Trojan.Win32.Alureon_beea065e35

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

support.exe:1564
Setup.exe:1896
lodctr.exe:2772
lodctr.exe:364
lodctr.exe:2804
IDM1.tmp:1760
aspnet_regiis.exe:3232
idman621f.exe:1276
mscorsvw.exe:2860
mscorsvw.exe:2904
mscorsvw.exe:1204
mscorsvw.exe:336
mscorsvw.exe:3944
mscorsvw.exe:3800
mscorsvw.exe:3060
mscorsvw.exe:1908
mscorsvw.exe:1488
mscorsvw.exe:3292
mscorsvw.exe:4008
mscorsvw.exe:2568
mscorsvw.exe:1984
mscorsvw.exe:2540
mscorsvw.exe:2132
mscorsvw.exe:1616
mscorsvw.exe:2300
mscorsvw.exe:772
mscorsvw.exe:2384
mscorsvw.exe:572
mscorsvw.exe:2240
mscorsvw.exe:2816
mscorsvw.exe:3584
mscorsvw.exe:2720
mscorsvw.exe:3744
mscorsvw.exe:2468
mscorsvw.exe:3708
mscorsvw.exe:3356
mscorsvw.exe:1952
mscorsvw.exe:4040
mscorsvw.exe:2956
mscorsvw.exe:3640
mscorsvw.exe:1284
mscorsvw.exe:1044
mscorsvw.exe:3016
mscorsvw.exe:2672
mscorsvw.exe:352
mscorsvw.exe:3848
mscorsvw.exe:3532
%original file name%.exe:1724
MsiExec.exe:2192
MsiExec.exe:2492
MsiExec.exe:2732
ServiceModelReg.exe:2756
unlodctr.exe:2632
mofcomp.exe:3252
dotNetFx40_Full_setup.exe:652
TMP12.tmp.exe:2324
ngen.exe:3920
ngen.exe:3888

The Trojan injects its code into the following process(es):

KeywordService.exe:2340
mscorsvw.exe:3896
Autoupdate.exe:3448

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process support.exe:1564 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.vshost.exe.manifest (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.vshost.exe (22 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Services.msi (7386 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC (8 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support\prerequisites\.NET Framework 4.0\dotNetFx40_Full_setup.exe (8737 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.exe.config (1 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.vshost.exe (22 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.vshost.exe.config (625 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.vshost.exe.manifest (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\decoder.dll (1137 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Newtonsoft.Json.dll (319 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.exe.config (625 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\GoogleSearchDotnet.xml (140 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\GoogleSearchDotnet.pdb (194 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.exe (38 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\GoogleSearchDotnet.dll (90 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.pdb (73 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.pdb (30 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.exe (14 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\CSCommonLib.dll (110 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.vshost.exe.config (1 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.exe.config (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0 (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support\prerequisites\.NET Framework 4.0\dotNetFx40_Full_setup.exe (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.vshost.exe (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.exe.config (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.exe (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support\prerequisites\.NET Framework 4.0 (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\holder0.aiph (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.vshost.exe.config (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Newtonsoft.Json.dll (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.pdb (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\GoogleSearchDotnet.dll (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.pdb (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\GoogleSearchDotnet.xml (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\CSCommonLib.dll (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.vshost.exe.manifest (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support\prerequisites (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\GoogleSearchDotnet.pdb (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.exe (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.vshost.exe.config (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.vshost.exe (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Services.msi (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.vshost.exe.manifest (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\decoder.dll (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC (0 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install (0 bytes)

The process Setup.exe:1896 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1037\SetupResources.dll (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate8.ico (894 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1038\SetupResources.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_20151028_194612849.html (1754040 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupUtility.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1040\eula.rtf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Setup_20151028_194612255.html (169496 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759AD (813 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1036\SetupResources.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Setup.ico (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1037\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1029\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1040\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1049\SetupResources.dll (18 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\A1377F7115F1F126A15360369B165211 (597 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\SysReqNotMet.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate1.ico (894 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1030\SetupResources.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1033\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2052\eula.rtf (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1029\eula.rtf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SplashScreen.bmp (41 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\F90F18257CBB4D84216AC1E1F3BB2C76 (550 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3076\eula.rtf (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1038\eula.rtf (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1044\SetupResources.dll (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\stop.ico (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1037\eula.rtf (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate5.ico (894 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_20151028_194612849-MSI_netfx_Extended_x86.msi.txt (1088936 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate3.ico (894 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\3130B1871A126520A8C47861EFE3ED4D (240 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1043\eula.rtf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1028\LocalizedData.xml (60 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\A1377F7115F1F126A15360369B165211 (260 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate6.ico (894 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Extended\UiInfo.xml (39 bytes)
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Setup_2015102 (1284 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate2.ico (894 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1046\eula.rtf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1031\eula.rtf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1049\eula.rtf (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1032\eula.rtf (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1031\SetupResources.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\ParameterInfo.xml (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1040\SetupResources.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupUi.xsd (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Save.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1031\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1041\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\DisplayIcon.ico (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\UiInfo.xml (38 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Print.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2070\eula.rtf (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1042\SetupResources.dll (15 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\3130B1871A126520A8C47861EFE3ED4D (521 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1045\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1036\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1041\SetupResources.dll (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1041\eula.rtf (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Client\Parameterinfo.xml (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1030\eula.rtf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1028\eula.rtf (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupUi.dll (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1035\SetupResources.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1046\SetupResources.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3082\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1042\LocalizedData.xml (65 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1032\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3082\eula.rtf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1029\SetupResources.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1045\SetupResources.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1046\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\F90F18257CBB4D84216AC1E1F3BB2C76 (304 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1030\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1025\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1042\eula.rtf (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1033\SetupResources.dll (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1053\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2052\SetupResources.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\warn.ico (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1038\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFI2.tmp.html (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1053\eula.rtf (3 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\696F3DE637E6DE85B458996D49D759AD (288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate4.ico (894 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1044\eula.rtf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\header.bmp (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1035\eula.rtf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3076\LocalizedData.xml (60 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1032\SetupResources.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1043\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Strings.xml (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1025\SetupResources.dll (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupEngine.dll (5873 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1044\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\watermark.bmp (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1035\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\sqmapi.dll (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFI5.tmp.html (54394 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\SysReqMet.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Client\UiInfo.xml (39 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1049\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1055\SetupResources.dll (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1045\eula.rtf (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1055\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2070\LocalizedData.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1036\eula.rtf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Setup.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1028\SetupResources.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1033\eula.rtf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1055\eula.rtf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Extended\Parameterinfo.xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3082\SetupResources.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2052\LocalizedData.xml (60 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1043\SetupResources.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate7.ico (894 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1025\eula.rtf (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\DHtmlHeader.html (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3076\SetupResources.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2070\SetupResources.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1053\SetupResources.dll (17 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\TMP12.tmp.exe.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFI2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFI5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\TMP12.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFI1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFI10.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFI19.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\TMP12.tmp.exe.tmp\netfx_ExtendedCab.msi (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFI4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFI13.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFI3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFI16.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\TMP12.tmp.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFIA.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFI5.tmp.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFID.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFI7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HFI1C.tmp (0 bytes)

The process KeywordService.exe:2340 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\config (200 bytes)
%System%\config\system (5239 bytes)
%Program Files%\Adobe\Support\list.dll (97 bytes)
%System%\config\SYSTEM.LOG (8433 bytes)

The process lodctr.exe:2772 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\perfc009.dat (76 bytes)
%System%\PerfStringBackup.INI (3361 bytes)
%System%\PerfStringBackup.TMP (1480360 bytes)
%System%\perfh009.dat (1756 bytes)

The Trojan deletes the following file(s):

%System%\PerfStringBackup.TMP (0 bytes)

The process lodctr.exe:2804 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\perfc009.dat (77 bytes)
%System%\PerfStringBackup.INI (3361 bytes)
%System%\PerfStringBackup.TMP (1485028 bytes)
%System%\perfh009.dat (1758 bytes)

The Trojan deletes the following file(s):

%System%\PerfStringBackup.TMP (0 bytes)

The process aspnet_regiis.exe:3232 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RGI58.tmp (9639 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI55.tmp-tmp (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI59.tmp (9639 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI58.tmp-tmp (9 bytes)
%System%\PerfStringBackup.INI (10083 bytes)
%System%\perfc009.dat (323 bytes)
%System%\perfh009.dat (7070 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ASPNETSetup_00000.log (91534 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI57.tmp-tmp (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI54.tmp (9639 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI55.tmp (9639 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI53.tmp-tmp (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI59.tmp-tmp (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI57.tmp (9639 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI54.tmp-tmp (9 bytes)
%System%\PerfStringBackup.TMP (4595016 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI53.tmp (9639 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RGI58.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI55.tmp-tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI59.tmp-tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI58.tmp-tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI59.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI57.tmp-tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI54.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI55.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI53.tmp-tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI57.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI54.tmp-tmp (0 bytes)
%System%\PerfStringBackup.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGI53.tmp (0 bytes)

The process mscorsvw.exe:4008 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%WinDir%\assembly\NativeImages_v4.0.30319_32\Temp\fa8-0\System.Design.dll (821943 bytes)

The Trojan deletes the following file(s):

%WinDir%\assembly\NativeImages_v4.0.30319_32\Temp\fa8-0 (0 bytes)
%WinDir%\assembly\NativeImages_v4.0.30319_32\index55.dat (0 bytes)

The process mscorsvw.exe:1984 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%WinDir%\assembly\NativeImages_v4.0.30319_32\Temp\7c0-0\System.Drawing.Design.dll (28176 bytes)

The Trojan deletes the following file(s):

%WinDir%\assembly\NativeImages_v4.0.30319_32\index56.dat (0 bytes)
%WinDir%\assembly\NativeImages_v4.0.30319_32\Temp\7c0-0 (0 bytes)

The process mscorsvw.exe:3896 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%WinDir%\Microsoft.NET\Framework\v4.0.30319\ngen_service.log (514 bytes)

The process %original file name%.exe:1724 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\support.exe (32766 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\idman621f.exe (21530 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\__tmp_rar_sfx_access_check_277375 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\support.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\idman621f.exe (0 bytes)

The process MsiExec.exe:2192 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\diskcost.html (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\rmfiles.html (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\cancel.png (395 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\jquery-1.3.2.js (61857 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\box-repair.png (457 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\resume.html (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\back.png (328 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\outofrbdisk.html (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\retry.png (415 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\welcome.html (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\progress.html (337 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\check.png (333 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\pngfix\DD_belatedPNG_0.0.8a.js (1969 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\customize.html (337 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\box-add-remove.png (457 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\common.js (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\folder.html (337 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\client.png (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\verifyrepair.html (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\exit.html (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\style.css (337 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\setuptype.html (337 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\client_server.png (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\outofdisk.html (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\progress\progressbar.js (302 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\fatalerror.html (337 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\box.png (337 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\verifyready.html (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\box-custom.png (457 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\prepare.html (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\print.png (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\server.png (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\box-remove.png (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\button-large-bg.png (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\userexit.html (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\fileinuse.html (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\varstyle.css (232 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\maintwelcome.html (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\progress\progressbar.css (407 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7 (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\next.png (333 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\verifyremove.html (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\maintype.html (457 bytes)

The Trojan deletes the following file(s):

C:\DOCUMENTS AND SETTINGS (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\diskcost.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\cancel.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\rmfiles.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\outofdisk.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\common.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\box-repair.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\resume.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\outofrbdisk.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\retry.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\welcome.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\progress.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\check.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\pngfix\DD_belatedPNG_0.0.8a.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\verifyready.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\customize.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\box-add-remove.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\verifyrepair.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\folder.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\client.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\exit.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\style.css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\setuptype.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\client_server.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\box-custom.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\jquery-1.3.2.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\progress\progressbar.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\fatalerror.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\box.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\pngfix (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\progress (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\prepare.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\print.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\server.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\box-remove.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\button-large-bg.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\userexit.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\back.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\fileinuse.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\varstyle.css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\maintwelcome.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\progress\progressbar.css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\next.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\verifyremove.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\maintype.html (0 bytes)
%Documents and Settings%\%current user%\LOCAL SETTINGS (0 bytes)

The process MsiExec.exe:2492 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%WinDir%\assembly\tmp\751VHO3H\System.ServiceModel.Activation.dll (6360 bytes)
%WinDir%\assembly\tmp\5E7SDNDD\System.Web.DataVisualization.dll (48928 bytes)
%WinDir%\assembly\tmp\8SHHTI8S\Microsoft.Workflow.Compiler.manifest (491 bytes)
%WinDir%\assembly\tmp\G78P5KRU\Microsoft.VisualC.STLCLR.dll (1552 bytes)
%WinDir%\assembly\tmp\I7AW9OUF\System.Web.Abstractions.dll (784 bytes)
%WinDir%\assembly\tmp\QI3T4ABF\System.Data.Services.dll (23296 bytes)
%WinDir%\assembly\tmp\19BC9HZ9\System.Web.Entity.Design.dll (5064 bytes)
%WinDir%\assembly\tmp\EC0KHXJI\System.Web.Extensions.dll (56684 bytes)
%WinDir%\assembly\tmp\N2NGQG0N\System.Xaml.Hosting.dll (784 bytes)
%WinDir%\assembly\tmp\YCTE7B33\PresentationBuildTasks.dll (19592 bytes)
%WinDir%\assembly\tmp\IZN06KEA\System.Web.dll (165798 bytes)
%WinDir%\assembly\tmp\2HOW8PT9\System.Web.DynamicData.dll (8560 bytes)
%WinDir%\assembly\tmp\5QX1UWUX\System.ServiceModel.ServiceMoniker40.dll (12 bytes)
%WinDir%\assembly\tmp\PTS7XXL1\Microsoft.Build.Conversion.v4.0.dll (2392 bytes)
%WinDir%\assembly\tmp\TZSDFI1C\System.Data.Services.Design.dll (6360 bytes)
%WinDir%\assembly\tmp\QWR2CQVO\Microsoft.Build.Tasks.v4.0.dll (33391 bytes)
%WinDir%\assembly\tmp\TVKYS1EU\System.Web.Entity.dll (5064 bytes)
%WinDir%\assembly\tmp\MHBOWRSB\System.WorkflowServices.dll (15168 bytes)
%WinDir%\assembly\tmp\RKNSA6MO\System.Workflow.ComponentModel.dll (44462 bytes)
%WinDir%\assembly\tmp\M3WMBDX6\AspNetMMCExt.dll (16944 bytes)
%WinDir%\assembly\tmp\DARCI67A\Microsoft.Build.dll (37025 bytes)
%WinDir%\assembly\tmp\9XRLSSVY\System.Web.RegularExpressions.dll (2392 bytes)
%WinDir%\assembly\tmp\2M9610E6\Microsoft.Build.Engine.dll (23936 bytes)
%WinDir%\assembly\tmp\41LYR0G2\System.Web.Mobile.dll (27704 bytes)
%WinDir%\assembly\tmp\2L7ZOCXU\System.Web.Extensions.Design.dll (11344 bytes)
%WinDir%\assembly\tmp\PU3CE29F\System.Web.Routing.dll (784 bytes)
%WinDir%\assembly\tmp\VQR78MV4\System.Windows.Forms.DataVisualization.Design.dll (2392 bytes)
%WinDir%\assembly\tmp\87SD3538\Microsoft.Build.Utilities.v4.0.dll (8184 bytes)
%WinDir%\assembly\tmp\RVQHRR45\System.Drawing.Design.dll (3312 bytes)
%WinDir%\assembly\tmp\R8P3CY5W\System.ServiceModel.WasHosting.dll (784 bytes)
%WinDir%\assembly\tmp\3NPDCTUI\System.Data.OracleClient.dll (16944 bytes)
%WinDir%\assembly\tmp\MD8A1L6R\XamlBuildTask.dll (3312 bytes)
%WinDir%\assembly\tmp\5B8HO84G\Microsoft.Build.Framework.dll (3616 bytes)
%WinDir%\assembly\tmp\0MP4V5FE\System.Web.DataVisualization.Design.dll (3312 bytes)
%WinDir%\assembly\tmp\8DKF866A\System.Design.dll (165081 bytes)
%WinDir%\assembly\tmp\XRR185J6\System.ServiceModel.Web.dll (11344 bytes)
%WinDir%\assembly\tmp\8SHHTI8S\Microsoft.Workflow.Compiler.exe (784 bytes)
%WinDir%\assembly\tmp\NLG7DXKH\System.Data.Entity.Design.dll (27504 bytes)
%WinDir%\assembly\tmp\O334KH0J\System.Workflow.Runtime.dll (17848 bytes)
%WinDir%\assembly\tmp\9LDLZFYY\System.Runtime.Caching.dll (3312 bytes)
%WinDir%\assembly\tmp\G5DZJJ2D\System.Web.DynamicData.Design.dll (1552 bytes)
%WinDir%\assembly\tmp\GSJR9SJ4\System.Workflow.Activities.dll (33455 bytes)

The process ServiceModelReg.exe:2756 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\dd_wcf_CA_smci_20151028_174648_520.txt (21652 bytes)

The process mofcomp.exe:3252 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\wbem\Logs\mofcomp.log (1883 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmp56.tmp (13484 bytes)
%System%\wbem\AutoRecover\807DD20ADF6F5D5EEA0C4E4CF016E69E.mof (216 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\tmp56.tmp (0 bytes)

The process dotNetFx40_Full_setup.exe:652 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\b677a0af2311ba9e2f8238db391cdc\1042\eula.rtf (12 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1049\SetupResources.dll (18 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\2070\LocalizedData.xml (1425 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\SetupUtility.exe (886 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\SysReqMet.ico (1 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1025\LocalizedData.xml (555 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\2070\eula.rtf (4 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1038\LocalizedData.xml (493 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1045\LocalizedData.xml (638 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\UiInfo.xml (376 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\2070\SetupResources.dll (18 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1053\LocalizedData.xml (579 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1036\eula.rtf (3 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate8.ico (894 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1037\eula.rtf (860 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1029\SetupResources.dll (18 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1040\eula.rtf (3 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\sqmapi.dll (531 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1055\eula.rtf (3 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1040\SetupResources.dll (18 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Extended\UiInfo.xml (959 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\ParameterInfo.xml (2631 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1030\LocalizedData.xml (427 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1025\eula.rtf (7 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1028\SetupResources.dll (14 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1041\eula.rtf (10 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1055\SetupResources.dll (17 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1044\LocalizedData.xml (203 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1028\LocalizedData.xml (423 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\watermark.bmp (1212 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Print.ico (1 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate6.ico (894 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1053\SetupResources.dll (619 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\SetupUi.dll (1564 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1032\SetupResources.dll (711 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\warn.ico (10 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\SetupUi.xsd (30 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\SplashScreen.bmp (41 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1042\SetupResources.dll (15 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Setup.ico (394 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate4.ico (894 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1044\SetupResources.dll (17 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1028\eula.rtf (6 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1043\SetupResources.dll (19 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1046\SetupResources.dll (117 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1033\eula.rtf (3 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\3076\eula.rtf (6 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate2.ico (894 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate3.ico (894 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\3082\LocalizedData.xml (423 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Setup.exe (1356 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1029\LocalizedData.xml (380 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\2052\SetupResources.dll (14 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1046\LocalizedData.xml (817 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1038\SetupResources.dll (18 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1043\eula.rtf (3 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1033\SetupResources.dll (17 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1036\LocalizedData.xml (104 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Client\UiInfo.xml (39 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1031\eula.rtf (3 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1032\eula.rtf (8 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1053\eula.rtf (3 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1037\LocalizedData.xml (556 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1032\LocalizedData.xml (849 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\stop.ico (10 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate5.ico (894 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\header.bmp (3 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\3082\SetupResources.dll (564 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1033\LocalizedData.xml (658 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1030\SetupResources.dll (18 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Client\Parameterinfo.xml (1937 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Strings.xml (14 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\SysReqNotMet.ico (1 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1029\eula.rtf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dd_dotNetFx40_Full_setup_decompression_log.txt (5605 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\3076\SetupResources.dll (14 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1037\SetupResources.dll (16 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\2052\eula.rtf (5 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\DisplayIcon.ico (875 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\3082\eula.rtf (3 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1040\LocalizedData.xml (1164 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate7.ico (894 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1045\eula.rtf (4 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1035\eula.rtf (3 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1046\eula.rtf (3 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1035\SetupResources.dll (981 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1049\LocalizedData.xml (600 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1025\SetupResources.dll (459 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics (4 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1031\LocalizedData.xml (930 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1041\LocalizedData.xml (249 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Save.ico (1 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1049\eula.rtf (229 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1055\LocalizedData.xml (872 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate1.ico (894 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1035\LocalizedData.xml (924 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Extended\Parameterinfo.xml (711 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1043\LocalizedData.xml (429 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1044\eula.rtf (3 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1038\eula.rtf (4 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1030\eula.rtf (3 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1042\LocalizedData.xml (950 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\2052\LocalizedData.xml (566 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1031\SetupResources.dll (18 bytes)
C:\b677a0af2311ba9e2f8238db391cdc (8 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1045\SetupResources.dll (18 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1036\SetupResources.dll (18 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\3076\LocalizedData.xml (148 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\DHtmlHeader.html (322 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1041\SetupResources.dll (252 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\SetupEngine.dll (5705 bytes)

