build.Engine.dll (23936 bytes)
    %WinDir%\assembly\tmp\41LYR0G2\System.Web.Mobile.dll (27704 bytes)
    %WinDir%\assembly\tmp\2L7ZOCXU\System.Web.Extensions.Design.dll (11344 bytes)
    %WinDir%\assembly\tmp\PU3CE29F\System.Web.Routing.dll (784 bytes)
    %WinDir%\assembly\tmp\VQR78MV4\System.Windows.Forms.DataVisualization.Design.dll (2392 bytes)
    %WinDir%\assembly\tmp\87SD3538\Microsoft.Build.Utilities.v4.0.dll (8184 bytes)
    %WinDir%\assembly\tmp\RVQHRR45\System.Drawing.Design.dll (3312 bytes)
    %WinDir%\assembly\tmp\R8P3CY5W\System.ServiceModel.WasHosting.dll (784 bytes)
    %WinDir%\assembly\tmp\3NPDCTUI\System.Data.OracleClient.dll (16944 bytes)
    %WinDir%\assembly\tmp\MD8A1L6R\XamlBuildTask.dll (3312 bytes)
    %WinDir%\assembly\tmp\5B8HO84G\Microsoft.Build.Framework.dll (3616 bytes)
    %WinDir%\assembly\tmp\0MP4V5FE\System.Web.DataVisualization.Design.dll (3312 bytes)
    %WinDir%\assembly\tmp\8DKF866A\System.Design.dll (165081 bytes)
    %WinDir%\assembly\tmp\XRR185J6\System.ServiceModel.Web.dll (11344 bytes)
    %WinDir%\assembly\tmp\8SHHTI8S\Microsoft.Workflow.Compiler.exe (784 bytes)
    %WinDir%\assembly\tmp\NLG7DXKH\System.Data.Entity.Design.dll (27504 bytes)
    %WinDir%\assembly\tmp\O334KH0J\System.Workflow.Runtime.dll (17848 bytes)
    %WinDir%\assembly\tmp\9LDLZFYY\System.Runtime.Caching.dll (3312 bytes)
    %WinDir%\assembly\tmp\G5DZJJ2D\System.Web.DynamicData.Design.dll (1552 bytes)
    %WinDir%\assembly\tmp\GSJR9SJ4\System.Workflow.Activities.dll (33455 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\dd_wcf_CA_smci_20151028_174648_520.txt (21652 bytes)
    %System%\wbem\Logs\mofcomp.log (1883 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\tmp56.tmp (13484 bytes)
    %System%\wbem\AutoRecover\807DD20ADF6F5D5EEA0C4E4CF016E69E.mof (216 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1042\eula.rtf (12 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1049\SetupResources.dll (18 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\2070\LocalizedData.xml (1425 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\SetupUtility.exe (886 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\Graphics\SysReqMet.ico (1 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1025\LocalizedData.xml (555 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\2070\eula.rtf (4 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1038\LocalizedData.xml (493 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1045\LocalizedData.xml (638 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\UiInfo.xml (376 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\2070\SetupResources.dll (18 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1053\LocalizedData.xml (579 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1036\eula.rtf (3 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate8.ico (894 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1037\eula.rtf (860 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1029\SetupResources.dll (18 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1040\eula.rtf (3 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\sqmapi.dll (531 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1055\eula.rtf (3 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1040\SetupResources.dll (18 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\Extended\UiInfo.xml (959 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\ParameterInfo.xml (2631 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1030\LocalizedData.xml (427 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1025\eula.rtf (7 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1028\SetupResources.dll (14 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1041\eula.rtf (10 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1055\SetupResources.dll (17 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1044\LocalizedData.xml (203 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1028\LocalizedData.xml (423 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\watermark.bmp (1212 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Print.ico (1 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate6.ico (894 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1053\SetupResources.dll (619 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\SetupUi.dll (1564 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1032\SetupResources.dll (711 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\Graphics\warn.ico (10 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\SetupUi.xsd (30 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\SplashScreen.bmp (41 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1042\SetupResources.dll (15 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Setup.ico (394 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate4.ico (894 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1044\SetupResources.dll (17 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1028\eula.rtf (6 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1043\SetupResources.dll (19 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1046\SetupResources.dll (117 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1033\eula.rtf (3 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\3076\eula.rtf (6 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate2.ico (894 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate3.ico (894 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\3082\LocalizedData.xml (423 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\Setup.exe (1356 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1029\LocalizedData.xml (380 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\2052\SetupResources.dll (14 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1046\LocalizedData.xml (817 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1038\SetupResources.dll (18 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1043\eula.rtf (3 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1033\SetupResources.dll (17 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1036\LocalizedData.xml (104 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\Client\UiInfo.xml (39 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1031\eula.rtf (3 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1032\eula.rtf (8 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1053\eula.rtf (3 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1037\LocalizedData.xml (556 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1032\LocalizedData.xml (849 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\Graphics\stop.ico (10 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate5.ico (894 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\header.bmp (3 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\3082\SetupResources.dll (564 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1033\LocalizedData.xml (658 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1030\SetupResources.dll (18 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\Client\Parameterinfo.xml (1937 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\Strings.xml (14 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\Graphics\SysReqNotMet.ico (1 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1029\eula.rtf (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\dd_dotNetFx40_Full_setup_decompression_log.txt (5605 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\3076\SetupResources.dll (14 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1037\SetupResources.dll (16 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\2052\eula.rtf (5 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\DisplayIcon.ico (875 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\3082\eula.rtf (3 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1040\LocalizedData.xml (1164 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate7.ico (894 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1045\eula.rtf (4 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1035\eula.rtf (3 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1046\eula.rtf (3 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1035\SetupResources.dll (981 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1049\LocalizedData.xml (600 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1025\SetupResources.dll (459 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1031\LocalizedData.xml (930 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1041\LocalizedData.xml (249 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Save.ico (1 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1049\eula.rtf (229 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1055\LocalizedData.xml (872 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate1.ico (894 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1035\LocalizedData.xml (924 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\Extended\Parameterinfo.xml (711 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1043\LocalizedData.xml (429 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1044\eula.rtf (3 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1038\eula.rtf (4 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1030\eula.rtf (3 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1042\LocalizedData.xml (950 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\2052\LocalizedData.xml (566 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1031\SetupResources.dll (18 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1045\SetupResources.dll (18 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1036\SetupResources.dll (18 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\3076\LocalizedData.xml (148 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\DHtmlHeader.html (322 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\1041\SetupResources.dll (252 bytes)
    C:\b677a0af2311ba9e2f8238db391cdc\SetupEngine.dll (5705 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\TMP12.tmp.exe.tmp\netfx_Extended.mzz (263065 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\dd_TMP12.tmp_decompression_log.txt (1272 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\TMP12.tmp.exe.tmp\netfx_ExtendedCab.msi (26 bytes)
    %WinDir%\Microsoft.NET\Framework\v4.0.30319\ngen.log (43210 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\RarSFX0]
    "support.exe" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\RarSFX0\support.exe /exenoupdates /exelang 0 /prereqs 1 /qn"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Average: 5 (1 vote)


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2026 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now