The Trojan deletes the following file(s):

C:\b677a0af2311ba9e2f8238db391cdc\1042\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1049\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\2070\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\SetupUtility.exe (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\2052 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\SysReqMet.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1025\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\2070\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1038\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1045\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\UiInfo.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\2070\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1053\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1036\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate8.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1037\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1029\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1040\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1028 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1043\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\sqmapi.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Client (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1055\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1040\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1025 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Extended\UiInfo.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\3082 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\ParameterInfo.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1030\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1025\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1028\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1041\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1055\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1044\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1028\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1036 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1035 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1033 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1032 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1031 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1030 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Print.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1038 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate6.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Extended (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1053\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\SetupUi.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1032\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\warn.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\SetupUi.xsd (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\SplashScreen.bmp (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1042\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Setup.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate4.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1044\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1028\eula.rtf (0 bytes)
C:\ece90306-3a19-405a-81b4-b4a46592a18a (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1046\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1042 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1043 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1040 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1041 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1046 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1044 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1045 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1049 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1033\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\3076\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate2.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate3.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\3082\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Setup.exe (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1029\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\2052\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1046\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1038\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1043\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1033\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1036\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Client\UiInfo.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1037 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1031\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1055 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1032\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1053\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1037\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1032\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\stop.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate5.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1053 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\header.bmp (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\3082\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1033\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\3082\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Client\Parameterinfo.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Strings.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\SysReqNotMet.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1029\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\2070 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\watermark.bmp (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\3076\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1037\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\2052\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\DisplayIcon.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1030\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1040\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate7.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1045\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1035\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1046\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1035\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1049\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1025\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1031\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1041\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Save.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1049\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1055\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate1.ico (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1035\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\Extended\Parameterinfo.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1043\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1044\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1038\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1030\eula.rtf (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1042\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\2052\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1029 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1031\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1045\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\3076 (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1036\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\3076\LocalizedData.xml (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\DHtmlHeader.html (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\1041\SetupResources.dll (0 bytes)
C:\b677a0af2311ba9e2f8238db391cdc\SetupEngine.dll (0 bytes)

The process TMP12.tmp.exe:2324 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\TMP12.tmp.exe.tmp\netfx_Extended.mzz (263065 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dd_TMP12.tmp_decompression_log.txt (1272 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\TMP12.tmp.exe.tmp\netfx_ExtendedCab.msi (26 bytes)

The process ngen.exe:3920 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%WinDir%\Microsoft.NET\Framework\v4.0.30319\ngen.log (43210 bytes)

The process ngen.exe:3888 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%WinDir%\Microsoft.NET\Framework\v4.0.30319\ngen.log (886 bytes)

Registry activity

The process support.exe:1564 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D4 1A A3 3A CD C9 53 C6 CE 54 38 B5 A2 55 BE 0A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\InterbootContext]
"(Default)" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Application Data\Adobe\Support\prerequisites\.NET Framework 4.0]
"dotNetFx40_Full_setup.exe" = "Microsoft .NET Framework 4 Setup"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\RarSFX0]
"support.exe" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\RarSFX0\support.exe /exenoupdates /exelang 0 /prereqs 1 /qn"

The Trojan deletes the following registry key(s):

[HKCU\InterbootContext]

The Trojan deletes the following value(s) in system registry:

The Trojan disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\RarSFX0]
"support.exe"

The process Setup.exe:1896 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DF 48 32 26 8E 5F 21 82 88 64 93 4A F5 17 3A 20"

The process KeywordService.exe:2340 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "46 B8 CF 5B 0F DA 36 62 29 5F 83 49 22 33 81 0E"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application]
"Sources" = "ASP.NET 4.0.30319.0, WSH, WMIAdapter, WMI.NET Provider Extension, WmdmPmSN, WinMgmt, Winlogon, Windows Product Activation, Windows 3.1 Migration, WebClient, VSSetup, VSS, vmtools, vmStatsProvider, VBRuntime, Userinit, Userenv, TPVCGateway, Tlntsvr, System.ServiceModel.Install 3.0.0.0, System.ServiceModel 4.0.0.0, System.ServiceModel 3.0.0.0, System.Runtime.Serialization 4.0.0.0, System.Runtime.Serialization 3.0.0.0, System.IO.Log 4.0.0.0, System.IO.Log 3.0.0.0, System.IdentityModel 4.0.0.0, System.IdentityModel 3.0.0.0, SysmonLog, Starter, SpoolerCtrs, Software Restriction Policies, Software Installation, ServiceModel Audit 4.0.0.0, ServiceModel Audit 3.0.0.0, SecurityCenter, SclgNtfy, SceSrv, SceCli, safrslv, SAFrdms, RPC, Remote Assistance, PerlMsg, PerfProc, PerfOS, PerfNet, Perfmon, Perflib, PerfDisk, Perfctrs, Offline Files, Oakley, ntbackup, MSSQLSERVER/MSDE, MSSHA, MsiInstaller, MSDTC Client, MSDTC, mnmsrvc, Microsoft.Transactions.Bridge 4.0.0.0, Microsoft.Transactions.Bridge 3.0.0.0, Microsoft H.323 Telephony Service Provider, Microsoft (R) Visual C# 2005 Compile`"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\Service1]
"EventMessageFile" = "%WinDir%\Microsoft.NET\Framework\v4.0.30319\EventLogMessages.dll"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = ""
"Cookies" = "%Documents and Settings%\LocalService\Cookies"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\C]
"BaseClass" = "Drive"

[HKU\.DEFAULT\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Adobe\Support]
"AutoUpdate.exe" = "Autoupdate"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = ""

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D]
"BaseClass" = "Drive"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F]
"BaseClass" = "Drive"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\A]
"BaseClass" = "Drive"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The process lodctr.exe:2772 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "67 76 7B D6 46 AC 11 C0 D3 8F F5 85 83 1C 4E 3C"

[HKLM\System\CurrentControlSet\Services\.NET Memory Cache 4.0\Performance]
"First Help" = "3705"
"First Counter" = "3704"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib]
"Updating" = ".NET Memory Cache 4.0"

[HKLM\System\CurrentControlSet\Services\.NET Memory Cache 4.0\Performance]
"Last Counter" = "3718"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib]
"Last Help" = "3719"

[HKLM\System\CurrentControlSet\Services\.NET Memory Cache 4.0\Performance]
"Last Help" = "3719"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib]
"Last Counter" = "3718"

[HKLM\System\CurrentControlSet\Services\.NET Memory Cache 4.0\Performance]
"Object List" = "3704"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib]
"Updating"

[HKLM\System\CurrentControlSet\Services\.NET Memory Cache 4.0\Performance]
"Disable Performance Counters"

The process lodctr.exe:364 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D2 AA AF 8B 54 6E 83 63 1E 4B B2 62 74 BB A8 AF"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib]
"Updating"

The process lodctr.exe:2804 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B5 58 37 B1 39 FE F2 A3 0A 16 3C 4F F6 75 73 DD"

[HKLM\System\CurrentControlSet\Services\Windows Workflow Foundation 4.0.0.0\Performance]
"First Counter" = "3720"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib]
"Updating" = "Windows Workflow Foundation 4.0.0.0"

[HKLM\System\CurrentControlSet\Services\Windows Workflow Foundation 4.0.0.0\Performance]
"Last Counter" = "3762"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib]
"Last Help" = "3763"

[HKLM\System\CurrentControlSet\Services\Windows Workflow Foundation 4.0.0.0\Performance]
"Object List" = "3720 3720 3720 3720 3720 3720 3720 3720 3720 3720 3720 3720 3720 3720 3720 3720 3720 3720 3720 3720 3720 3720 3720 3720"
"First Help" = "3721"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib]
"Last Counter" = "3762"

[HKLM\System\CurrentControlSet\Services\Windows Workflow Foundation 4.0.0.0\Performance]
"Last Help" = "3763"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib]
"Updating"

[HKLM\System\CurrentControlSet\Services\Windows Workflow Foundation 4.0.0.0\Performance]
"Disable Performance Counters"

The process IDM1.tmp:1760 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F8 E5 C5 5F 18 6C 32 53 20 C6 A2 0A 45 1A BE BB"

The process aspnet_regiis.exe:3232 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\MMC\NodeTypes\{a841b6c8-7577-11d0-bb1f-00a0c922e79c}\Extensions\PropertySheet]
"{fedb2179-2335-48f1-aa28-5cda35a2b36d}" = "ASP.NET MMC Extension VDir Node"

[HKLM\System\CurrentControlSet\Services\ASP.NET_4.0.30319\Performance]
"Last Help" = "4195"
"Object List" = "3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986 3984 3986"

[HKLM\System\CurrentControlSet\Services\aspnet_state\Performance]
"First Help" = "3765"

[HKLM\SOFTWARE\Microsoft\ASP.NET\4.0.30319.0]
"DefaultDoc" = "Default.aspx"

[HKLM\System\CurrentControlSet\Services\ASP.NET\Performance]
"Collect" = "CollectGenericCounters"
"Last Help" = "4407"

[HKLM\System\CurrentControlSet\Services\aspnet_state\Performance]
"Object List" = "3764 3764 3764 3764 3764 3764 3764 3764 3764 3764 3764 3764 3764 3764 3764 3764 3764 3764 3764 3764 3764 3764 3764 3764"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ASP.NET 4.0.30319.0]
"EventMessageFile" = "%WinDir%\Microsoft.NET\Framework\v4.0.30319\aspnet_rc.dll"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib]
"Last Help" = "3983"

[HKLM\SOFTWARE\Microsoft\MMC\NodeTypes\{a841b6c5-7577-11d0-bb1f-00a0c922e79c}\Extensions\PropertySheet]
"{fedb2179-2335-48f1-aa28-5cda35a2b36d}" = "ASP.NET MMC Extension"

[HKLM\System\CurrentControlSet\Services\ASP.NET\Performance]
"Library" = "aspnet_counters.dll"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ASP.NET 4.0.30319.0]
"CategoryCount" = "5"

[HKCR\CLSID\{5437FDFA-9EC9-4CCC-8531-42F8D9C19AF7}]
"AppID" = "{F75B6772-91E4-4D2F-9D44-61A447109C2B}"

[HKLM\SOFTWARE\Microsoft\MMC\NodeTypes\{a841b6c2-7577-11d0-bb1f-00a0c922e79c}\Extensions\PropertySheet]
"{fedb2179-2335-48f1-aa28-5cda35a2b36d}" = "ASP.NET MMC Extension IIS Snap in"

[HKLM\SOFTWARE\Microsoft\MMC\NodeTypes\{a841b6c4-7577-11d0-bb1f-00a0c922e79c}\Extensions\PropertySheet]
"{fedb2179-2335-48f1-aa28-5cda35a2b36d}" = "ASP.NET MMC Extension Machine Node"

[HKCR\AppID\{F75B6772-91E4-4D2F-9D44-61A447109C2B}]
"DllSurrogate" = ""

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ASP.NET 4.0.30319.0]
"TypesSupported" = "7"

[HKLM\System\CurrentControlSet\Services\aspnet_state\Performance]
"First Counter" = "3764"

[HKCR\TypeLib\{0015B4CC-EDC9-3A0E-B14A-AFB8F75F2A1C}\2.4\0\win32]
"(Default)" = "%WinDir%\Microsoft.NET\Framework\v4.0.30319\System.Web.tlb"

[HKLM\SOFTWARE\Microsoft\ASP.NET\4.0.30319.0]
"Mimemap" = ".wsdl,text/xml,.disco,text/xml,.xsd,text/xml,.wbmp,image/vnd.wap.wbmp,.png,image/png,.pnz,image/png,.smd,audio/x-smd,.smz,audio/x-smd,.smx,audio/x-smd,.mmf,application/x-smaf,.application,application/x-ms-application,.manifest,application/x-ms-manifest,.deploy,application/octet-stream,"

[HKCR\TypeLib\{0015B4CC-EDC9-3A0E-B14A-AFB8F75F2A1C}\2.4\FLAGS]
"(Default)" = "0"

[HKLM\System\CurrentControlSet\Services\ASP.NET_4.0.30319\Performance]
"Library" = "aspnet_counters.dll"

[HKCR\Microsoft.Aspnet.Snapin.AspNetManagementUtility.4\CLSID]
"(Default)" = "{5437FDFA-9EC9-4CCC-8531-42F8D9C19AF7}"

[HKLM\System\CurrentControlSet\Services\ASP.NET\Performance]
"Open" = "OpenGenericCounters"

[HKLM\System\CurrentControlSet\Services\aspnet_state\Parameters]
"AllowRemoteConnection" = "0"
"Port" = "42424"

[HKLM\System\CurrentControlSet\Services\ASP.NET_4.0.30319\Performance]
"First Counter" = "3984"

[HKCR\.ascx\PersistentHandler]
"(Default)" = "{eec97550-47a9-11cf-b952-00aa0051fe20}"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib]
"Updating" = "aspnet_state"

[HKLM\SOFTWARE\Microsoft\ASP.NET\4.0.30319.0]
"DllFullPath" = "%WinDir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll"

[HKLM\System\CurrentControlSet\Services\aspnet_state\Performance]
"Close" = "CloseStateCounters"

[HKLM\SOFTWARE\Microsoft\MMC\NodeTypes\{a841b6c7-7577-11d0-bb1f-00a0c922e79c}\Extensions\PropertySheet]
"{fedb2179-2335-48f1-aa28-5cda35a2b36d}" = "ASP.NET MMC Extension Instance Node"

[HKLM\SOFTWARE\Microsoft\ASP.NET\4.0.30319.0\CompilationMutexName]
"(Default)" = "3kKT8zb1cTxvRhiCcp7AxLadgyvqn0"

[HKLM\SOFTWARE\Microsoft\MMC\NodeTypes\{a841b6c3-7577-11d0-bb1f-00a0c922e79c}\Extensions\PropertySheet]
"{fedb2179-2335-48f1-aa28-5cda35a2b36d}" = "ASP.NET MMC Extension Static Node"

[HKCR\CLSID\{00000541-0000-0010-8000-00AA006D2EA4}\InprocServer32]
"ThreadingModel" = "Both"

[HKLM\System\CurrentControlSet\Services\aspnet_state\Linkage]
"Export" = "4.0.30319.0"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ASP.NET 4.0.30319.0]
"CategoryMessageFile" = "%WinDir%\Microsoft.NET\Framework\v4.0.30319\aspnet_rc.dll"

[HKCR\CLSID\{5437FDFA-9EC9-4CCC-8531-42F8D9C19AF7}]
"(Default)" = "Microsoft.Aspnet.Snapin.AspNetManagementUtility.4"

[HKCR\CLSID\{00000535-0000-0010-8000-00AA006D2EA4}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\CLSID\{FEDB2179-2335-48F1-AA28-5CDA35A2B36D}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList]
"ASPNET" = "0"

[HKLM\System\CurrentControlSet\Services\aspnet_state\Performance]
"Library" = "aspnet_counters.dll"

[HKCR\Interface\{98347F39-50EC-3894-AC43-E1948377FD43}\TypeLib]
"(Default)" = "{0015B4CC-EDC9-3A0E-B14A-AFB8F75F2A1C}"

[HKCR\CLSID\{5437FDFA-9EC9-4CCC-8531-42F8D9C19AF7}\ProgId]
"(Default)" = "Microsoft.Aspnet.Snapin.AspNetManagementUtility.4"

[HKLM\SOFTWARE\Microsoft\ASP.NET\4.0.30319.0]
"LastInstallTime" = "Type: REG_QWORD, Length: 8"

[HKLM\System\CurrentControlSet\Services\ASP.NET\Performance]
"Object List" = "4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198 4196 4198"

[HKLM\SOFTWARE\Microsoft\MMC\NodeTypes\{a841b6c9-7577-11d0-bb1f-00a0c922e79c}\Extensions\PropertySheet]
"{fedb2179-2335-48f1-aa28-5cda35a2b36d}" = "ASP.NET MMC Extension File Node"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib]
"Last Counter" = "3982"

[HKLM\System\CurrentControlSet\Services\ASP.NET\Linkage]
"Export" = "4.0.30319.0"

[HKLM\System\CurrentControlSet\Services\ASP.NET_4.0.30319\Performance]
"First Help" = "3985"

[HKCR\CLSID\{00000507-0000-0010-8000-00AA006D2EA4}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\CLSID\{0000050B-0000-0010-8000-00AA006D2EA4}\InprocServer32]
"ThreadingModel" = "Both"

[HKLM\SOFTWARE\Microsoft\ASP.NET\4.0.30319.0]
"Path" = "%WinDir%\Microsoft.NET\Framework\v4.0.30319"

[HKLM\SOFTWARE\Microsoft\MMC\SnapIns\{fedb2179-2335-48f1-aa28-5cda35a2b36d}]
"About" = "{4E9963B7-B2BF-4685-9378-8FEBEA364EF8}"

[HKCR\TypeLib\{0015B4CC-EDC9-3A0E-B14A-AFB8F75F2A1C}\2.4]
"(Default)" = "System_Web"

[HKLM\System\CurrentControlSet\Services\ASP.NET_4.0.30319\Performance]
"Collect" = "CollectVersion4Counters"

[HKLM\SOFTWARE\Microsoft\ASP.NET\4.0.30319.0]
"SupportedExts" = ".asax,1,.ascx,1,.ashx,0,.asmx,0,.aspx,0,.axd,0,.vsdisco,0,.rem,0,.soap,0,.config,1,.cs,1,.csproj,1,.vb,1,.vbproj,1,.webinfo,1,.licx,1,.resx,1,.resources,1,.master,1,.skin,1,.compiled,1,.browser,1,.mdb,1,.jsl,1,.vjsproj,1,.sitemap,1,.msgx,0,.ad,1,.dd,1,.ldd,1,.sd,1,.cd,1,.adprototype,1,.lddprototype,1,.sdm,1,.sdmDocument,1,.ldb,1,.svc,0,.mdf,1,.ldf,1,.java,1,.exclude,1,.refresh,1,.xoml,0,.xamlx,0,.rules,1,.aspq,1,.cshtm,1,.cshtml,1,.vbhtm,1,.vbhtml,1,"

[HKLM\SOFTWARE\Microsoft\MMC\SnapIns\{fedb2179-2335-48f1-aa28-5cda35a2b36d}]
"NameString" = "ASP.NET Management Extension"

[HKLM\System\CurrentControlSet\Services\aspnet_state\Performance]
"Collect" = "CollectStateCounters"
"Open" = "OpenStateCounters"

[HKLM\SOFTWARE\Microsoft\MMC\NodeTypes\{a841b6c6-7577-11d0-bb1f-00a0c922e79c}\Extensions\PropertySheet]
"{fedb2179-2335-48f1-aa28-5cda35a2b36d}" = "ASP.NET MMC Extension"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "52 2F 1C 7E 7C 06 95 A2 FA 32 D2 88 6D 7B ED E5"

[HKLM\System\CurrentControlSet\Services\ASP.NET\Performance]
"Close" = "CloseGenericCounters"
"First Help" = "4197"

[HKCR\CLSID\{FEDB2179-2335-48F1-AA28-5CDA35A2B36D}\InprocServer32]
"(Default)" = "%WinDir%\Microsoft.NET\Framework\v4.0.30319\MmcAspExt.dll"

[HKLM\System\CurrentControlSet\Services\ASP.NET_4.0.30319\Performance]
"Open" = "OpenVersion4Counters"

[HKLM\System\CurrentControlSet\Services\ASP.NET\Performance]
"First Counter" = "4196"

[HKCR\Interface\{A99B591A-23C6-4238-8452-C7B0E895063D}\TypeLib]
"Version" = "2.4"
"(Default)" = "{0015B4CC-EDC9-3A0E-B14A-AFB8F75F2A1C}"

[HKCR\AppID\{F75B6772-91E4-4D2F-9D44-61A447109C2B}]
"(Default)" = "Microsoft.Aspnet.Snapin.AspNetManagementUtility.4"

[HKLM\System\CurrentControlSet\Services\aspnet_state\Performance]
"Last Help" = "3983"

[HKLM\System\CurrentControlSet\Services\ASP.NET_4.0.30319\Performance]
"Close" = "CloseVersion4Counters"

[HKCR\Interface\{98347F39-50EC-3894-AC43-E1948377FD43}\TypeLib]
"Version" = "2.4"

[HKLM\System\CurrentControlSet\Services\ASP.NET_4.0.30319\Linkage]
"Export" = "4.0.30319.0"

[HKLM\System\CurrentControlSet\Services\ASP.NET_4.0.30319\Performance]
"Last Counter" = "4194"

[HKCR\TypeLib\{0015B4CC-EDC9-3A0E-B14A-AFB8F75F2A1C}\2.4\HELPDIR]
"(Default)" = "%WinDir%\Microsoft.NET\Framework\v4.0.30319"

[HKLM\SOFTWARE\Microsoft\ASP.NET\4.0.30319.0]
"AssemblyVersion" = "4.0.0.0"

[HKLM\System\CurrentControlSet\Services\aspnet_state\Performance]
"Last Counter" = "3982"

[HKCR\.aspx\PersistentHandler]
"(Default)" = "{eec97550-47a9-11cf-b952-00aa0051fe20}"

[HKLM\System\CurrentControlSet\Services\ASP.NET\Performance]
"Last Counter" = "4406"

The Trojan deletes the following registry key(s):

[HKLM\SOFTWARE\Microsoft\ASP.NET\4.0.30319.0]

The Trojan deletes the following value(s) in system registry:

[HKLM\System\CurrentControlSet\Services\ASP.NET\Performance]
"Last Help"

[HKLM\System\CurrentControlSet\Services\aspnet_state\Performance]
"Disable Performance Counters"

[HKLM\System\CurrentControlSet\Services\aspnet_state\Parameters]
"AllowRemoteConnection"
"Port"

[HKLM\SOFTWARE\Microsoft\ASP.NET\4.0.30319.0]
"DefaultDoc"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib]
"Updating"

[HKLM\System\CurrentControlSet\Services\ASP.NET\Performance]
"Object List"

[HKLM\SOFTWARE\Microsoft\ASP.NET\4.0.30319.0]
"DllFullPath"

[HKLM\System\CurrentControlSet\Services\ASP.NET\Performance]
"First Help"

[HKLM\SOFTWARE\Microsoft\ASP.NET\4.0.30319.0]
"Path"
"AssemblyVersion"

[HKLM\System\CurrentControlSet\Services\ASP.NET\Performance]
"Library Validation Code"

[HKLM\SOFTWARE\Microsoft\ASP.NET\4.0.30319.0]
"SupportedExts"

[HKLM\System\CurrentControlSet\Services\ASP.NET_4.0.30319\Performance]
"Disable Performance Counters"

[HKLM\System\CurrentControlSet\Services\ASP.NET\Performance]
"Last Counter"
"First Counter"
"Disable Performance Counters"

[HKLM\SOFTWARE\Microsoft\ASP.NET\4.0.30319.0]
"Mimemap"

The process idman621f.exe:1276 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5B C5 61 74 85 4E 69 5E B6 94 A5 33 54 DC 4C 57"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process mscorsvw.exe:2860 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA 6C D2 2F 67 BA 44 F6 CE 3B 31 4A 38 4C 04 4E"

The process mscorsvw.exe:2904 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C0 B9 7B EA 49 04 BB 7D 73 DF B1 04 B8 E7 F0 52"

The process mscorsvw.exe:1204 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7C FF 99 73 DE 36 4F 06 7D 4E 41 32 B7 7B 17 BD"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:336 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D0 0C D5 08 A9 75 34 01 D9 61 EB 4F B6 8F 11 21"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:3944 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BD D3 E8 41 09 DC 22 64 B8 62 9F 3A E5 75 4E 86"

The process mscorsvw.exe:3800 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E6 5A F1 14 A3 C8 7E 8B 08 4A 01 FE 45 D8 50 95"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:3060 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DF 0F 5E 57 59 7F F6 38 3A 79 68 47 FA FE B1 F2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process mscorsvw.exe:1908 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "73 04 1B 11 AC 6E DD 9D FE 1B 9F 84 BC 6D D2 A2"

The process mscorsvw.exe:1488 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "18 54 DE 59 83 34 08 FF 79 E4 74 70 17 BC 77 12"

The process mscorsvw.exe:3292 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9D 16 28 B6 23 5F 49 DD CF D4 E9 5E 31 6E 13 B8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:4008 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\7e441e10\2807462a]
"1b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\740e747\583670c4]
"3f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\1a714620\2f0c2e3a]
"1c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\46b91004\571609c]
"5" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\3e5c014b\2933b5e4]
"35" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\7a819b88\1229dc20]
"50" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\6087e565\6f05f6e3]
"b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\48cbec9d\4c0baa3d\53]
"ILDependencies" = "3F BC 10 09 9E B8 6D 30 09 00 00 00 04 00 00 00"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\7a819b88\1229dc20]
"50" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\768ca187\29eb70c6\3\InvertDependencies\226b2009\768ca187]
"14" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7ac727df\4c76d55c]
"3" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\44ec6d48\74c9f6c5]
"27" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7f0603e4\ecd2583]
"40" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\6960d6d7\4b18a453]
"3d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\179bc95c\2202b9f5]
"34" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d0933fc\a425901\28\InvertDependencies\61e7e666\27e1f7e2]
"17" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32]
"Status" = "1"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\179bc95c\2202b9f5]
"34" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\768ca187\29eb70c6\3\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\48cbec9d\4c0baa3d\53]
"MVID" = "95 A4 6D 47 75 42 8A CF 5D D8 4F 12 AA A9 F0 6F"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\368e5e51\5cbefaea]
"58" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\1320606e\5f605a0e]
"19" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\4c0baa3d\6b6b1c13\53]
"DisplayName" = "System.Design,4.0.0.0,,b03f5f7f11d50a3a"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\4f1555b2\4383b32f]
"24" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\5764ec77\5f62750e]
"56" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\6087e565\6f05f6e3]
"b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\2ef268ac\497c9d44]
"4f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\4d5ecec1\58ac8060]
"9" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\64be1fa4\58364143]
"2a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\3e5c014b\2933b5e4]
"35" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\3d67735\7bda07cc]
"7" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\48cbec9d\4c0baa3d\53]
"ConfigMask" = "4361"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\649348ce\60337166]
"2c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\7e420f89\11c357a1]
"1a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\48cbec9d\4c0baa3d\53]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\4f1555b2\4383b32f]
"24" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\1bc5b14b\7dd65e4]
"4d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\25ed4857\426d019e\52]
"SIG" = "46 11 84 04 3F 14 BA 45 9A 58 F3 DE 0D C0 DD 5D"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\1c22df2f\6ae28f47]
"1d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\226b2009\768ca187]
"14" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\1a714620\2f0c2e3a]
"1c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\298818d6\3d37e654]
"26" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\55d78379\3d9f8012]
"6" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\159a66b8\5d94bc56]
"10" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\311f1bc6\78ce3965]
"43" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\368e5e51\5cbefaea]
"58" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\1c22df2f\6ae28f47]
"1d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\429b0dd8\1d9a9270]
"39" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d0933fc\a425901\28\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\2ef268ac\497c9d44]
"4f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\48cbec9d\4c0baa3d\53]
"ConfigString" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\72522657\467dfbf7]
"51" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\6faf58\34f474d5]
"F" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5b86bed\63ca5c10\5f]
"Status" = "4098"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\5f079895\3e0d252d]
"4e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7a819b88\1229dc20]
"50" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\19a3ab9\9adbb50]
"23" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\640d09ef\10ac776b]
"e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\6960d6d7\4b18a453]
"3d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\64be1fa4\58364143]
"2a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\226b2009\768ca187]
"14" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\4f0ed0af\4b333e2c]
"3b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\60049528\69f655c0]
"54" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\77a2835c\447dbcd8]
"25" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\61e7e666\27e1f7e2]
"17" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\768ca187\29eb70c6\3\InvertDependencies\368e5e51\5cbefaea]
"58" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\25ed4857\426d019e\52\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\53e01c0b\3aecd0a4]
"38" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\3d67735\7bda07cc]
"7" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\61e7e666\27e1f7e2]
"17" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\3a50533c\769fc3d5]
"2d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\6f06001f\62a6b5be]
"d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\48cbec9d\4c0baa3d\53]
"NIDependencies" = "C6 38 19 18 42 CA 99 14 01 00 00 00 04 00 00 00"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\3cca06a0\910bc3f]
"4" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\55d78379\3d9f8012]
"6" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\368e5e51\5cbefaea]
"58" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\340dcf4c\55b350eb]
"30" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\2a7f0223\16be2bc2]
"1f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\6f06001f\62a6b5be]
"d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\432ba598\2ab76b15]
"2f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\159a66b8\5d94bc56]
"10" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\53e01c0b\3aecd0a4]
"38" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\53e01c0b\3aecd0a4]
"38" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7ac727df\4c76d55c]
"3" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\3d67735\7bda07cc]
"7" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\2708d9ec\352e0e84]
"18" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\7940d148\2bfa95e0]
"36" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\40087b74\3bb0edb3\60]
"DisplayName" = "System.Web,4.0.0.0,,b03f5f7f11d50a3a"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5b86bed\63ca5c10\5f]
"LastModTime" = "EC EF D8 9F A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\340dcf4c\55b350eb]
"30" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\561175dc\261d3b7b]
"47" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\552fa235\a3eaecd]
"4a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\6960d6d7\4b18a453]
"3d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\585c020c\7c0832a4]
"37" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\1c22df2f\6ae28f47]
"1d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\6eae2d34\566d82b2]
"22" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\64be1fa4\58364143]
"2a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\2a7f0223\16be2bc2]
"1f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7e420f89\11c357a1]
"1a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\7ac727df\4c76d55c]
"3" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\5132fda3\47899b1f]
"46" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\1c22df2f\6ae28f47]
"1d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\298818d6\3d37e654]
"26" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\2a7f0223\16be2bc2]
"1f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\5fcea75a\57e574f9]
"4c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\1904b408\7e673d85]
"2" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\740e747\583670c4]
"3f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\61e7e666\27e1f7e2]
"17" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\61e7e666\27e1f7e2]
"17" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\2a8ab4f5\43eec18d]
"55" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\4eb53aa8\50e4c026]
"3e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\1c22df2f\6ae28f47]
"1d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\60049528\69f655c0]
"54" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\40087b74\3bb0edb3\60]
"SIG" = "65 80 64 CA A9 CD 05 40 AB 2E 7E A8 40 E9 32 4A"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\46b91004\571609c]
"5" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\73320ae2\63e86779]
"4b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\6faf58\34f474d5]
"F" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\6c9a55d4\78d3666c]
"31" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\53ab1129\25acd1c0]
"a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\index57]
"NIUsageMask" = "FF FF FF FF FF FF FF FF FF FF FD"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\6faf58\34f474d5]
"F" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\40087b74\3bb0edb3\60\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\5149b6c8\70e4f760]
"16" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\db950d6\2f66e4ee]
"44" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\2708d9ec\352e0e84]
"18" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\585c020c\7c0832a4]
"37" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\212ef70c\701aec8a]
"41" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\768ca187\29eb70c6\3\InvertDependencies\3e5c014b\2933b5e4]
"35" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\4c0baa3d\6b6b1c13\53]
"SIG" = "BC EB DD 90 43 40 35 45 8D 0A 8A AC 2A E3 93 76"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\65e9966b\102e28b1\59\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\109d7e79\50c7cc18]
"20" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\30bc7c4f\5a99e5cd]
"8" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\179bc95c\2202b9f5]
"34" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\368e5e51\5cbefaea]
"58" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\25ed4857\426d019e\52]
"DisplayName" = "System.Web.RegularExpressions,4.0.0.0,,b03f5f7f11d50a3a"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\50a69a2e\491f93ce]
"13" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\19a3ab9\9adbb50]
"23" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5b86bed\63ca5c10\5f]
"DisplayName" = "System.Drawing.Design,4.0.0.0,,b03f5f7f11d50a3a"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\3693fb48\607100c5]
"2b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\179bc95c\2202b9f5]
"34" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\2a7f0223\16be2bc2]
"1f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\4eb53aa8\50e4c026]
"3e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\585c020c\7c0832a4]
"37" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7dfaa0d2\6ac7e50]
"48" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7e441e10\2807462a]
"1b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\72522657\467dfbf7]
"51" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\46b91004\571609c]
"5" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\46b91004\571609c]
"5" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\505c41c7\52a7cb45]
"33" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\73320ae2\63e86779]
"4b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\505c41c7\52a7cb45]
"33" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\226b2009\768ca187]
"14" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\5fcea75a\57e574f9]
"4c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\4ed0765e\5d0933fc]
"2e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\1c22df2f\6ae28f47]
"1d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\3693fb48\607100c5]
"2b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\4c0baa3d\6b6b1c13\53]
"Status" = "4098"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\57d4b1bf\23a76b5d]
"29" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\4f0ed0af\4b333e2c]
"3b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\209ced07\2cd602a7]
"15" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\50a69a2e\491f93ce]
"13" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\25ed4857\426d019e\52]
"Status" = "4098"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\f3eb9d9\49cb8779]
"3a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\179bc95c\2202b9f5]
"34" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\5a8de2c3\1dfa8c62]
"45" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\6c9a55d4\78d3666c]
"31" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\4d5ecec1\58ac8060]
"9" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\4b235cde\55b9967d]
"12" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\209ced07\2cd602a7]
"15" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\db950d6\2f66e4ee]
"44" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\1bc5b14b\7dd65e4]
"4d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\60049528\69f655c0]
"54" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\77a2835c\447dbcd8]
"25" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\4c0baa3d\6b6b1c13\53]
"LastModTime" = "0E B6 BE 9F A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\552fa235\a3eaecd]
"4a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\3cca06a0\910bc3f]
"4" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\159a66b8\5d94bc56]
"10" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\311f1bc6\78ce3965]
"43" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\2a8ab4f5\43eec18d]
"55" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\768ca187\29eb70c6\3\InvertDependencies\46b91004\571609c]
"5" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\6697a4\58a1f3bd]
"21" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32]
"ILUsageMask" = "FF FF FF FF FF FF FF FF FF FF FF C1"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\55d78379\3d9f8012]
"6" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\740e747\583670c4]
"3f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\index57]
"ILUsageMask" = "FF FF FF FF FF FF FF FF FF FF FF C1"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\6eae2d34\566d82b2]
"22" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\378d4dc7\3be36366]
"1e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\30bc7c4f\5a99e5cd]
"8" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\5f079895\3e0d252d]
"4e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\6eae2d34\566d82b2]
"22" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\226b2009\768ca187]
"14" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\378d4dc7\3be36366]
"1e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\432ba598\2ab76b15]
"2f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\19a3ab9\9adbb50]
"23" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\71d90c39\3eec59d8]
"32" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\368e5e51\5cbefaea]
"58" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5b86bed\63ca5c10\5f]
"SIG" = "9E AC CE 5F 42 A6 CF 46 B5 66 DD 1F EA 78 22 6B"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\5f079895\3e0d252d]
"4e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\2ef268ac\497c9d44]
"4f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\3e5c014b\2933b5e4]
"35" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\414147a5\77165922]
"c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7b7b125f\7b4bfd]
"42" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\3b9d4dd3\a52a751]
"49" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7940d148\2bfa95e0]
"36" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\6eae2d34\566d82b2]
"22" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\1320606e\5f605a0e]
"19" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\209ced07\2cd602a7]
"15" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\5fcea75a\57e574f9]
"4c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\159a66b8\5d94bc56]
"10" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\6087e565\6f05f6e3]
"b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\7e441e10\2807462a]
"1b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\298818d6\3d37e654]
"26" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\25ed4857\426d019e\52]
"LastModTime" = "A8 90 3E A1 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\4c0baa3d\6b6b1c13\53]
"TargetedPatchBand" = "01 31 2E 30 2E 32 31 2D 30 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\432ba598\2ab76b15]
"2f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\429b0dd8\1d9a9270]
"39" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\f3eb9d9\49cb8779]
"3a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\5a8de2c3\1dfa8c62]
"45" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\53775644\6d8a6bc2]
"57" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d0933fc\a425901\28\InvertDependencies\432ba598\2ab76b15]
"2f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\768ca187\29eb70c6\3\InvertDependencies\740e747\583670c4]
"3f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\1bc5b14b\7dd65e4]
"4d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\4f1555b2\4383b32f]
"24" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\57d4b1bf\23a76b5d]
"29" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\6faf58\34f474d5]
"F" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\70e80e6e\51a1b706]
"28" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\44ec6d48\74c9f6c5]
"27" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\70e80e6e\51a1b706]
"28" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\19a3ab9\9adbb50]
"23" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\40087b74\3bb0edb3\60]
"Status" = "8194"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\65e9966b\102e28b1\59]
"LastModTime" = "F8 DF 87 9F A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\6960d6d7\4b18a453]
"3d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32]
"NIUsageMask" = "FF FF FF FF FF FF FF FF FF FF FD"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\48cbec9d\4c0baa3d\53]
"DisplayName" = "System.Design,4.0.0.0,,b03f5f7f11d50a3a"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\561175dc\261d3b7b]
"47" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\7dfaa0d2\6ac7e50]
"48" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\768ca187\29eb70c6\3\InvertDependencies\4eb53aa8\50e4c026]
"3e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\40087b74\3bb0edb3\60]
"LastModTime" = "62 CD 1A A1 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\57d4b1bf\23a76b5d]
"29" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\3b9d4dd3\a52a751]
"49" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\6087e565\6f05f6e3]
"b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\2eb0c927\2f6391bf]
"11" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7e420f89\11c357a1]
"1a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\4ed0765e\5d0933fc]
"2e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\1320606e\5f605a0e]
"19" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\db950d6\2f66e4ee]
"44" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\7f0603e4\ecd2583]
"40" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7f0603e4\ecd2583]
"40" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\4c0baa3d\6b6b1c13\53\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\179bc95c\2202b9f5]
"34" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\311f1bc6\78ce3965]
"43" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\298818d6\3d37e654]
"26" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\2a8ab4f5\43eec18d]
"55" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\3b9d4dd3\a52a751]
"49" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\4eb53aa8\50e4c026]
"3e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\5132fda3\47899b1f]
"46" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\7f0603e4\ecd2583]
"40" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\7940d148\2bfa95e0]
"36" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\768ca187\29eb70c6\3\InvertDependencies\3d67735\7bda07cc]
"7" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\73320ae2\63e86779]
"4b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\2eb0c927\2f6391bf]
"11" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\1bc5b14b\7dd65e4]
"4d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\5fcea75a\57e574f9]
"4c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\64be1fa4\58364143]
"2a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\61e7e666\27e1f7e2]
"17" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32]
"LatestIndex" = "87"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\70e80e6e\51a1b706]
"28" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\77a2835c\447dbcd8]
"25" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\65e9966b\102e28b1\59]
"DisplayName" = "System.Data.OracleClient,4.0.0.0,,b77a5c561934e089"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\46b91004\571609c]
"5" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\4eb53aa8\50e4c026]
"3e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d0933fc\a425901\28\InvertDependencies\4ed0765e\5d0933fc]
"2e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\5764ec77\5f62750e]
"56" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\340dcf4c\55b350eb]
"30" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\25ed4857\426d019e\52]
"TargetedPatchBand" = "01 31 2E 30 2E 32 31 2D 30 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\44ec6d48\74c9f6c5]
"27" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7e441e10\2807462a]
"1b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\5f079895\3e0d252d]
"4e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\545c5dd6\3d40af53]
"3c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\226b2009\768ca187]
"14" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7dfaa0d2\6ac7e50]
"48" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\585c020c\7c0832a4]
"37" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\6f06001f\62a6b5be]
"d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\2ef268ac\497c9d44]
"4f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\6c9a55d4\78d3666c]
"31" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\1bc5b14b\7dd65e4]
"4d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\72522657\467dfbf7]
"51" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\429b0dd8\1d9a9270]
"39" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\7940d148\2bfa95e0]
"36" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\4f0ed0af\4b333e2c]
"3b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\77a2835c\447dbcd8]
"25" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\64be1fa4\58364143]
"2a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\65e9966b\102e28b1\59]
"SIG" = "2E 32 FF D2 C0 99 DA 42 B1 28 5E 01 FE A9 62 52"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BE 55 C6 E5 02 09 00 76 65 73 5C 67 55 55 49 A3"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\3b9d4dd3\a52a751]
"49" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\3693fb48\607100c5]
"2b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\212ef70c\701aec8a]
"41" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\4f0ed0af\4b333e2c]
"3b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\340dcf4c\55b350eb]
"30" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\19a3ab9\9adbb50]
"23" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\368e5e51\5cbefaea]
"58" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\3b9d4dd3\a52a751]
"49" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\61e7e666\27e1f7e2]
"17" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7940d148\2bfa95e0]
"36" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\4eb53aa8\50e4c026]
"3e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\5149b6c8\70e4f760]
"16" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\311f1bc6\78ce3965]
"43" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5b86bed\63ca5c10\5f\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\545c5dd6\3d40af53]
"3c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\212ef70c\701aec8a]
"41" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\3d67735\7bda07cc]
"7" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\740e747\583670c4]
"3f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\72522657\467dfbf7]
"51" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\40087b74\3bb0edb3\60]
"TargetedPatchBand" = "01 31 2E 30 2E 32 31 2D 30 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\552fa235\a3eaecd]
"4a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\768ca187\29eb70c6\3\InvertDependencies\72522657\467dfbf7]
"51" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\212ef70c\701aec8a]
"41" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\212ef70c\701aec8a]
"41" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\55d78379\3d9f8012]
"6" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\53ab1129\25acd1c0]
"a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\30bc7c4f\5a99e5cd]
"8" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\70e80e6e\51a1b706]
"28" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\1904b408\7e673d85]
"2" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7a819b88\1229dc20]
"50" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\3d67735\7bda07cc]
"7" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\7e420f89\11c357a1]
"1a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\77a2835c\447dbcd8]
"25" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\640d09ef\10ac776b]
"e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\65e9966b\102e28b1\59]
"Status" = "8194"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\5f079895\3e0d252d]
"4e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32]
"SystemStoreChangeId" = "227"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\3e5c014b\2933b5e4]
"35" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\f3eb9d9\49cb8779]
"3a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\1a714620\2f0c2e3a]
"1c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\6\InvertDependencies\7a819b88\1229dc20]
"50" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\5764ec77\5f62750e]
"56" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\4f1555b2\4383b32f]
"24" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\5132fda3\47899b1f]
"46" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\768ca187\29eb70c6\3\InvertDependencies\6087e565\6f05f6e3]
"b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\2ef268ac\497c9d44]
"4f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5b86bed\63ca5c10\5f]
"TargetedPatchBand" = "01 31 2E 30 2E 32 31 2D 30 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\4d5ecec1\58ac8060]
"9" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\311f1bc6\78ce3965]
"43" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7b7b125f\7b4bfd]
"42" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\3\InvertDependencies\1904b408\7e673d85]
"2" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\3cca06a0\910bc3f]
"4" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\65246f3f\7\InvertDependencies\53e01c0b\3aecd0a4]
"38" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\60049528\69f655c0]
"54" = ""

The Trojan deletes the following registry key(s):

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\index55]

The process mscorsvw.exe:2568 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3E 0E 7D 8E A6 72 54 6E FB D2 AC B5 F1 A5 44 E1"

The process mscorsvw.exe:1984 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7e420f89\11c357a1]
"1a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\73320ae2\63e86779]
"4b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\42d76e4d\5b86bed\52]
"ILDependencies" = "3F BC 10 09 9E B8 6D 30 09 00 00 00 04 00 00 00"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\7e441e10\2807462a]
"1b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\2a8ab4f5\43eec18d]
"55" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\42d76e4d\5b86bed]
"52" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\311f1bc6\78ce3965]
"43" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\1c22df2f\6ae28f47]
"1d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\298818d6\3d37e654]
"26" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\6697a4\58a1f3bd]
"21" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\1bc5b14b\7dd65e4]
"4d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\740e747\583670c4]
"3f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32]
"ILUsageMask" = "FF FF FF FF FF FF FF FF FF FF FF C1"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\55d78379\3d9f8012]
"6" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\5fcea75a\57e574f9]
"4c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\1320606e\5f605a0e]
"19" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\1a714620\2f0c2e3a]
"1c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\46b91004\571609c]
"5" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\740e747\583670c4]
"3f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\64be1fa4\58364143]
"2a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\378d4dc7\3be36366]
"1e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\3cca06a0\910bc3f]
"4" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\30bc7c4f\5a99e5cd]
"8" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\5f079895\3e0d252d]
"4e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\61e7e666\27e1f7e2]
"17" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\2a8ab4f5\43eec18d]
"55" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\1904b408\7e673d85]
"2" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\2eb0c927\2f6391bf]
"11" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\432ba598\2ab76b15]
"2f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\60049528\69f655c0]
"54" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7f0603e4\ecd2583]
"40" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32]
"LatestIndex" = "88"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\70e80e6e\51a1b706]
"28" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\6960d6d7\4b18a453]
"3d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\368e5e51\5cbefaea]
"58" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\71d90c39\3eec59d8]
"32" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\42d76e4d\5b86bed\52]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\46b91004\571609c]
"5" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32]
"Status" = "1"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\179bc95c\2202b9f5]
"34" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\index58]
"ILUsageMask" = "FF FF FF FF FF FF FF FF FF FF FF C1"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\6faf58\34f474d5]
"F" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\77a2835c\447dbcd8]
"25" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\6c9a55d4\78d3666c]
"31" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\46b91004\571609c]
"5" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\53ab1129\25acd1c0]
"a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\368e5e51\5cbefaea]
"58" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\1320606e\5f605a0e]
"19" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7a819b88\1229dc20]
"50" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\5fcea75a\57e574f9]
"4c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\5149b6c8\70e4f760]
"16" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\5764ec77\5f62750e]
"56" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\5132fda3\47899b1f]
"46" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\index58]
"NIUsageMask" = "FF FF FF FF FF FF FF FF FF FF FF"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\db950d6\2f66e4ee]
"44" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\2708d9ec\352e0e84]
"18" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\64be1fa4\58364143]
"2a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\5764ec77\5f62750e]
"56" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\44ec6d48\74c9f6c5]
"27" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\6c9a55d4\78d3666c]
"31" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\1904b408\7e673d85]
"2" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7e441e10\2807462a]
"1b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\3d67735\7bda07cc]
"7" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\42d76e4d\5b86bed]
"52" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\42d76e4d\5b86bed\52]
"DisplayName" = "System.Drawing.Design,4.0.0.0,,b03f5f7f11d50a3a"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\545c5dd6\3d40af53]
"3c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\414147a5\77165922]
"c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7b7b125f\7b4bfd]
"42" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\226b2009\768ca187]
"14" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\3b9d4dd3\a52a751]
"49" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7940d148\2bfa95e0]
"36" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\6eae2d34\566d82b2]
"22" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\109d7e79\50c7cc18]
"20" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\7e420f89\11c357a1]
"1a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7dfaa0d2\6ac7e50]
"48" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\552fa235\a3eaecd]
"4a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\585c020c\7c0832a4]
"37" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\1bc5b14b\7dd65e4]
"4d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\209ced07\2cd602a7]
"15" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\61e7e666\27e1f7e2]
"17" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\6f06001f\62a6b5be]
"d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\42d76e4d\5b86bed]
"52" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\5fcea75a\57e574f9]
"4c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\368e5e51\5cbefaea]
"58" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\2ef268ac\497c9d44]
"4f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\50a69a2e\491f93ce]
"13" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\42d76e4d\5b86bed\52]
"MVID" = "8F 99 93 D3 EB 4C D3 3D 14 52 15 5F 79 B2 3D 65"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\1a714620\2f0c2e3a]
"1c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\4f0ed0af\4b333e2c]
"3b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\55d78379\3d9f8012]
"6" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\77a2835c\447dbcd8]
"25" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\6087e565\6f05f6e3]
"b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\7e441e10\2807462a]
"1b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\311f1bc6\78ce3965]
"43" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\368e5e51\5cbefaea]
"58" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\1c22df2f\6ae28f47]
"1d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\3693fb48\607100c5]
"2b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\6087e565\6f05f6e3]
"b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\429b0dd8\1d9a9270]
"39" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\70e80e6e\51a1b706]
"28" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\61e7e666\27e1f7e2]
"17" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\3693fb48\607100c5]
"2b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\44ec6d48\74c9f6c5]
"27" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\429b0dd8\1d9a9270]
"39" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\2ef268ac\497c9d44]
"4f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\19a3ab9\9adbb50]
"23" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\368e5e51\5cbefaea]
"58" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\f3eb9d9\49cb8779]
"3a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\5a8de2c3\1dfa8c62]
"45" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\179bc95c\2202b9f5]
"34" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\7f0603e4\ecd2583]
"40" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\6faf58\34f474d5]
"F" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\505c41c7\52a7cb45]
"33" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\561175dc\261d3b7b]
"47" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7940d148\2bfa95e0]
"36" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\4eb53aa8\50e4c026]
"3e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\5149b6c8\70e4f760]
"16" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\5f079895\3e0d252d]
"4e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7a819b88\1229dc20]
"50" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\4f1555b2\4383b32f]
"24" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\57d4b1bf\23a76b5d]
"29" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7dfaa0d2\6ac7e50]
"48" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5b86bed\63ca5c10\5f\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7e441e10\2807462a]
"1b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\159a66b8\5d94bc56]
"10" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\72522657\467dfbf7]
"51" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\545c5dd6\3d40af53]
"3c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\3e5c014b\2933b5e4]
"35" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\19a3ab9\9adbb50]
"23" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\640d09ef\10ac776b]
"e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\46b91004\571609c]
"5" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\6960d6d7\4b18a453]
"3d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\64be1fa4\58364143]
"2a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\212ef70c\701aec8a]
"41" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\226b2009\768ca187]
"14" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\42d76e4d\5b86bed]
"52" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\70e80e6e\51a1b706]
"28" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\72522657\467dfbf7]
"51" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\73320ae2\63e86779]
"4b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\42d76e4d\5b86bed\52]
"ConfigMask" = "4361"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C2 E5 DD C2 9E F3 1A AB 8A 51 6D 2F D7 0C 00 BB"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\179bc95c\2202b9f5]
"34" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\53e01c0b\3aecd0a4]
"38" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\60049528\69f655c0]
"54" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\55d78379\3d9f8012]
"6" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\491f93ce\3fe97dbf\10\InvertDependencies\3d67735\7bda07cc]
"7" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\53ab1129\25acd1c0]
"a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\61e7e666\27e1f7e2]
"17" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\3a50533c\769fc3d5]
"2d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32]
"NIUsageMask" = "FF FF FF FF FF FF FF FF FF FF FF"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\70e80e6e\51a1b706]
"28" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\378d4dc7\3be36366]
"1e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\53775644\6d8a6bc2]
"57" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\561175dc\261d3b7b]
"47" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7ac727df\4c76d55c]
"3" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\5fcea75a\57e574f9]
"4c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\6f06001f\62a6b5be]
"d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\649348ce\60337166]
"2c" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\1c22df2f\6ae28f47]
"1d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\212ef70c\701aec8a]
"41" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\3d67735\7bda07cc]
"7" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\3cca06a0\910bc3f]
"4" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\42d76e4d\5b86bed\52]
"ConfigString" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\7e420f89\11c357a1]
"1a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\640d09ef\10ac776b]
"e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\42d76e4d\5b86bed\52]
"NIDependencies" = "C6 38 19 18 42 CA 99 14 01 00 00 00 04 00 00 00"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\505c41c7\52a7cb45]
"33" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\42d76e4d\5b86bed]
"52" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\57d4b1bf\23a76b5d]
"29" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32]
"SystemStoreChangeId" = "227"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\4f0ed0af\4b333e2c]
"3b" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\432ba598\2ab76b15]
"2f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\f3eb9d9\49cb8779]
"3a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7e420f89\11c357a1]
"1a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\50a69a2e\491f93ce]
"13" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\53e01c0b\3aecd0a4]
"38" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\2eb0c927\2f6391bf]
"11" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\159a66b8\5d94bc56]
"10" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7ac727df\4c76d55c]
"3" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\3cca06a0\910bc3f]
"4" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\3d67735\7bda07cc]
"7" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\4ed0765e\5d0933fc]
"2e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\2708d9ec\352e0e84]
"18" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\3b9d4dd3\a52a751]
"49" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\5764ec77\5f62750e]
"56" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\179bc95c\2202b9f5]
"34" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\5a8de2c3\1dfa8c62]
"45" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\4f1555b2\4383b32f]
"24" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\6c9a55d4\78d3666c]
"31" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\4d5ecec1\58ac8060]
"9" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\48cbec9d\4c0baa3d]
"53" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\4b235cde\55b9967d]
"12" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\209ced07\2cd602a7]
"15" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\7f0603e4\ecd2583]
"40" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\53e01c0b\3aecd0a4]
"38" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\340dcf4c\55b350eb]
"30" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\3e5c014b\2933b5e4]
"35" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\db950d6\2f66e4ee]
"44" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\311f1bc6\78ce3965]
"43" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\340dcf4c\55b350eb]
"30" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\60049528\69f655c0]
"54" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\298818d6\3d37e654]
"26" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\552fa235\a3eaecd]
"4a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\2a8ab4f5\43eec18d]
"55" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\585c020c\7c0832a4]
"37" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\4d5ecec1\58ac8060]
"9" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\1c22df2f\6ae28f47]
"1d" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\4eb53aa8\50e4c026]
"3e" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\9\InvertDependencies\311f1bc6\78ce3965]
"43" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\7b7b125f\7b4bfd]
"42" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\5132fda3\47899b1f]
"46" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\2a7f0223\16be2bc2]
"1f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\6eae2d34\566d82b2]
"22" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\4e1b5ff2\21\InvertDependencies\64be1fa4\58364143]
"2a" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5b86bed\63ca5c10\5f\InvertDependencies\42d76e4d\5b86bed]
"52" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\1\InvertDependencies\2a7f0223\16be2bc2]
"1f" = ""

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\8\InvertDependencies\60049528\69f655c0]
"54" = ""

The Trojan deletes the following registry key(s):

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\index56]

The process mscorsvw.exe:2540 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A0 09 A4 BF 3B 35 96 8D CD D9 9F E2 BE 0D 4D C6"

The process mscorsvw.exe:2132 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "62 0C 02 E1 27 90 A4 FC 47 21 73 43 8E 3C 23 62"

The process mscorsvw.exe:1616 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C4 9A A7 02 D0 32 1A 64 39 A3 B8 AA 77 80 5A 52"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:2300 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7D 1B 0A 46 DD 06 A9 59 C6 5F A1 49 92 88 3C D9"

The process mscorsvw.exe:772 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C0 D1 77 B8 C3 EE B4 DE 84 34 87 21 F0 AF BE CB"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:2384 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2A 40 54 8E 3F 15 98 81 A9 35 F4 A5 87 11 D5 44"

The process mscorsvw.exe:572 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3E B5 C5 0A 4A 28 93 0A 7B 6C 2D B1 BF 39 05 BD"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:2240 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E0 12 8C 24 C5 11 57 57 68 E6 AF 29 F3 31 40 3B"

The process mscorsvw.exe:2816 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0E B9 F3 A6 7A 88 CF B6 F0 64 C0 49 2B 7D 5F 0D"

The process mscorsvw.exe:3584 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3C A7 9A B1 3D A1 CC 74 0E 35 18 7E AB 9C E4 06"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:2720 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C8 0D DF 5A FA 7D 3D 4C DE 2E A9 F6 EC C2 5B 79"

The process mscorsvw.exe:3744 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9A 5B 23 5A 70 54 AE 7F 5E 84 50 36 10 A0 DC 5A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:2468 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B9 98 C9 89 A2 A4 5E D6 CE 13 BB EE 4D 83 43 23"

The process mscorsvw.exe:3708 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "34 55 1F 11 DA 98 66 E3 1A AB 17 92 E4 46 71 95"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:3356 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3E 55 BC 9A 2E C5 6A 8B 92 C3 F0 7D A4 B7 11 20"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:1952 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1C 87 5B C3 3D 46 99 85 85 00 DF 08 65 CA 6F 65"

The process mscorsvw.exe:4040 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "29 EF D1 89 EA 52 56 F6 39 67 1A AC 53 7F 81 0D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:2956 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "77 1B DD FD EA 1D 32 66 9A 16 6B CE 80 01 DC 9D"

The process mscorsvw.exe:3640 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AA 91 0C F4 46 59 37 64 AC 1B CE 51 FE F8 56 2D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:1284 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9B EC 5F A2 64 DD 16 7C E1 FE 9D FA 20 EC 69 24"

The process mscorsvw.exe:1044 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "74 A8 7F 02 AC 02 61 53 7E 5B 00 B6 C4 E1 24 88"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:3896 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "22 A1 6E 1C 96 B4 A8 B5 07 F7 86 8A C2 FE AB 9F"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\ListenedState]
"RootstoreDirty" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\State]
"AccumulatedWaitIdleTime" = "0"

The process mscorsvw.exe:3016 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CD 78 0C 31 D7 6B 06 16 7B 24 B2 CE 1C D9 F3 4F"

The process mscorsvw.exe:2672 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "02 6B FE 96 76 01 6D D4 EF 6A 79 02 1E 2C 1D 20"

The process mscorsvw.exe:352 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB 72 75 C8 45 79 E9 4B 93 71 23 83 B7 64 C5 CF"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:3848 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "15 0F 3E 1C D7 81 16 76 3B 0A 97 42 30 54 63 7F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process mscorsvw.exe:3532 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D7 83 3C A7 14 41 80 F6 BC 75 DE 74 69 05 27 D8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process %original file name%.exe:1724 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1A AB EB 0E 29 E7 8F C9 41 63 B8 08 4C 97 B4 83"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\RarSFX0]
"idman621f.exe" = "Internet Download Manager installer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\RarSFX0]
"support.exe" = "This installer database contains the logic and data required to install Support."

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process MsiExec.exe:2192 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "29 55 7C CF E3 4D CA 88 53 87 42 E2 EC B9 36 EF"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process MsiExec.exe:2492 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.WorkflowServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Web.DataVisualization,4.0.0.0,,31bf3856ad364e35,MSIL" = "56 B0 3A A0 A8 11 D1 01"
"System.Data.Entity.Design,4.0.0.0,,b77a5c561934e089,MSIL" = "DC 91 79 9F A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=x86\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Workflow.ComponentModel,4.0.0.0,,31bf3856ad364e35,MSIL" = "2E 9F AE A1 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Data.Services.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"Microsoft.Build.Tasks.v4.0,4.0.0.0,,b03f5f7f11d50a3a,MSIL" = "3E D0 DC A0 A8 11 D1 01"
"System.Web.Extensions.Design,4.0.0.0,,31bf3856ad364e35,MSIL" = "E8 AE 59 A0 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Web.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{4B861EBF-6843-416A-9BA8-6BAB08050610}]
"(Default)" = "install System.Windows.Forms.DataVisualization.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{81325DA4-A2B9-46CE-A9BD-7A73BD33FBA9}]
"(Default)" = "install System.Workflow.Runtime, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Web.DynamicData.Design,4.0.0.0,,31bf3856ad364e35,MSIL" = "4E 01 0B A0 A8 11 D1 01"
"System.Xaml.Hosting,4.0.0.0,,31bf3856ad364e35,MSIL" = "36 4E DE A1 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Windows.Forms.DataVisualization.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\PresentationBuildTasks, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Data.OracleClient,4.0.0.0,,b77a5c561934e089,x86" = "F8 DF 87 9F A8 11 D1 01"
"System.Design,4.0.0.0,,b03f5f7f11d50a3a,MSIL" = "0E B6 BE 9F A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\Microsoft.Build.Framework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{5081A45B-FFFB-4484-BC0E-A063C404CB2B}]
"(Default)" = "install System.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a /NoDependencies /queue:1 /nologo /netfxpri1"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{8599635E-E655-46D3-AEEA-CFF0E1233F24}]
"(Default)" = "install System.ServiceModel.ServiceMoniker40, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Web.Entity.Design,4.0.0.0,,b77a5c561934e089,MSIL" = "C4 B1 1B A0 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{7FBD49AE-BAEF-44DB-81C5-65E921E28998}]
"(Default)" = "install System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Drawing.Design,4.0.0.0,,b03f5f7f11d50a3a,MSIL" = "EC EF D8 9F A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\Microsoft.Build, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{F0D6B202-8F47-48B9-ACA9-94CD9741F82E}]
"(Default)" = "install Microsoft.Build.Tasks.v4.0, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"Microsoft.Workflow.Compiler,4.0.0.0,,31bf3856ad364e35,MSIL" = "78 A3 51 A1 A8 11 D1 01"
"System.Data.Services.Design,4.0.0.0,,b77a5c561934e089,MSIL" = "14 2E 96 9F A8 11 D1 01"
"StoreChangeIDFor64BitProcesses" = "166"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{5436CFCD-5A2E-49DF-A30E-163DE766DB88}]
"(Default)" = "install System.Web.Abstractions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"Microsoft.Build.Framework,4.0.0.0,,b03f5f7f11d50a3a,MSIL" = "6E BD C9 A0 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\Microsoft.VisualC.STLCLR, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\Microsoft.Build.Tasks.v4.0, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{34CBD628-D83B-4D82-995D-C0EA70F5551C}]
"(Default)" = "install System.Web.Extensions.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Web.Entity.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{24402CF6-ADBB-478B-A57E-54FCBC978AC8}]
"(Default)" = "install %WinDir%\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Web.Routing,4.0.0.0,,31bf3856ad364e35,MSIL" = "5E 5F 6A A0 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Data.Entity.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{8EE0FF2D-EF3D-4DE3-AAEB-C96B18B5AC71}]
"(Default)" = "install System.Web.DataVisualization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{6B49CD46-9442-4EC7-BC3C-F744392F7A9D}]
"(Default)" = "install System.ServiceModel.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{02AD274F-7EBB-4767-B328-5F9660867A54}]
"(Default)" = "install AspNetMMCExt, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Web.RegularExpressions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Web.Entity,4.0.0.0,,b77a5c561934e089,MSIL" = "86 9D 27 A0 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{A5104A72-86F7-40D8-BCD0-11B537BFFEBE}]
"(Default)" = "install Microsoft.Workflow.Compiler, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"Microsoft.Build,4.0.0.0,,b03f5f7f11d50a3a,MSIL" = "DC BE AA A0 A8 11 D1 01"
"System.ServiceModel.WasHosting,4.0.0.0,,b77a5c561934e089,MSIL" = "B0 3F 6E A1 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{ABB9A98B-1C9A-4CBB-BCC5-8833745DD704}]
"(Default)" = "install Microsoft.Build.Utilities.v4.0, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{7845D75A-B668-40FB-8E40-4FDC41BAFAAA}]
"(Default)" = "install System.Web.DataVisualization.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{0A039F53-BB78-43B4-8B2A-8034CD28A1E9}]
"(Default)" = "install Microsoft.Build.Engine, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{B9743B3C-DA68-48F9-B2EB-6F8CE89D7301}]
"(Default)" = "install System.Workflow.ComponentModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Web.DataVisualization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Workflow.ComponentModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"AspNetMMCExt,4.0.0.0,,b03f5f7f11d50a3a,MSIL" = "84 93 00 A1 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{1D9E33A6-FC41-4B2F-B058-5D8CE6D2FE09}]
"(Default)" = "install System.Workflow.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{35041460-F91F-429E-8B1D-C174A86760D8}]
"(Default)" = "install System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Web.Abstractions,4.0.0.0,,31bf3856ad364e35,MSIL" = "16 65 EE 9F A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\Microsoft.Build.Conversion.v4.0, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{1CC5409A-3CE2-435A-869C-3B4414EC3B20}]
"(Default)" = "install System.WorkflowServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{107D49CA-C6B0-455B-A6DA-5BC3DDC39780}]
"(Default)" = "install System.Web.Mobile, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Data.OracleClient, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=x86\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\Microsoft.Workflow.Compiler, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{72B6E2AD-1847-42E7-8F41-E9825637F060}]
"(Default)" = "install System.Runtime.Caching, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"StoreChangeIDFor32BitProcesses" = "187"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB FB 11 BE 5C AB A0 09 AA 03 82 46 F7 DE 1C FC"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{D09DE84F-CE7A-491E-877F-6449E9514E89}]
"(Default)" = "install System.Web.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Web.DataVisualization.Design,4.0.0.0,,31bf3856ad364e35,MSIL" = "CC 60 4B A0 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Web.Extensions.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Runtime.Caching,4.0.0.0,,b03f5f7f11d50a3a,MSIL" = "C0 43 6B 9F A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{E8C58978-1C4F-481B-A943-2BA052A0BFF3}]
"(Default)" = "install System.Web.Entity, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"XamlBuildTask,4.0.0.0,,31bf3856ad364e35,MSIL" = "AC FE EE A1 A8 11 D1 01"
"StoreChangeID" = "188"
"System.WorkflowServices,4.0.0.0,,31bf3856ad364e35,MSIL" = "1A 00 D0 A1 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Xaml.Hosting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{ECEEFE61-B8A9-40A1-BBF8-D34358338DB5}]
"(Default)" = "install Microsoft.Build, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"Microsoft.Build.Conversion.v4.0,4.0.0.0,,b03f5f7f11d50a3a,MSIL" = "66 0E 9A A0 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.ServiceModel.ServiceMoniker40, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{2E03E10B-ABF3-4348-BA6F-7E45A2A43886}]
"(Default)" = "install XamlBuildTask, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{9A0D2850-13BC-442B-9567-8E14308EC73E}]
"(Default)" = "install System.Data.OracleClient, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Web.DynamicData, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Web.Mobile,4.0.0.0,,b03f5f7f11d50a3a,MSIL" = "8C 42 30 A1 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Web.Entity, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Web,4.0.0.0,,b03f5f7f11d50a3a,x86" = "62 CD 1A A1 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{0B0609B6-17BB-44ED-8E7B-503DB3FABD48}]
"(Default)" = "install PresentationBuildTasks, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Workflow.Activities,4.0.0.0,,31bf3856ad364e35,MSIL" = "5E 8C 9B A1 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{625DE7FC-9162-4EA3-B7C2-156C367EA3F1}]
"(Default)" = "install System.ServiceModel.Activation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{F0A5C196-29CE-4B05-9027-6964C23B2B72}]
"(Default)" = "install System.Web.DynamicData.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{F630FF42-B742-4806-AC55-119EFD8B7182}]
"(Default)" = "install Microsoft.Build.Conversion.v4.0, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{F517B337-E306-4DB6-BCB7-B3DF5E45E8FB}]
"(Default)" = "install System.Web.RegularExpressions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.ServiceModel.Web,4.0.0.0,,31bf3856ad364e35,MSIL" = "E8 DB 8A A1 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{47710961-8CBA-4C7F-A1B6-3D09F0BA62CE}]
"(Default)" = "install System.Web.DynamicData, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.ServiceModel.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.ServiceModel.WasHosting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\Microsoft.Build.Engine, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Workflow.Runtime,4.0.0.0,,31bf3856ad364e35,MSIL" = "A4 4F BF A1 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{A8407368-C2CC-4527-A58B-DA69E3EC60BD}]
"(Default)" = "install Microsoft.Build.Framework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.ServiceModel.Activation,4.0.0.0,,31bf3856ad364e35,MSIL" = "CC 8D 7C A1 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{ABEA4575-7209-4F72-B875-0283B81AB9DB}]
"(Default)" = "install System.Web.Entity.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"Microsoft.Build.Engine,4.0.0.0,,b03f5f7f11d50a3a,MSIL" = "52 6F BB A0 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{16041400-BAA4-4BC6-BB78-95B6A6311B22}]
"(Default)" = "install System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32]
"SystemStoreChangeId" = "187"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Drawing.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"Microsoft.Build.Utilities.v4.0,4.0.0.0,,b03f5f7f11d50a3a,MSIL" = "B4 80 ED A0 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.ServiceModel.Activation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{1A0AE05F-5E03-4DC5-9D6B-DE0363564289}]
"(Default)" = "install System.Xaml.Hosting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Web.Abstractions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Web.DataVisualization.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\XamlBuildTask, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{5F7D2414-D352-417F-896D-46C95DE6B544}]
"(Default)" = "install System.Data.Services.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\AspNetMMCExt, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Web.RegularExpressions,4.0.0.0,,b03f5f7f11d50a3a,MSIL" = "A8 90 3E A1 A8 11 D1 01"
"System.Web.Extensions,4.0.0.0,,31bf3856ad364e35,MSIL" = "D4 0F 7B A0 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Workflow.Runtime, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Runtime.Caching, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"Microsoft.VisualC.STLCLR,2.0.0.0,,b03f5f7f11d50a3a,MSIL" = "A4 F5 5C 9F A8 11 D1 01"
"System.Windows.Forms.DataVisualization.Design,4.0.0.0,,31bf3856ad364e35,MSIL" = "A4 22 8E A0 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Workflow.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{8E2DCDD1-EDCE-468E-B788-9147D39CEB68}]
"(Default)" = "install System.Drawing.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a /NoDependencies /queue:1 /nologo /netfxpri1"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.ServiceModel.ServiceMoniker40,4.0.0.0,,b77a5c561934e089,MSIL" = "94 F1 5F A1 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{1F2828E6-0236-4D6C-A904-E482193265C2}]
"(Default)" = "install System.Data.Entity.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"System.Web.DynamicData,4.0.0.0,,31bf3856ad364e35,MSIL" = "32 B3 FC 9F A8 11 D1 01"
"System.Data.Services,4.0.0.0,,b77a5c561934e089,MSIL" = "30 7C A4 9F A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Web.DynamicData.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default]
"PresentationBuildTasks,4.0.0.0,,31bf3856ad364e35,MSIL" = "C8 4C FD A1 A8 11 D1 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\Microsoft.Build.Utilities.v4.0, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{E62F1F07-607D-48C1-8A76-41D1A40AEC4B}]
"(Default)" = "install %WinDir%\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe /NoDependencies /queue:3 /nologo"

[HKLM\SOFTWARE\Microsoft\.NETFramework\Fusion\References\System.Web.Mobile, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = ".NET Framework Redist Setup"

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{03AA07EE-8EF4-47C6-91B0-587AE8E058FA}]
"(Default)" = "install %WinDir%\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe /NoDependencies /queue:3 /nologo"

The process MsiExec.exe:2732 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "57 BD CE EA B1 F2 10 95 3F 73 BB 13 77 DC CD 2F"

The process ServiceModelReg.exe:2756 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1F 7F 80 05 BD AE 74 C8 96 A4 74 20 AC E8 18 E0"

The process unlodctr.exe:2632 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E0 FF 5B 0F A7 21 21 4E A4 B3 FF 4F 09 39 35 72"

The process mofcomp.exe:3252 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BD 05 40 1D 94 20 1B 8F 0C 8F 86 D1 03 85 11 D7"

[HKLM\SOFTWARE\Microsoft\WBEM\CIMOM]
"Autorecover MOFs timestamp" = "130905280148333750"
"Autorecover MOFs" = "%System%\WBEM\cimwin32.mof, %System%\WBEM\cimwin32.mfl, %System%\WBEM\system.mof, %System%\WBEM\wmipcima.mof, %System%\WBEM\wmipcima.mfl, %System%\WBEM\regevent.mof, %System%\WBEM\regevent.mfl, %System%\WBEM\ntevt.mof, %System%\WBEM\ntevt.mfl, %System%\WBEM\secrcw32.mof, %System%\WBEM\secrcw32.mfl, %System%\WBEM\dsprov.mof, %System%\WBEM\dsprov.mfl, %System%\WBEM\msi.mof, %System%\WBEM\msi.mfl, %System%\WBEM\policman.mof, %System%\WBEM\policman.mfl, %System%\WBEM\subscrpt.mof, %System%\WBEM\wmi.mof, %System%\WBEM\wmi.mfl, %System%\WBEM\scm.mof, %System%\WBEM\fevprov.mof, %System%\WBEM\fevprov.mfl, %System%\WBEM\wmitimep.mof, %System%\WBEM\wmitimep.mfl, %System%\WBEM\wmipdskq.mof, %System%\WBEM\wmipdskq.mfl, %System%\WBEM\wmipicmp.mof0"

The process dotNetFx40_Full_setup.exe:652 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A1 29 EA F1 B4 37 8B F3 13 C0 05 80 46 A1 25 E7"

The process TMP12.tmp.exe:2324 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "97 97 23 C5 18 72 09 D4 B2 E8 34 DC 67 4D F0 74"

The process Autoupdate.exe:3448 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "12 55 13 CE E7 C3 C7 C7 95 9A 2F 2D A5 AB 85 75"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\LocalService\Cookies"
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"

The process ngen.exe:3920 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.Net/Framework/v3.0/WPF/PresentationFontCache.exe\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.DataVisualization.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Abstractions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 9E 00 00 00 57 00 69"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.DynamicData.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.Composition, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"ImageList" = "08 00 00 00 01 4A 51 8B 84 1F 06 EE 4F 07 32 01"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"ImageList" = "0D 00 00 00 01 01 1F 8E 31 D1 97 B4 CC B6 A6 1C"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"ImageList" = "0C 00 00 00 01 87 A7 13 CE E6 13 D0 8E E0 4A E9"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Mobile, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Extensions.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.DynamicData, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 9E 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 B2 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Priority" = "1"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.Runtime, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Workflow.Compiler, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 A4 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"ImageList" = "05 00 00 00 01 9D F6 1E C7 AA D3 9F E0 BA C8 21"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/MSBuild.exe\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.RegularExpressions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 A4 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 BC 00 00 00 50 00 72"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 9C 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.Net/Framework/v3.0/WPF/PresentationFontCache.exe\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.DynamicData.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/MSBuild.exe\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.Net/Framework/v3.0/WPF/PresentationFontCache.exe\0]
"ImageList" = "08 00 00 00 01 4C E7 FD 62 D4 10 7F BE 99 6A B3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xaml.Hosting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"ImageList" = "04 00 00 00 01 96 4D A0 27 EB CA 3B 26 3A 05 CA"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms.DataVisualization.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Tasks.v4.0, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\AspNetMMCExt, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 C0 00 00 00 50 00 72"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 BC 00 00 00 50 00 72"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.Composition, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 98 00 00 00 6D 00 73"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"ImageList" = "05 00 00 00 01 81 D2 54 0B C1 C1 81 90 D0 43 1D"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Mobile, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"KeepPriority" = "1"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"ImageList" = "08 00 00 00 01 5F 66 9E 81 9D A7 01 0C 1D CA 34"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.OracleClient, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/WsatConfig.exe\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 A4 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 BC 00 00 00 50 00 72"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Activation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/ComSvcConfig.exe\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Framework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.ComponentModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Caching, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\XamlBuildTask, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"ImageList" = "0A 00 00 00 01 17 E0 20 AE 92 D7 FA B3 3B CC 1C"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.ComponentModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms.DataVisualization.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/WsatConfig.exe]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/MSBuild.exe]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.Composition, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Caching, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.DataVisualization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Abstractions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 9E 00 00 00 57 00 69"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.DataVisualization.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"ImageList" = "05 00 00 00 01 C9 8C B6 5A 79 CF CC B4 4E A7 27"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.OracleClient, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.ServiceMoniker40, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Abstractions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 A2 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/ComSvcConfig.exe\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.WorkflowServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Workflow.Compiler, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"ImageList" = "05 00 00 00 01 DD 57 BC 19 F5 80 7C 6D BE 8F 88"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 A8 00 00 00 50 00 72"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Tasks.v4.0, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.Composition, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 CA 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"ImageList" = "0C 00 00 00 01 D1 76 06 E8 13 F0 13 76 BD 0D EF"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Conversion.v4.0, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"ImageList" = "05 00 00 00 01 E9 97 D0 20 0C 25 F7 DB 6B D3 23"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"KeepPriority" = "1"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Engine, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Engine, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"ImageList" = "04 00 00 00 01 BA 0E 3A 22 21 1B A7 34 3E 01 16"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\AspNetMMCExt, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 B2 00 00 00 50 00 72"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"ImageList" = "01 00 00 00 00 02 00 00 00 B2 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 A8 00 00 00 50 00 72"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"ImageList" = "0E 00 00 00 01 C1 E1 6B 40 E3 0A 05 C3 9B E8 AE"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"ImageList" = "05 00 00 00 01 0E 83 AA C3 7B 26 23 F1 A2 4C 70"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.Composition, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"ImageList" = "0B 00 00 00 01 92 CC CE DC 7C DA 41 3F F6 FC 64"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Entity, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"ImageList" = "09 00 00 00 01 35 55 F5 F7 4C 56 FA 92 C0 AB 7A"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Caching, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Entity.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xaml.Hosting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"ImageList" = "06 00 00 00 01 11 A9 CF 08 E5 BB 06 E0 77 0B 2B"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.DataVisualization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Utilities.v4.0, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Entity.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"ImageList" = "09 00 00 00 01 13 31 EE 3A 71 46 21 83 88 53 7A"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationBuildTasks, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.RegularExpressions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.WorkflowServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\XamlBuildTask, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationBuildTasks, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/WsatConfig.exe\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.OracleClient, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Framework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Engine, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Activation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"ImageList" = "05 00 00 00 01 36 C6 CF D5 D4 E8 0D 5C 54 8F 82"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\ListenedState]
"RootstoreDirty" = "1"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Entity, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 C2 00 00 00 50 00 72"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.WorkflowServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.Net/Framework/v3.0/WPF/PresentationFontCache.exe\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"ImageList" = "01 00 00 00 00 02 00 00 00 A2 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 98 00 00 00 6D 00 73"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 B0 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Activation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"ImageList" = "16 00 00 00 01 7F 91 EE CD A3 FF 7C E4 78 14 6B"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Utilities.v4.0, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"ImageList" = "05 00 00 00 01 3F 18 BF F5 10 7C 9A 8A CC AE 6C"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.Net/Framework/v3.0/WPF/PresentationFontCache.exe]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Framework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 9E 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 A8 00 00 00 4D 00 69"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.ComponentModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"ImageList" = "12 00 00 00 01 39 63 E9 CE 8D 44 F5 0E 83 67 E9"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Entity.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 BC 00 00 00 50 00 72"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 B0 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Conversion.v4.0, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"ImageList" = "07 00 00 00 01 71 36 47 B9 87 B1 40 A1 7E 3C 4F"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 C0 00 00 00 50 00 72"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms.DataVisualization.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.Net/Framework/v3.0/WPF/PresentationFontCache.exe\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 9E 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Services.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 9E 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Entity.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.Net/Framework/v3.0/WPF/PresentationFontCache.exe\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Tasks.v4.0, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"ImageList" = "07 00 00 00 01 B9 74 F6 C1 7D 17 A5 33 AD F6 E7"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 A8 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.DynamicData.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 94 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.Composition, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Conversion.v4.0, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 C2 00 00 00 50 00 72"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Extensions.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"ImageList" = "0A 00 00 00 01 3D 8C 79 C4 5A A6 74 E4 3F 07 5E"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\XamlBuildTask, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.Runtime, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Services.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"ImageList" = "09 00 00 00 01 F5 E0 29 E2 21 5C 95 AB 38 A1 EE"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Entity, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.ServiceMoniker40, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Priority" = "1"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"ImageList" = "09 00 00 00 01 01 6F 9A 15 0F CE 0E 0A 4C 93 53"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.Runtime, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 9C 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.Composition, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.DynamicData, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"ImageList" = "0A 00 00 00 01 05 50 3F 37 AE F5 26 1D 80 CC CA"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Services.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"ImageList" = "06 00 00 00 01 07 03 02 14 37 C2 EC 71 21 3A 6B"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Mobile, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"ImageList" = "01 00 00 00 01 32 E6 F7 03 C1 14 F3 A9 71 CB E7"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/ComSvcConfig.exe]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationBuildTasks, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 A8 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Utilities.v4.0, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 94 00 00 00 53 00 79"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Entity.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.DataVisualization.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"ImageList" = "12 00 00 00 01 60 42 1D DA 88 80 0B 14 DC 10 1E"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EE 27 FF 0F 93 C5 24 56 C4 28 46 53 93 EE 45 DB"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.RegularExpressions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"ImageList" = "09 00 00 00 01 04 05 71 D6 5D C8 22 E5 DF 02 0D"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.DynamicData, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 B2 00 00 00 50 00 72"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Entity.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Workflow.Compiler, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.DataVisualization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"ImageList" = "0B 00 00 00 01 B7 64 AE B8 80 06 08 5C 9C C4 20"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.Net/Framework/v3.0/WPF/PresentationFontCache.exe\1]
"ImageList" = "01 00 00 00 00 02 00 00 00 8C 00 00 00 43 00 3A"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"ImageList" = "01 00 00 00 01 24 6F 1A 5A BB 68 6B 9D CD F2 2D"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Extensions.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xaml.Hosting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"RuntimeVersion" = "v2.0.50727"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.Composition, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"RuntimeVersion" = "v4.0.30319"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "5"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\AspNetMMCExt, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.ServiceMoniker40, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Scenario" = "32"

The Trojan deletes the following registry key(s):

[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{E8C58978-1C4F-481B-A943-2BA052A0BFF3}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{02AD274F-7EBB-4767-B328-5F9660867A54}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{B9743B3C-DA68-48F9-B2EB-6F8CE89D7301}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{625DE7FC-9162-4EA3-B7C2-156C367EA3F1}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.Net/Framework/v3.0/WPF/PresentationFontCache.exe\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.Net/Framework/v3.0/WPF/PresentationFontCache.exe\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{24402CF6-ADBB-478B-A57E-54FCBC978AC8}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{5081A45B-FFFB-4484-BC0E-A063C404CB2B}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{8EE0FF2D-EF3D-4DE3-AAEB-C96B18B5AC71}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{F630FF42-B742-4806-AC55-119EFD8B7182}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{35041460-F91F-429E-8B1D-C174A86760D8}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{1A0AE05F-5E03-4DC5-9D6B-DE0363564289}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{ABEA4575-7209-4F72-B875-0283B81AB9DB}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{2E03E10B-ABF3-4348-BA6F-7E45A2A43886}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{1CC5409A-3CE2-435A-869C-3B4414EC3B20}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{A8407368-C2CC-4527-A58B-DA69E3EC60BD}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{F0D6B202-8F47-48B9-ACA9-94CD9741F82E}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{6B49CD46-9442-4EC7-BC3C-F744392F7A9D}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{0B0609B6-17BB-44ED-8E7B-503DB3FABD48}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{F517B337-E306-4DB6-BCB7-B3DF5E45E8FB}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{A5104A72-86F7-40D8-BCD0-11B537BFFEBE}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{5436CFCD-5A2E-49DF-A30E-163DE766DB88}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{1F2828E6-0236-4D6C-A904-E482193265C2}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{1D9E33A6-FC41-4B2F-B058-5D8CE6D2FE09}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{7FBD49AE-BAEF-44DB-81C5-65E921E28998}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{107D49CA-C6B0-455B-A6DA-5BC3DDC39780}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.Composition, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.Composition, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{81325DA4-A2B9-46CE-A9BD-7A73BD33FBA9}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{ECEEFE61-B8A9-40A1-BBF8-D34358338DB5}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{72B6E2AD-1847-42E7-8F41-E9825637F060}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{16041400-BAA4-4BC6-BB78-95B6A6311B22}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{03AA07EE-8EF4-47C6-91B0-587AE8E058FA}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{0A039F53-BB78-43B4-8B2A-8034CD28A1E9}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{9A0D2850-13BC-442B-9567-8E14308EC73E}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{4B861EBF-6843-416A-9BA8-6BAB08050610}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{7845D75A-B668-40FB-8E40-4FDC41BAFAAA}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{D09DE84F-CE7A-491E-877F-6449E9514E89}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{E62F1F07-607D-48C1-8A76-41D1A40AEC4B}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{5F7D2414-D352-417F-896D-46C95DE6B544}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{8599635E-E655-46D3-AEEA-CFF0E1233F24}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{ABB9A98B-1C9A-4CBB-BCC5-8833745DD704}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{8E2DCDD1-EDCE-468E-B788-9147D39CEB68}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{F0A5C196-29CE-4B05-9027-6964C23B2B72}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{34CBD628-D83B-4D82-995D-C0EA70F5551C}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\NGenQueueMSI\WIN32\Default\{47710961-8CBA-4C7F-A1B6-3D09F0BA62CE}]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]

The process ngen.exe:3888 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.Net/Framework/v3.0/WPF/PresentationFontCache.exe\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xaml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceProcess, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn.Contract, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Net, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/SMDiagnostics.dll]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Web, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.ServiceModel.dll\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel.Selectors, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v2.0.50727/dfsvc.exe\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Printing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationUI, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/SMSvcHost.exe\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Accessibility, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/Microsoft.Transactions.Bridge.dll\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Input.Manipulations, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.DataAnnotations, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationBuildTasks, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.EnterpriseServices, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.ApplicationServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.ComponentModel, Version=3.0.0.000000, Culture=neutral, PublicKeyToken=31BF3856AD364E35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities.Core.Presentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.Protocols, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClientsideProviders, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Serialization, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/SMSvcHost.exe\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Framework, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationBuildTasks, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities.Core.Presentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.SqlXml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Utilities.v3.5, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Messaging, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Deployment, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/WsatConfig.exe\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Presentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Tasks.v3.5, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities.Presentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Printing, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel.Selectors, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Framework, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel.Selectors, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualC, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IO.Log, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Services, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\CustomMarshalers, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.RegularExpressions, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v2.0.50727/dfsvc.exe\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationTypes, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn.Contract, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.AccountManagement, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\ReachFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/Microsoft.Transactions.Bridge.Dtc.dll\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.RegularExpressions, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.WorkflowServices, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic.Compatibility.Data, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities.DurableInstancing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\SMDiagnostics, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xaml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Transactions, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Mobile, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Management.Instrumentation, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/Microsoft.Transactions.Bridge.Dtc.dll\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\ReachFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.Composition, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.Composition, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Deployment, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Presentation, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationTypes, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Printing, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/Microsoft.Transactions.Bridge.dll]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.ComponentModel, Version=3.0.0.000000, Culture=neutral, PublicKeyToken=31BF3856AD364E35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/SMDiagnostics.dll\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IO.Log, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationTypes, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities.Core.Presentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Numerics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic, Version=8.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Presentation, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Services, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/Microsoft.Transactions.Bridge.dll\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots]
"WorkPending" = "1"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Services.Client, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Mobile, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\AspNetMMCExt, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/dfsvc.exe\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.DataSetExtensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.EnterpriseServices, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Services, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Net, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn.Contract, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic, Version=8.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Remoting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationProvider, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationProvider, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Engine, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Printing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\CustomMarshalers, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xaml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Framework, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Serialization, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClientsideProviders, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/SMSvcHost.exe\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClientsideProviders, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms.DataVisualization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Management.Instrumentation, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Conversion.v3.5, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.SqlXml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Security, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\ReachFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel.Selectors, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.IdentityModel.dll\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsFormsIntegration, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.Runtime, Version=3.0.0.000000, Culture=neutral, PublicKeyToken=31BF3856AD364E35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Accessibility, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.IdentityModel.dll\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic.Activities.Compiler, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Printing, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/ComSvcConfig.exe\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Channels, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/dfsvc.exe]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Tasks.v3.5, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceProcess, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Utilities.v3.5, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Extensions.Design, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Transactions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.Composition, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsFormsIntegration, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Speech, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IO.Log, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.DataAnnotations, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Discovery, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Input.Manipulations, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\ReachFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\CustomMarshalers, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\CustomMarshalers, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Deployment, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/SMDiagnostics.dll\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/ServiceModelReg.exe\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Accessibility, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/Microsoft.Transactions.Bridge.Dtc.dll]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualC, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Serialization.Formatters.Soap, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities.Presentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Framework, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Serialization.Formatters.Soap, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xaml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClient, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Tasks, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Speech, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Management.Instrumentation, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge.Dtc, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Serialization.Formatters.Soap, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClientsideProviders, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Printing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.RegularExpressions, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Speech, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Serialization, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Speech, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationTypes, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/SMSvcHost.exe\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.DataAnnotations, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.5/MSBuild.exe]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/WsatConfig.exe\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.Activities, Version=3.0.0.000000, Culture=neutral, PublicKeyToken=31BF3856AD364E35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Tasks, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Serialization, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IO.Log, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Device, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/SMSvcHost.exe]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Accessibility, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.DurableInstancing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.5/MSBuild.exe\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationTypes, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.RegularExpressions, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Printing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn.Contract, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Device, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.SqlXml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Engine, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Speech, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClientsideProviders, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Presentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.DurableInstancing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Web, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Services.Client, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Entity, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Deployment, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationUI, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.5/MSBuild.exe\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.AccountManagement, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Configuration.Install, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.EnterpriseServices, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Transactions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Presentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Remoting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Utilities, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Channels, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/ComSvcConfig.exe\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/ServiceModelReg.exe\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\SMDiagnostics, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.ComponentModel, Version=3.0.0.000000, Culture=neutral, PublicKeyToken=31BF3856AD364E35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Net, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic.Compatibility.Data, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Utilities, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.Runtime, Version=3.0.0.000000, Culture=neutral, PublicKeyToken=31BF3856AD364E35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/Microsoft.Transactions.Bridge.Dtc.dll\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.DataSetExtensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Management.Instrumentation, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.DurableInstancing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge.Dtc, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.IdentityModel.dll\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge.Dtc, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.DataSetExtensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Presentation, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\CustomMarshalers, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/ServiceModelReg.exe\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic.Activities.Compiler, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Conversion.v3.5, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.Protocols, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities.Core.Presentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.Runtime, Version=3.0.0.000000, Culture=neutral, PublicKeyToken=31BF3856AD364E35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Numerics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Mobile, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel.Selectors, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Management.Instrumentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationTypes, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Engine, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.Runtime.Serialization.dll\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Messaging, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/WsatConfig.exe]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Engine, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\CustomMarshalers, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Channels, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.IdentityModel.dll]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationProvider, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Entity, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.5/MSBuild.exe\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Numerics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn.Contract, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IO.Log, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn.Contract, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.AccountManagement, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\SMDiagnostics, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.DataSetExtensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Device, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClient, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Security, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Accessibility, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms.DataVisualization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Engine, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Discovery, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Management.Instrumentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.AccountManagement, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Accessibility, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Transactions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Extensions.Design, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Printing, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceProcess, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.AccountManagement, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.Activities, Version=3.0.0.000000, Culture=neutral, PublicKeyToken=31BF3856AD364E35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Tasks.v3.5, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge.Dtc, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic.Activities.Compiler, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Utilities, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.IdentityModel.Selectors.dll\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.WorkflowServices, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel.Selectors, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.WorkflowServices, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IO.Log, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.Protocols, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.IO.Log.dll\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClient, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClientsideProviders, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\ListenedState]
"RootstoreDirty" = "1"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Entity, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/Microsoft.Transactions.Bridge.dll\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.EnterpriseServices, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge.Dtc, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Deployment, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.ApplicationServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationUI, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCFFRasterizer, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsFormsIntegration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.Net/Framework/v3.0/WPF/PresentationFontCache.exe\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationProvider, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge.Dtc, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Management.Instrumentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Management.Instrumentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClient, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Tasks.v3.5, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\CustomMarshalers, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Numerics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v2.0.50727/dfsvc.exe\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationUI, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\AspNetMMCExt, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Speech, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Channels, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Speech, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationProvider, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/ComSvcConfig.exe\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/SMSvcHost.exe\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Classic, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.SqlXml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Web, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Net, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Input.Manipulations, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Input.Manipulations, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClient, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic.Activities.Compiler, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/dfsvc.exe\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsFormsIntegration, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms.DataVisualization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Conversion.v3.5, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.Net/Framework/v3.0/WPF/PresentationFontCache.exe]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IO.Log, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Mobile, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/ServiceModelReg.exe]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationTypes, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.WorkflowServices, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.AccountManagement, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Deployment, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Configuration.Install, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.IdentityModel.Selectors.dll\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.Runtime.Serialization.dll\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationUI, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Speech, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\SMDiagnostics, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Net, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.Protocols, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic.Compatibility, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.DataSetExtensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Framework, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/WsatConfig.exe\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Security, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Transactions, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Extensions.Design, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClient, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.DataAnnotations, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn.Contract, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.DataSetExtensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.IO.Log.dll\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.AccountManagement, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities.Presentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/dfsvc.exe\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClientsideProviders, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationUI, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Discovery, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Presentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualC, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms.DataVisualization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities.Presentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Framework, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationProvider, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Framework, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Accessibility, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Transactions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCore, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.Activities, Version=3.0.0.000000, Culture=neutral, PublicKeyToken=31BF3856AD364E35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.Protocols, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.DataSetExtensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.DurableInstancing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.Protocols, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Utilities.v3.5, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge.Dtc, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Messaging, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.ServiceModel.dll]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge.Dtc, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Engine, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.Runtime.Serialization.dll\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/SMSvcHost.exe\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities.DurableInstancing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Royale, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCFFRasterizer, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.IdentityModel.Selectors.dll]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Transactions, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\ReachFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\AspNetMMCExt, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Net, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic, Version=8.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/ComSvcConfig.exe]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.Activities, Version=3.0.0.000000, Culture=neutral, PublicKeyToken=31BF3856AD364E35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel.Selectors, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Engine, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationProvider, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Configuration.Install, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\ReachFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsFormsIntegration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Engine, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationBuildTasks, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v2.0.50727/dfsvc.exe]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClient, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic.Compatibility.Data, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Deployment, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.Protocols, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Transactions.Bridge, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.ComponentModel, Version=3.0.0.000000, Culture=neutral, PublicKeyToken=31BF3856AD364E35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Workflow.Runtime, Version=3.0.0.000000, Culture=neutral, PublicKeyToken=31BF3856AD364E35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationUI, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsFormsIntegration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Net, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Messaging, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IO.Log, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\CustomMarshalers, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\ReachFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.Net/Framework/v3.0/WPF/PresentationFontCache.exe\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AD 09 45 F2 E6 D6 89 CA 58 2C E5 73 F4 A7 13 42"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.Protocols, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic, Version=8.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic.Compatibility, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Services.Client, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Configuration.Install, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Web, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCFFRasterizer, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Accessibility, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.ServiceModel.dll\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.ServiceModel.dll\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Luna, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Services.Client, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceProcess, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Deployment, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic.Compatibility, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.IO.Log.dll\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.IdentityModel.Selectors, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v3.0/Windows Communication Foundation/SMDiagnostics.dll\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.AddIn.Contract, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Extensions.Design, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities.DurableInstancing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/WINDOWS/Microsoft.NET/Framework/v4.0.30319/SMSvcHost.exe]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Tasks, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Net, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationCFFRasterizer, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Utilities.v3.5, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationTypes, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\ReachFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic.Compatibility, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Serialization.Formatters.Soap, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationBuildTasks, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Xml.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.ApplicationServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\AspNetMMCExt, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Windows.Presentation, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.DirectoryServices.AccountManagement, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Device, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClient, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Security, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Transactions, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.Entity, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Scenario" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.ApplicationServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsFormsIntegration, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Remoting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationFramework.Aero, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ComponentModel.Composition, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.IdentityModel.Selectors.dll\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.IO.Log.dll]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Status" = "2"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.ServiceModel.Discovery, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Conversion.v3.5, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Framework, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualBasic.Compatibility.Data, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Utilities, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationClientsideProviders, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Web.Services, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.VisualC, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\Microsoft.Build.Tasks, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Activities.DurableInstancing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\C:/Program Files/Reference Assemblies/Microsoft/Framework/v3.0/System.Runtime.Serialization.dll]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\WindowsFormsIntegration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Data.DataSetExtensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]
"Status" = "3"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\PresentationUI, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\1]
"Scenario" = "32"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Runtime.Remoting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\System.Drawing.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\0]
"Status" = "0"

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\UIAutomationProvider, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]
"Status" = "3"

Dropped PE files

MD5	File path
53406e9988306cbd4537677c5336aba4	c:\Documents and Settings\"%CurrentUserName%"\Application Data\Adobe\Support\prerequisites\.NET Framework 4.0\dotNetFx40_Full_setup.exe
ffd68bdede50e5d9d90aacd63cd2404a	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM1.tmp
ce284454c16cd202961bd4a7f1ff105d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM100.tmp
c03ef8e3d7e432d7f4fd515e75ce18fb	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM106.tmp
d1a1bac3f04a71fdbbcae5c2a3203bb6	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM3.tmp
50c2e62660c7c1d26c60d320cc61f8a6	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM35.tmp
12f5582eeef2464f90f37d288fe8a159	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM36.tmp
8733245b8d7a0038f46f65f945584e6f	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM39.tmp
bd95e822e7a958bbca842d078426a151	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM40.tmp
eafda5be5899d806afde417f71d43a1c	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM45.tmp
48db4bfce6f3476dfa6602546f5fb5d4	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM46.tmp
019ab25686601f42444208fefc86bc59	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM49.tmp
311db28045536889fc0fd43148c1921f	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM5.tmp
075c68f408d8d810e85122e334e6dbbb	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM52.tmp
d4805fb81d30b128eb081750885a31dd	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM53.tmp
22ece0bc222b54ca73ae37d7a65ea93f	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM54.tmp
4c1a8b0cdc3454b8817997520d5304bd	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM55.tmp
b9f719b572d8d440dd8b5401c35b3b6f	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM56.tmp
9d5901b51ffee8766db7d34fa1ed232c	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM57.tmp
9472a0184e75c8733d9faf8c20e867b4	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM66.tmp
ac822be8ffb08e7ea2ad573b9f87ea71	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM67.tmp
b06190af451b2037ff075aeb5d21e26f	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM68.tmp
07a5f2043bab61711f1c955f61df70d6	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM69.tmp
8c6af35602856595601f3cffc70317d8	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM7.tmp
c976ceb4be1daf3a848c11a4adf224ba	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM71.tmp
ded9ec09a15757005bae4d7e39cdf6a8	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM72.tmp
aea0323e45bcfce6fe396cb6463e948b	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM73.tmp
3b2574a4bcaab325288db198e4b9cae6	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM8.tmp
0df73b628afb86410d7a03cd3b3794a8	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM88.tmp
090a189f4eeb3c0b76e97acdb1a71c92	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM92.tmp
50542c90567698cb0c0c02f71eebea60	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IDM_Setup_Temp\IDM94.tmp
35b62b395968b7754c298fbb410e9821	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1025\SetupResources.dll
7c136b92983cec25f85336056e45f3e8	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1028\SetupResources.dll
62876c2fe28b1b5c434b9fad80abe9f9	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1029\SetupResources.dll
9f0cd8981979154cc2a6393da42731c5	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1030\SetupResources.dll
7c9ae49b3a400c728a55dd1cacc8ffb2	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1031\SetupResources.dll
e663b67a66adf9375d1d183ca5fdd23d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1032\SetupResources.dll
9547d24ac04b4d0d1dbf84f74f54faf7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1033\SetupResources.dll
881adf55d51976ca592033a7adf620b8	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1035\SetupResources.dll
93f57216fe49e7e2a75844edfccc2e09	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1036\SetupResources.dll
06cc83e6c677db13757df4242f5679f7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1037\SetupResources.dll
c1bf3d63576d619b24837b72986dfad4	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1038\SetupResources.dll
e4860fc5d4c114d5c0781714f3bf041a	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1040\SetupResources.dll
278fd7595b580a016705d00be363612f	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1041\SetupResources.dll
fcfd69ec15a6897a940b0435439bf5fc	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1042\SetupResources.dll
76d6e9f15d842e6a56ee42c9c5ccabca	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1043\SetupResources.dll
bacea57a781c43738a3b065103479bb5	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1044\SetupResources.dll
550c79640eee713c73eb67b0736a92e6	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1045\SetupResources.dll
86cb58f2b6bc1174d200d0abe5497233	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1046\SetupResources.dll
7ef74af6ab5760950a1d233c582099f1	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1049\SetupResources.dll
28813510b82f45868b5bdc67fff9c9fa	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1053\SetupResources.dll
357a1cbf08a83e657ffae8639ac1212a	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1055\SetupResources.dll
407cdb7e1c2c862b486cde45f863ae6e	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2052\SetupResources.dll
58cb55fa4d9e2f62f675720b1269137d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2070\SetupResources.dll
7c136b92983cec25f85336056e45f3e8	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3076\SetupResources.dll
b057315a8c04df29b7e4fd2b257b75f4	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3082\SetupResources.dll
006f8a615020a4a17f5e63801485df46	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Setup.exe
84c1daf5f30ff99895ecab3a55354bcf	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupEngine.dll
eb881e3dddc84b20bd92abcec444455f	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupUi.dll
8dfbb95989af28058c7431704ce7cd66	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupUtility.exe
3f0363b40376047eff6a9b97d633b750	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\sqmapi.dll
9fef3c3da45fa856d9ec0da6fde9af6b	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\1033\FileTrackerUI.dll
ac055c2bf56886ca96042fcde2d722da	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\AspNetMMCExt.dll
f4e9693f449600a30088a0b16079f3cd	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\Aspnet_perf.dll
26a196cf6a37cc9834a2ca9b3d1b34ff	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe
e544e3f91c08f428cf6b760dbd5ff01f	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe
cc5bb3c28d24acde026493a7b31d7b06	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe
fd9f17a461322f0dc8e40c42b4bbdaff	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\FileTracker.dll
4498209a4aede645a257d641d9946271	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
dbe5f7b95d15ce1e8fec589e2be7048a	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\Microsoft.Build.Conversion.v4.0.dll
8933c2a4df165ea7127e8e60f66cbd22	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\Microsoft.Build.Engine.dll
711f010517dd19571386a5a681b2a2b6	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\Microsoft.Build.Framework.dll
9adf90088ac811f0902131d45cc50cd1	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll
a6384603a99f24faf7bc364d841a21ff	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\Microsoft.Build.Utilities.v4.0.dll
e6d36a05a5544122395aeb305d5f4fc0	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\Microsoft.Build.dll
2d717cdcaf0cddf6f46ed6383cf0e268	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\Microsoft.Data.Entity.Build.Tasks.dll
0c3dce64502a7034a7046a9858376377	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\Microsoft.VisualC.STLCLR.dll
e3a48a1de8670112323b47225a9bc19d	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe
4c35454ccda6fbddcf64301a63058149	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\MmcAspExt.dll
e75731a59119aeda27ba4d52117c7570	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\ServiceMonikerSupport.dll
35b62b395968b7754c298fbb410e9821	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1025\SetupResources.dll
7c136b92983cec25f85336056e45f3e8	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1028\SetupResources.dll
62876c2fe28b1b5c434b9fad80abe9f9	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1029\SetupResources.dll
9f0cd8981979154cc2a6393da42731c5	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1030\SetupResources.dll
7c9ae49b3a400c728a55dd1cacc8ffb2	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1031\SetupResources.dll
e663b67a66adf9375d1d183ca5fdd23d	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1032\SetupResources.dll
9547d24ac04b4d0d1dbf84f74f54faf7	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1033\SetupResources.dll
881adf55d51976ca592033a7adf620b8	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1035\SetupResources.dll
93f57216fe49e7e2a75844edfccc2e09	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1036\SetupResources.dll
06cc83e6c677db13757df4242f5679f7	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1037\SetupResources.dll
c1bf3d63576d619b24837b72986dfad4	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1038\SetupResources.dll
e4860fc5d4c114d5c0781714f3bf041a	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1040\SetupResources.dll
278fd7595b580a016705d00be363612f	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1041\SetupResources.dll
fcfd69ec15a6897a940b0435439bf5fc	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1042\SetupResources.dll
76d6e9f15d842e6a56ee42c9c5ccabca	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1043\SetupResources.dll
bacea57a781c43738a3b065103479bb5	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1044\SetupResources.dll
550c79640eee713c73eb67b0736a92e6	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1045\SetupResources.dll
86cb58f2b6bc1174d200d0abe5497233	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1046\SetupResources.dll
7ef74af6ab5760950a1d233c582099f1	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1049\SetupResources.dll
28813510b82f45868b5bdc67fff9c9fa	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1053\SetupResources.dll
357a1cbf08a83e657ffae8639ac1212a	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1055\SetupResources.dll
407cdb7e1c2c862b486cde45f863ae6e	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2052\SetupResources.dll
58cb55fa4d9e2f62f675720b1269137d	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2070\SetupResources.dll
7c136b92983cec25f85336056e45f3e8	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3076\SetupResources.dll
b057315a8c04df29b7e4fd2b257b75f4	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3082\SetupResources.dll
006f8a615020a4a17f5e63801485df46	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Setup.exe
84c1daf5f30ff99895ecab3a55354bcf	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\SetupEngine.dll
eb881e3dddc84b20bd92abcec444455f	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\SetupUi.dll
8dfbb95989af28058c7431704ce7cd66	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\SetupUtility.exe
3f0363b40376047eff6a9b97d633b750	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\sqmapi.dll
9738fd0238ee4a0832f2a9d4cf69a71a	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Data.Entity.Design.dll
1f398290f4de7b00bccc4dddc193e2d5	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Data.OracleClient.dll
59e3a44249d12758566b9a58c28faec0	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Data.Services.Design.dll
65bbc872e434ff876ab82046cb108c35	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Data.Services.dll
927ee51ae8a5a7666fa0eb0fb9cfb8e1	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Design.dll
da1309d96adb0276985d7acf1dc77c5a	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Drawing.Design.dll
dc0995d3745e11a58264f6bb69702d8c	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Runtime.Caching.dll
09fca625eb5152001aa99b1b1d404382	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.Activation.dll
5e837c27c062ac913e83ad8d49046a96	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.ServiceMoniker40.dll
71864eb9b9b48e6c8d33bfcd123ed465	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.WasHosting.dll
013265dba4d8b6c8c48456902887d515	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.Web.dll
a10dba25feb4c4d816df6ee66840097a	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Web.Abstractions.dll
d9a9f1100f7748b57de453f8667e8dfe	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Web.DataVisualization.Design.dll
f43f36ded8f0dabc95191e0563483fdf	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Web.DataVisualization.dll
ad5657238bfca2a5eede44dab576a877	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Web.DynamicData.Design.dll
4bb5ce66e9f6190ac45a34ba4a460bf2	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Web.DynamicData.dll
9f47605fa58b9d87003ec77c158f38df	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Web.Entity.Design.dll
82f4a38b85c9cb91cd9f10f2f60f22d6	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Web.Entity.dll
c408b912eee4cbbc19fe4b0de272e1b8	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Web.Extensions.Design.dll
4a67e924531d4a58cc7eb33116718858	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Web.Extensions.dll
000176f11ebcf4c256090ee8bdbfadb9	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Web.Mobile.dll
9cdd5c9237d10a8c02860235873aea35	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Web.RegularExpressions.dll
0cd550d02f084d8fd63a26fc94e50c6b	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Web.Routing.dll
cb32cd6955cefc73da2725d570315915	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Web.dll
292734a187736dcd0f96e093586f0f41	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Web.tlb
05e072292a6fb43abcd3e492bcc1bd65	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Windows.Forms.DataVisualization.Design.dll
d5494339252dc11b351084102a1572b0	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Workflow.Activities.dll
a85830d2bfc21f220e7b084899be3f70	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Workflow.ComponentModel.dll
0bdf0abedc0270775b027e7b44807578	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Workflow.Runtime.dll
6f317f21781e7d5914d9a1e8f52b4f84	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.WorkflowServices.dll
e9b6dfeda771c5c9aeaa54bc05627d31	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\System.Xaml.Hosting.dll
431fb33c3a5797238c7d98ca4a4b4060	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\TLBREF.DLL
c5a38fd6f3706a9a12d3557324799652	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationBuildTasks.dll
83cf5753e1c680e5a9245f8e3b177354	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe
a94969a8f7fdd2f12f630638fec1580a	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\XamlBuildTask.dll
a3779c23ecf454b1b280ed251ee0cd5b	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
9b609463552d4413b4e37c9f0870f386	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_filter.dll
7aa67f809b29d42af1723ae9d8b2c9f5	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll
51df5aa2fb9ce29ca9b386889a5262c5	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_rc.dll
eac6e98872921ac26f51822de7217d31	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
9a53baa8684f1b21ee8ba37b0f8a67a9	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
e5883f29a90fc5bb9e6e7aa3c469c103	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe
776acefa0ca9df0faa51a5fb2f435705	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
3e5969dd217a142017bd8a8841c2d68c	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
1a3d6725fe85ae298b002b776eb5db10	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
da312ef6ca9fb3768063bd801ff38a00	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsn.dll
386b17250a9fa30a3346134627e80e64	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\peverify.dll
534fc93a10ec3bc2d045f1228fa758d5	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\webengine.dll
b5ff5ca778284cdc758502282d7eacf3	c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\webengine4.dll
1f398290f4de7b00bccc4dddc193e2d5	c:\WINDOWS\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
cb32cd6955cefc73da2725d570315915	c:\WINDOWS\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll
ac055c2bf56886ca96042fcde2d722da	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\AspNetMMCExt\v4.0_4.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
dbe5f7b95d15ce1e8fec589e2be7048a	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Conversion.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Conversion.v4.0.dll
8933c2a4df165ea7127e8e60f66cbd22	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Engine\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
711f010517dd19571386a5a681b2a2b6	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
9adf90088ac811f0902131d45cc50cd1	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Tasks.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.v4.0.dll
a6384603a99f24faf7bc364d841a21ff	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Utilities.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.v4.0.dll
e6d36a05a5544122395aeb305d5f4fc0	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.dll
0c3dce64502a7034a7046a9858376377	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\v4.0_2.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.STLCLR.dll
e3a48a1de8670112323b47225a9bc19d	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe
c5a38fd6f3706a9a12d3557324799652	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\PresentationBuildTasks\v4.0_4.0.0.0__31bf3856ad364e35\PresentationBuildTasks.dll
9738fd0238ee4a0832f2a9d4cf69a71a	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity.Design\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Entity.Design.dll
59e3a44249d12758566b9a58c28faec0	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Design\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Services.Design.dll
65bbc872e434ff876ab82046cb108c35	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Services.dll
927ee51ae8a5a7666fa0eb0fb9cfb8e1	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Design\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Design.dll
da1309d96adb0276985d7acf1dc77c5a	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Drawing.Design\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
dc0995d3745e11a58264f6bb69702d8c	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Caching\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Caching.dll
09fca625eb5152001aa99b1b1d404382	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Activation\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Activation.dll
5e837c27c062ac913e83ad8d49046a96	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.ServiceMoniker40\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.ServiceMoniker40.dll
71864eb9b9b48e6c8d33bfcd123ed465	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.WasHosting\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.WasHosting.dll
013265dba4d8b6c8c48456902887d515	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Web\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Web.dll
a10dba25feb4c4d816df6ee66840097a	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Web.Abstractions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Abstractions.dll
d9a9f1100f7748b57de453f8667e8dfe	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Web.DataVisualization.Design\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.DataVisualization.Design.dll
f43f36ded8f0dabc95191e0563483fdf	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Web.DataVisualization\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.DataVisualization.dll
ad5657238bfca2a5eede44dab576a877	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Web.DynamicData.Design\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.DynamicData.Design.dll
4bb5ce66e9f6190ac45a34ba4a460bf2	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Web.DynamicData\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.DynamicData.dll
9f47605fa58b9d87003ec77c158f38df	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Web.Entity.Design\v4.0_4.0.0.0__b77a5c561934e089\System.Web.Entity.Design.dll
82f4a38b85c9cb91cd9f10f2f60f22d6	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Web.Entity\v4.0_4.0.0.0__b77a5c561934e089\System.Web.Entity.dll
c408b912eee4cbbc19fe4b0de272e1b8	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions.Design\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.Design.dll
4a67e924531d4a58cc7eb33116718858	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll
000176f11ebcf4c256090ee8bdbfadb9	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Web.Mobile\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
9cdd5c9237d10a8c02860235873aea35	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Web.RegularExpressions\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
0cd550d02f084d8fd63a26fc94e50c6b	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Web.Routing\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Routing.dll
05e072292a6fb43abcd3e492bcc1bd65	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.DataVisualization.Design\v4.0_4.0.0.0__31bf3856ad364e35\System.Windows.Forms.DataVisualization.Design.dll
d5494339252dc11b351084102a1572b0	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.Activities\v4.0_4.0.0.0__31bf3856ad364e35\System.Workflow.Activities.dll
a85830d2bfc21f220e7b084899be3f70	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.ComponentModel\v4.0_4.0.0.0__31bf3856ad364e35\System.Workflow.ComponentModel.dll
0bdf0abedc0270775b027e7b44807578	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.Runtime\v4.0_4.0.0.0__31bf3856ad364e35\System.Workflow.Runtime.dll
6f317f21781e7d5914d9a1e8f52b4f84	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.WorkflowServices\v4.0_4.0.0.0__31bf3856ad364e35\System.WorkflowServices.dll
e9b6dfeda771c5c9aeaa54bc05627d31	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Xaml.Hosting\v4.0_4.0.0.0__31bf3856ad364e35\System.Xaml.Hosting.dll
a94969a8f7fdd2f12f630638fec1580a	c:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\XamlBuildTask\v4.0_4.0.0.0__31bf3856ad364e35\XamlBuildTask.dll
e3a48a1de8670112323b47225a9bc19d	c:\WINDOWS\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5\Microsoft.Workflow.Compiler.exe
6222a4d7dd7a7a4a74f51c712221ccd3	c:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Design\95a46d4775428acf5dd84f12aaa9f06f\System.Design.ni.dll
b4929eb9cb46d2c344801106ed3f07f2	c:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Drawing.Desi#\8f9993d3eb4cd33d1452155f79b23d65\System.Drawing.Design.ni.dll
add7a08e7016694fe1c73dd7498dead6	c:\WINDOWS\system32\aspnet_counters.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   support.exe:1564
   Setup.exe:1896
   lodctr.exe:2772
   lodctr.exe:364
   lodctr.exe:2804
   IDM1.tmp:1760
   aspnet_regiis.exe:3232
   idman621f.exe:1276
   mscorsvw.exe:2860
   mscorsvw.exe:2904
   mscorsvw.exe:1204
   mscorsvw.exe:336
   mscorsvw.exe:3944
   mscorsvw.exe:3800
   mscorsvw.exe:3060
   mscorsvw.exe:1908
   mscorsvw.exe:1488
   mscorsvw.exe:3292
   mscorsvw.exe:4008
   mscorsvw.exe:2568
   mscorsvw.exe:1984
   mscorsvw.exe:2540
   mscorsvw.exe:2132
   mscorsvw.exe:1616
   mscorsvw.exe:2300
   mscorsvw.exe:772
   mscorsvw.exe:2384
   mscorsvw.exe:572
   mscorsvw.exe:2240
   mscorsvw.exe:2816
   mscorsvw.exe:3584
   mscorsvw.exe:2720
   mscorsvw.exe:3744
   mscorsvw.exe:2468
   mscorsvw.exe:3708
   mscorsvw.exe:3356
   mscorsvw.exe:1952
   mscorsvw.exe:4040
   mscorsvw.exe:2956
   mscorsvw.exe:3640
   mscorsvw.exe:1284
   mscorsvw.exe:1044
   mscorsvw.exe:3016
   mscorsvw.exe:2672
   mscorsvw.exe:352
   mscorsvw.exe:3848
   mscorsvw.exe:3532
   %original file name%.exe:1724
   MsiExec.exe:2192
   MsiExec.exe:2492
   MsiExec.exe:2732
   ServiceModelReg.exe:2756
   unlodctr.exe:2632
   mofcomp.exe:3252
   dotNetFx40_Full_setup.exe:652
   TMP12.tmp.exe:2324
   ngen.exe:3920
   ngen.exe:3888

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.vshost.exe.manifest (2 bytes)
   %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Services.msi (7386 bytes)
   %Documents and Settings%\%current user%\Application Data\Adobe\Support\prerequisites\.NET Framework 4.0\dotNetFx40_Full_setup.exe (8737 bytes)
   %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.exe.config (1 bytes)
   %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.vshost.exe (22 bytes)
   %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.vshost.exe.config (625 bytes)
   %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.vshost.exe.manifest (2 bytes)
   %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\decoder.dll (1137 bytes)
   %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Newtonsoft.Json.dll (319 bytes)
   %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.exe.config (625 bytes)
   %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\GoogleSearchDotnet.xml (140 bytes)
   %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\GoogleSearchDotnet.pdb (194 bytes)
   %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\GoogleSearchDotnet.dll (90 bytes)
   %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.pdb (73 bytes)
   %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\Autoupdate.pdb (30 bytes)
   %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\CSCommonLib.dll (110 bytes)
   %Documents and Settings%\%current user%\Application Data\Adobe\Support 1.0.0\install\E7B97CC\KeywordService.vshost.exe.config (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1037\SetupResources.dll (16 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate8.ico (894 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1038\SetupResources.dll (18 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_20151028_194612849.html (1754040 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupUtility.exe (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1040\eula.rtf (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Setup_20151028_194612255.html (169496 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759AD (813 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1036\SetupResources.dll (18 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Setup.ico (36 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1037\LocalizedData.xml (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1029\LocalizedData.xml (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1040\LocalizedData.xml (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1049\SetupResources.dll (18 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\A1377F7115F1F126A15360369B165211 (597 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\SysReqNotMet.ico (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate1.ico (894 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1030\SetupResources.dll (18 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1033\LocalizedData.xml (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2052\eula.rtf (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1029\eula.rtf (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SplashScreen.bmp (41 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\F90F18257CBB4D84216AC1E1F3BB2C76 (550 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3076\eula.rtf (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1038\eula.rtf (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1044\SetupResources.dll (17 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\stop.ico (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1037\eula.rtf (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate5.ico (894 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_20151028_194612849-MSI_netfx_Extended_x86.msi.txt (1088936 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate3.ico (894 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\3130B1871A126520A8C47861EFE3ED4D (240 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1043\eula.rtf (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1028\LocalizedData.xml (60 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\A1377F7115F1F126A15360369B165211 (260 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate6.ico (894 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Extended\UiInfo.xml (39 bytes)
   C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Setup_2015102 (1284 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate2.ico (894 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1046\eula.rtf (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1031\eula.rtf (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1049\eula.rtf (54 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1032\eula.rtf (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1031\SetupResources.dll (18 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\ParameterInfo.xml (1425 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1040\SetupResources.dll (18 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupUi.xsd (30 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Save.ico (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1031\LocalizedData.xml (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1041\LocalizedData.xml (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\DisplayIcon.ico (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\UiInfo.xml (38 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Print.ico (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2070\eula.rtf (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1042\SetupResources.dll (15 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\3130B1871A126520A8C47861EFE3ED4D (521 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1045\LocalizedData.xml (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1036\LocalizedData.xml (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1041\SetupResources.dll (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1041\eula.rtf (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Client\Parameterinfo.xml (1281 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1030\eula.rtf (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1028\eula.rtf (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupUi.dll (1425 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1035\SetupResources.dll (18 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1046\SetupResources.dll (18 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3082\LocalizedData.xml (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1042\LocalizedData.xml (65 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1032\LocalizedData.xml (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3082\eula.rtf (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1029\SetupResources.dll (18 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1045\SetupResources.dll (18 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1046\LocalizedData.xml (601 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\F90F18257CBB4D84216AC1E1F3BB2C76 (304 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1030\LocalizedData.xml (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1025\LocalizedData.xml (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1042\eula.rtf (12 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1033\SetupResources.dll (17 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1053\LocalizedData.xml (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2052\SetupResources.dll (14 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\warn.ico (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1038\LocalizedData.xml (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\HFI2.tmp.html (22 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1053\eula.rtf (3 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\696F3DE637E6DE85B458996D49D759AD (288 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate4.ico (894 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1044\eula.rtf (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\header.bmp (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1035\eula.rtf (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3076\LocalizedData.xml (60 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1032\SetupResources.dll (19 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1043\LocalizedData.xml (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Strings.xml (14 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1025\SetupResources.dll (17 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupEngine.dll (5873 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1044\LocalizedData.xml (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\watermark.bmp (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1035\LocalizedData.xml (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\sqmapi.dll (673 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\HFI5.tmp.html (54394 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\SysReqMet.ico (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Client\UiInfo.xml (39 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1049\LocalizedData.xml (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1055\SetupResources.dll (17 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1045\eula.rtf (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1055\LocalizedData.xml (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2070\LocalizedData.xml (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1036\eula.rtf (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Setup.exe (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1028\SetupResources.dll (14 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1033\eula.rtf (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1055\eula.rtf (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Extended\Parameterinfo.xml (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3082\SetupResources.dll (18 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2052\LocalizedData.xml (60 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1043\SetupResources.dll (19 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Graphics\Rotate7.ico (894 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1025\eula.rtf (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\DHtmlHeader.html (16 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3076\SetupResources.dll (14 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2070\SetupResources.dll (18 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1053\SetupResources.dll (17 bytes)
   %System%\config (200 bytes)
   %System%\config\system (5239 bytes)
   %Program Files%\Adobe\Support\list.dll (97 bytes)
   %System%\config\SYSTEM.LOG (8433 bytes)
   %System%\perfc009.dat (76 bytes)
   %System%\PerfStringBackup.INI (3361 bytes)
   %System%\PerfStringBackup.TMP (1480360 bytes)
   %System%\perfh009.dat (1756 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RGI58.tmp (9639 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RGI55.tmp-tmp (9 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RGI59.tmp (9639 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RGI58.tmp-tmp (9 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ASPNETSetup_00000.log (91534 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RGI57.tmp-tmp (9 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RGI54.tmp (9639 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RGI53.tmp-tmp (9 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RGI59.tmp-tmp (9 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RGI54.tmp-tmp (9 bytes)
   %WinDir%\assembly\NativeImages_v4.0.30319_32\Temp\fa8-0\System.Design.dll (821943 bytes)
   %WinDir%\assembly\NativeImages_v4.0.30319_32\Temp\7c0-0\System.Drawing.Design.dll (28176 bytes)
   %WinDir%\Microsoft.NET\Framework\v4.0.30319\ngen_service.log (514 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\support.exe (32766 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\idman621f.exe (21530 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\diskcost.html (145 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\rmfiles.html (145 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\cancel.png (395 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\jquery-1.3.2.js (61857 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\box-repair.png (457 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\resume.html (145 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\back.png (328 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\outofrbdisk.html (145 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\retry.png (415 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\welcome.html (145 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\progress.html (337 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\check.png (333 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\pngfix\DD_belatedPNG_0.0.8a.js (1969 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\customize.html (337 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\box-add-remove.png (457 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\common.js (145 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\folder.html (337 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\client.png (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\verifyrepair.html (145 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\exit.html (145 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\style.css (337 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\setuptype.html (337 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\client_server.png (73 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\outofdisk.html (145 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\progress\progressbar.js (302 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\fatalerror.html (337 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\box.png (337 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\verifyready.html (73 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\box-custom.png (457 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\prepare.html (73 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\print.png (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\server.png (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\box-remove.png (145 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\button-large-bg.png (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\userexit.html (145 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\fileinuse.html (145 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\varstyle.css (232 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\maintwelcome.html (145 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\progress\progressbar.css (407 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\next.png (333 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\verifyremove.html (145 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\{C9AED754-BED9-4F5C-9E74-587D3E7B97CC}\Spring.742DA8B7\maintype.html (457 bytes)
   %WinDir%\assembly\tmp\751VHO3H\System.ServiceModel.Activation.dll (6360 bytes)
   %WinDir%\assembly\tmp\5E7SDNDD\System.Web.DataVisualization.dll (48928 bytes)
   %WinDir%\assembly\tmp\8SHHTI8S\Microsoft.Workflow.Compiler.manifest (491 bytes)
   %WinDir%\assembly\tmp\G78P5KRU\Microsoft.VisualC.STLCLR.dll (1552 bytes)
   %WinDir%\assembly\tmp\I7AW9OUF\System.Web.Abstractions.dll (784 bytes)
   %WinDir%\assembly\tmp\QI3T4ABF\System.Data.Services.dll (23296 bytes)
   %WinDir%\assembly\tmp\19BC9HZ9\System.Web.Entity.Design.dll (5064 bytes)
   %WinDir%\assembly\tmp\EC0KHXJI\System.Web.Extensions.dll (56684 bytes)
   %WinDir%\assembly\tmp\N2NGQG0N\System.Xaml.Hosting.dll (784 bytes)
   %WinDir%\assembly\tmp\YCTE7B33\PresentationBuildTasks.dll (19592 bytes)
   %WinDir%\assembly\tmp\IZN06KEA\System.Web.dll (165798 bytes)
   %WinDir%\assembly\tmp\2HOW8PT9\System.Web.DynamicData.dll (8560 bytes)
   %WinDir%\assembly\tmp\5QX1UWUX\System.ServiceModel.ServiceMoniker40.dll (12 bytes)
   %WinDir%\assembly\tmp\PTS7XXL1\Microsoft.Build.Conversion.v4.0.dll (2392 bytes)
   %WinDir%\assembly\tmp\TZSDFI1C\System.Data.Services.Design.dll (6360 bytes)
   %WinDir%\assembly\tmp\QWR2CQVO\Microsoft.Build.Tasks.v4.0.dll (33391 bytes)
   %WinDir%\assembly\tmp\TVKYS1EU\System.Web.Entity.dll (5064 bytes)
   %WinDir%\assembly\tmp\MHBOWRSB\System.WorkflowServices.dll (15168 bytes)
   %WinDir%\assembly\tmp\RKNSA6MO\System.Workflow.ComponentModel.dll (44462 bytes)
   %WinDir%\assembly\tmp\M3WMBDX6\AspNetMMCExt.dll (16944 bytes)
   %WinDir%\assembly\tmp\DARCI67A\Microsoft.Build.dll (37025 bytes)
   %WinDir%\assembly\tmp\9XRLSSVY\System.Web.RegularExpressions.dll (2392 bytes)
   %WinDir%\assembly\tmp\2M9610E6\Microsoft.Build.Engine.dll (23936 bytes)
   %WinDir%\assembly\tmp\41LYR0G2\System.Web.Mobile.dll (27704 bytes)
   %WinDir%\assembly\tmp\2L7ZOCXU\System.Web.Extensions.Design.dll (11344 bytes)
   %WinDir%\assembly\tmp\PU3CE29F\System.Web.Routing.dll (784 bytes)
   %WinDir%\assembly\tmp\VQR78MV4\System.Windows.Forms.DataVisualization.Design.dll (2392 bytes)
   %WinDir%\assembly\tmp\87SD3538\Microsoft.Build.Utilities.v4.0.dll (8184 bytes)
   %WinDir%\assembly\tmp\RVQHRR45\System.Drawing.Design.dll (3312 bytes)
   %WinDir%\assembly\tmp\R8P3CY5W\System.ServiceModel.WasHosting.dll (784 bytes)
   %WinDir%\assembly\tmp\3NPDCTUI\System.Data.OracleClient.dll (16944 bytes)
   %WinDir%\assembly\tmp\MD8A1L6R\XamlBuildTask.dll (3312 bytes)
   %WinDir%\assembly\tmp\5B8HO84G\Microsoft.Build.Framework.dll (3616 bytes)
   %WinDir%\assembly\tmp\0MP4V5FE\System.Web.DataVisualization.Design.dll (3312 bytes)
   %WinDir%\assembly\tmp\8DKF866A\System.Design.dll (165081 bytes)
   %WinDir%\assembly\tmp\XRR185J6\System.ServiceModel.Web.dll (11344 bytes)
   %WinDir%\assembly\tmp\8SHHTI8S\Microsoft.Workflow.Compiler.exe (784 bytes)
   %WinDir%\assembly\tmp\NLG7DXKH\System.Data.Entity.Design.dll (27504 bytes)
   %WinDir%\assembly\tmp\O334KH0J\System.Workflow.Runtime.dll (17848 bytes)
   %WinDir%\assembly\tmp\9LDLZFYY\System.Runtime.Caching.dll (3312 bytes)
   %WinDir%\assembly\tmp\G5DZJJ2D\System.Web.DynamicData.Design.dll (1552 bytes)
   %WinDir%\assembly\tmp\GSJR9SJ4\System.Workflow.Activities.dll (33455 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\dd_wcf_CA_smci_20151028_174648_520.txt (21652 bytes)
   %System%\wbem\Logs\mofcomp.log (1883 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\tmp56.tmp (13484 bytes)
   %System%\wbem\AutoRecover\807DD20ADF6F5D5EEA0C4E4CF016E69E.mof (216 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1042\eula.rtf (12 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1049\SetupResources.dll (18 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\2070\LocalizedData.xml (1425 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\SetupUtility.exe (886 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\Graphics\SysReqMet.ico (1 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1025\LocalizedData.xml (555 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\2070\eula.rtf (4 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1038\LocalizedData.xml (493 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1045\LocalizedData.xml (638 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\UiInfo.xml (376 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\2070\SetupResources.dll (18 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1053\LocalizedData.xml (579 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1036\eula.rtf (3 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate8.ico (894 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1037\eula.rtf (860 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1029\SetupResources.dll (18 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1040\eula.rtf (3 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\sqmapi.dll (531 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1055\eula.rtf (3 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1040\SetupResources.dll (18 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\Extended\UiInfo.xml (959 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\ParameterInfo.xml (2631 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1030\LocalizedData.xml (427 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1025\eula.rtf (7 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1028\SetupResources.dll (14 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1041\eula.rtf (10 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1055\SetupResources.dll (17 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1044\LocalizedData.xml (203 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1028\LocalizedData.xml (423 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\watermark.bmp (1212 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Print.ico (1 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate6.ico (894 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1053\SetupResources.dll (619 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\SetupUi.dll (1564 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1032\SetupResources.dll (711 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\Graphics\warn.ico (10 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\SetupUi.xsd (30 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\SplashScreen.bmp (41 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1042\SetupResources.dll (15 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Setup.ico (394 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate4.ico (894 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1044\SetupResources.dll (17 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1028\eula.rtf (6 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1043\SetupResources.dll (19 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1046\SetupResources.dll (117 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1033\eula.rtf (3 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\3076\eula.rtf (6 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate2.ico (894 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate3.ico (894 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\3082\LocalizedData.xml (423 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\Setup.exe (1356 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1029\LocalizedData.xml (380 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\2052\SetupResources.dll (14 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1046\LocalizedData.xml (817 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1038\SetupResources.dll (18 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1043\eula.rtf (3 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1033\SetupResources.dll (17 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1036\LocalizedData.xml (104 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\Client\UiInfo.xml (39 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1031\eula.rtf (3 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1032\eula.rtf (8 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1053\eula.rtf (3 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1037\LocalizedData.xml (556 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1032\LocalizedData.xml (849 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\Graphics\stop.ico (10 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate5.ico (894 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\header.bmp (3 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\3082\SetupResources.dll (564 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1033\LocalizedData.xml (658 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1030\SetupResources.dll (18 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\Client\Parameterinfo.xml (1937 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\Strings.xml (14 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\Graphics\SysReqNotMet.ico (1 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1029\eula.rtf (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\dd_dotNetFx40_Full_setup_decompression_log.txt (5605 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\3076\SetupResources.dll (14 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1037\SetupResources.dll (16 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\2052\eula.rtf (5 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\DisplayIcon.ico (875 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\3082\eula.rtf (3 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1040\LocalizedData.xml (1164 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate7.ico (894 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1045\eula.rtf (4 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1035\eula.rtf (3 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1046\eula.rtf (3 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1035\SetupResources.dll (981 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1049\LocalizedData.xml (600 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1025\SetupResources.dll (459 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1031\LocalizedData.xml (930 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1041\LocalizedData.xml (249 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Save.ico (1 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1049\eula.rtf (229 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1055\LocalizedData.xml (872 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\Graphics\Rotate1.ico (894 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1035\LocalizedData.xml (924 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\Extended\Parameterinfo.xml (711 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1043\LocalizedData.xml (429 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1044\eula.rtf (3 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1038\eula.rtf (4 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1030\eula.rtf (3 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1042\LocalizedData.xml (950 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\2052\LocalizedData.xml (566 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1031\SetupResources.dll (18 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1045\SetupResources.dll (18 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1036\SetupResources.dll (18 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\3076\LocalizedData.xml (148 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\DHtmlHeader.html (322 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\1041\SetupResources.dll (252 bytes)
   C:\b677a0af2311ba9e2f8238db391cdc\SetupEngine.dll (5705 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\TMP12.tmp.exe.tmp\netfx_Extended.mzz (263065 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\dd_TMP12.tmp_decompression_log.txt (1272 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\TMP12.tmp.exe.tmp\netfx_ExtendedCab.msi (26 bytes)
   %WinDir%\Microsoft.NET\Framework\v4.0.30319\ngen.log (43210 bytes)
   

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\RarSFX0]
   "support.exe" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\RarSFX0\support.exe /exenoupdates /exelang 0 /prereqs 1 /qn"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.